Skip to content
CostReveal
Menu

Connecting AWS to CostReveal, setup guide

The CostReveal team, , 9 minute read

AWS cost attribution starts with the Cost and Usage Report, the line by line billing export AWS writes for your organization. This guide covers how CostReveal reads it: the one CloudFormation stack that sets everything up, the fields you copy back into CostReveal, the cost allocation tags that decide whether your resource tags reach the bill, how Amazon Bedrock spend arrives by model and caller, and how every figure is checked against AWS Cost Explorer.

What the AWS connection reads

CostReveal reads AWS spend from a Cost and Usage Report (CUR 2.0) export in your own account. Nothing is installed in your workloads, and nothing in your account is changed after setup. The role CostReveal assumes is read only, and it can read:

  • the export folder in the bucket the stack creates;
  • your Cost Explorer totals, used as a second, independent check of each month;
  • the list of tags activated for cost allocation, so CostReveal can tell you which of your tag keys reach the report;
  • AWS's own Savings Plans, Reserved Instance and rightsizing recommendations, shown under Insights.

Why the Cost and Usage Report, not Cost Explorer alone

Cost Explorer is convenient, but it aggregates. The Cost and Usage Report is the raw material: every line with its usage quantity, its resource ID, its account, its region and its tags. Attribution needs that detail, because once spend is summed up, the evidence of who caused it is gone.

So CostReveal builds its ledger from the report's lines, and uses Cost Explorer for what it is good at: an independent total for the same month, computed by AWS, that the ledger must match.

What you need before you start

  • Access to your AWS management account, so the export covers every account in your organization.
  • Permission to deploy a CloudFormation stack in us-east-1. AWS Data Exports runs only in that region, and the stack refuses to deploy anywhere else.
  • An owner or admin role in CostReveal.

You do not need an existing export or bucket. The stack creates both, so you never have to match export settings by hand.

Step by step setup

1. Start the connection

Go to Connections and choose Connect AWS. CostReveal issues an external ID for this connection. The role the stack creates can be assumed only by CostReveal's account, and only with this ID, which protects against a third party using CostReveal to reach your account.

2. Deploy the CloudFormation stack

Choose Download template and deploy it in the CloudFormation console, or run the AWS CLI command shown. The template already holds your external ID and CostReveal's account; the only value you choose is a name for the new bucket. The stack creates:

  • a private, encrypted S3 bucket that only AWS billing can write to;
  • a daily CUR 2.0 export in Parquet, with resource IDs and the identity of each Amazon Bedrock caller, of exactly the columns CostReveal reads;
  • a read only IAM role CostReveal can assume with your external ID, allowed to read that export folder, your Cost Explorer totals, which tags are activated for cost allocation, and AWS's recommendations.

3. Copy the outputs and verify

When the stack finishes, copy its outputs into CostReveal: the role ARN, the bucket name, the export name, the prefix and the region. CostReveal checks the format of each field as you type. The real check happens when you choose Verify and connect: CostReveal assumes the role and reads the export before saving anything, and if something is wrong, it points at the field to fix.

4. Wait for AWS's first delivery

AWS delivers the first report within 24 hours of the export being created, and updates it up to three times a day after that. CostReveal reads the connection every four hours once data is flowing. Home fills in as soon as the first report arrives.

Connection states

A connection is always in one of four states, shown under Connections:

  • Setup not finished: the connection exists, but has not yet been verified.
  • Waiting for first data: credentials and access were verified, and CostReveal is waiting for AWS to deliver the first report.
  • Connected: data has been read and the latest read succeeded.
  • Needs attention: the latest read failed, for example because the stack was deleted or the role's policy changed. Everything already read is kept; only new data stops until it is fixed.

How much history you get

Because the stack creates a new CUR 2.0 export, history starts from the month the export is created. AWS adds earlier billing periods to the export on request: open a support case under Billing that names the export and the periods. CostReveal reads every period the export holds, however old, and reads a period again whenever AWS rewrites it, which is where its late charges and corrections land. AWS cannot add months from before the account was created, or before it joined its current organization.

Cost allocation tags: the step most teams miss

CostReveal names who each cost is for from your existing resource tags. For each owner, team, feature, customer and user, it reads a list of tag keys in order, and the first one present wins. The defaults cover common names such as team, owner, feature and customer. Change them per project under Settings, Projects, Tag keys.

The catch is that a tag on a resource does not automatically appear in the bill. AWS includes a tag in the report only after it is activated as a cost allocation tag, from the management account. A tag can be on every resource you own and still be missing from every cost tool. Until it is activated, spend carrying it stays unknown in CostReveal.

Where each of your keys stands

Once the connection has been read, Connections, Read automatically shows each of your project's tag keys in one of three states:

  • In the report: AWS includes it, so CostReveal reads it.
  • Not activated: your resources carry it, but it is not activated, so their costs arrive without it. The command shown activates exactly these keys, spelled as AWS has them.
  • Not seen: it is not in the report.

Activate keys in the Billing console under Cost allocation tags, or with the command shown. Tag keys are case sensitive in AWS, so activate each exactly as your resources spell it. A key appears in AWS only after a resource has used it, which can take up to a day.

