# Costexplorer Diagnostics > Use this skill to investigate and troubleshoot AWS Cost Explorer and Budgets problems by analyzing unexpected costs, cost allocation, tagging, budget alerts, forecast accuracy, budget actions, anomaly detection, savings recommendations, CUR reports, and organizational billing following structured runbooks. Activate when: unexpected cost spikes, cost allocation issues, untagged resources, budget alerts not firing, forecast inaccuracy, budget action failures, anomaly detection problems, false positive anomalies, RI/SP recommendation issues, utilization tracking, CUR setup problems, report delivery failures, linked account cost visibility, consolidated billing issues, or the user says something is wrong with Cost Explorer or Budgets without naming specific symptoms. - Skill: `aws-samples/costexplorer-diagnostics` (Agent Skill, multi-file: 19 files) - Install (CLI): `npx skillmds@latest add aws-samples/costexplorer-diagnostics` - Raw SKILL.md: https://api.skillmd.com/api/skills/aws-samples/costexplorer-diagnostics/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: aws-samples (https://skillmd.com/u/aws-samples) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/aws-samples/costexplorer-diagnostics --- # Cost Explorer Diagnostics ## When to use Any Cost Explorer or Budgets investigation where the console alone is insufficient — unexpected costs, allocation issues, budget alert failures, anomaly detection, savings plan recommendations, CUR configuration, or organizational billing. ## Investigation workflow ### Step 1 — Collect and triage ``` aws ce get-cost-and-usage --time-period Start=,End= --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE aws budgets describe-budgets --account-id aws ce get-anomalies --date-interval StartDate=,EndDate= aws ce get-cost-forecast --time-period Start=,End= --metric UNBLENDED_COST --granularity MONTHLY ``` ### Step 2 — Domain deep dive ``` aws ce get-cost-and-usage --time-period Start=,End= --granularity DAILY --metrics UnblendedCost --group-by Type=DIMENSION,Key=USAGE_TYPE --filter '{"Dimensions":{"Key":"SERVICE","Values":[""]}}' aws ce get-tags --time-period Start=,End= aws ce get-reservation-utilization --time-period Start=,End= aws ce get-savings-plans-utilization --time-period Start=,End= aws cur describe-report-definitions ``` Read `references/guardrails.md` before concluding on any Cost Explorer issue. ## Tool quick reference | Tool / API | When to use | |------------|-------------| | `ce get-cost-and-usage` | Cost breakdown by service, account, region, tag | | `ce get-cost-forecast` | Projected costs for future periods | | `ce get-anomalies` | Detected cost anomalies | | `ce get-tags` | Available cost allocation tags | | `ce get-reservation-utilization` | RI utilization and coverage | | `ce get-savings-plans-utilization` | Savings Plans utilization | | `budgets describe-budgets` | Budget configuration and status | | `budgets describe-notifications-for-budget` | Budget alert configuration | | `cur describe-report-definitions` | CUR report setup | ## Gotchas: Cost Explorer - Cost Explorer data has a 24-48 hour delay. Do not expect real-time cost visibility. - Cost allocation tags must be activated in the Billing console. Creating tags on resources does not automatically make them cost allocation tags. - Budgets evaluate once per day (or per configured period). Budget alerts are not real-time. - Anomaly detection uses machine learning and needs 2+ weeks of historical data to establish baselines. - Savings Plans and Reserved Instances show as separate line items. Amortized cost spreads the upfront payment across the term. - CUR reports are delivered to S3 with a delay of up to 24 hours. The first report may take up to 24 hours to appear. - Linked account costs in Organizations require the management account to enable Cost Explorer access for member accounts. - Unblended cost shows the actual charge. Blended cost averages across the organization. Amortized cost spreads upfront payments. - Cost categories are custom groupings that take up to 24 hours to apply to new data. - Budget actions can automatically apply SCPs, IAM policies, or target EC2/RDS instances when thresholds are breached. ## Anti-hallucination rules 1. Always cite specific cost data, budget configurations, anomaly details, or CUR report status as evidence. 2. Cost Explorer data is delayed 24-48 hours. Never claim real-time cost visibility. 3. Cost allocation tags must be activated separately. Never assume resource tags are automatically cost allocation tags. 4. Budget alerts evaluate periodically, not in real-time. Never claim instant budget notifications. 5. Anomaly detection needs historical data. Never expect anomaly detection to work on new accounts. 6. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive. ## 20 runbooks | Category | IDs | Covers | |----------|-----|--------| | A — Cost Analysis | A1–A3 | Unexpected costs, cost allocation, untagged resources | | B — Budgets | B1–B3 | Budget alerts, forecast accuracy, action failures | | C — Anomaly | C1–C2 | Anomaly detection, false positives | | D — Savings | D1–D2 | RI/SP recommendations, utilization | | E — Reports | E1–E2 | CUR setup, report delivery | | F — Organization | F1–F2 | Linked account costs, consolidated billing | | Z — Catch-All | Z1 | General troubleshooting |