AWS shares its list of cost allocation tags only with the management account or a standalone account. When the export is in a member account, CostReveal still knows which keys reach the report, but cannot tell a key waiting for activation from one on no resource yet, so it suggests activating every key not seen.

CostReveal matches a key however the report spells it. CUR 2.0 writes a resource's Cost-Center tag as user_cost_center, and both read as the key cost-center.

Amazon Bedrock arrives through the same connection

Bedrock spend is in the same export, so there is nothing more to connect.

  • One service, by model. Every line AWS files under its Amazon Bedrock product family is shown as Bedrock, whichever vendor's model it is. The model is AWS's own name for it, as the Bedrock console's model catalog shows it.
  • Who called. The export splits Bedrock lines by the IAM user or role that made each call. Tag those principals in IAM, for example with team or customer, and activate the tags in Cost allocation tags, filtered to IAM principal tags. A tag on the resource itself, such as an application inference profile tagged for a customer, comes first; the caller's tag explains what the resource's tags do not.
  • Tokens. Each Bedrock line states what it billed, such as input, output, cache read or cache write tokens, and CostReveal records the quantity.

Usage data does not yet divide Bedrock spend by customer, so Bedrock spend that no tag names stays unknown by customer. A stack deployed with an earlier template still works, but its export lacks the quantities and Bedrock detail; the connection says so, and you can update the stack with the template under Connections, Settings.

What the evidence labels mean for AWS

Every figure in CostReveal carries a basis that says how it is known:

  • DIRECT applies to the service and the model, which AWS reports on every line.
  • INFERRED applies to a team, feature, customer or user named by a resource tag, an IAM principal tag on a Bedrock caller, or an allocation rule that assigns matching lines to an owner.
  • ALLOCATED applies to a cost divided by a split rule (fixed percentages, evenly, or in proportion to explained spend), or to an EKS cluster's node cost divided among workloads by a Kubernetes connection.
  • UNKNOWN is everything else. Untagged spend is shown as unknown, never spread across teams to look complete.

A month AWS has not yet invoiced is shown as not yet invoiced and pending until AWS closes it.

How the figures are checked

  • The ledger is append only. Every line is recorded exactly as AWS reported it. When AWS restates a period, CostReveal records the change as a correction that keeps what was said before, and attribution runs again.
  • Attribution adds up. For every period, what CostReveal attributes must add up exactly to the ledger, on every dimension. If it does not, the period is flagged.
  • A second source. CostReveal compares the ledger with AWS Cost Explorer for the same month. While a month is open the two can briefly differ; once AWS issues the invoice, they must agree to the cent.

What to do after connecting

Check the tag states first. Every key marked Not activated is spend you already tagged but cannot yet see. Then look at Home: its next best action suggests tagging the AWS resources of one service with a team tag, and states what share of the period's total spend that would explain. One tagging pass on that service, followed by activation, usually moves the unknown share more than anything else.

For spend tags cannot reach, such as shared networking or support charges, an allocation rule can name an owner for lines that match conditions such as account, service or usage type, or share them at fixed percentages, evenly, or by explained spend.

From there, Explore groups spend by account (shown by name and ID), region, service, team, feature, customer, user or a custom dimension such as environment, which can be read from tags or set per account. Insights adds forecasts, anomalies and AWS's own savings recommendations. Reading those recommendations costs seven Cost Explorer requests a day, which AWS charges at a cent each.

Removing the connection

Removing the connection under Connections deletes every figure it brought into the project, and the archived report files are deleted within a day. The stack in your account is left as it is; delete it in CloudFormation to remove the export, the role and the bucket.

Frequently asked questions

How long until I see AWS data after connecting? AWS delivers the first report within 24 hours of the export being created. The connection shows Waiting for first data until then, and Home fills in once CostReveal has read it.

Does CostReveal read AWS history from before I connected? History starts from the month the CUR 2.0 export the stack sets up is created, because an export does not include months before it existed. AWS adds earlier billing periods to it on request, through a support case under Billing that names the export and the periods, and CostReveal reads every period the export holds.

Do I need one connection per AWS account? Usually not. Deployed in the management account, the export covers every account in your AWS Organization, and Explore shows each one by name and ID. A separate organization or standalone account needs its own connection.

Why does tagged spend still show as unknown? Almost always because the tag key is not activated as a cost allocation tag. Connections, Read automatically lists each key as In the report, Not activated or Not seen, and gives the command that activates the missing ones.

Does the connection cover Amazon Bedrock? Yes. Bedrock spend arrives in the same export, by model and by the IAM user or role that called it. Tag those principals and activate the tags to name who each call was for.

What does the AWS side cost? AWS charges standard S3 storage for the bucket, and Cost Explorer requests at a cent each: CostReveal makes seven a day for recommendations, one on each read to check which tags are activated, and one for each report AWS delivers, about sixteen a day, or five dollars a month.

Is my AWS data kept separate from other customers? Yes. It is held in CostReveal's database, with each organization isolated by PostgreSQL row level security, enforced in the database itself.

Keep reading

More setup guides