AWS Cost Explorer Reports

Enabling Cost Explorer

Cost Explorer is not active by default. To enable it, go to the Billing and Cost Management console, find Cost Explorer in the left nav, and click Launch Cost Explorer. It typically takes 24 hours for the initial data to populate.

Enable it immediately on any new AWS account, even if you’re not billing much yet. Historical data before enablement is not backfilled — if you wait until month 3 to enable Cost Explorer, you lose the first 3 months of cost history.

Once enabled, Cost Explorer shows up to 12 months of historical data at daily or monthly granularity. You can view data at the account level (for management accounts in AWS Organizations) or at the individual account level.

Navigating the Cost Explorer interface

Cost Explorer’s main view shows a bar chart of costs over time. The default view is monthly costs by service for the last 6 months. This single view answers the first question most people have: “Which service is costing me the most?”

The key controls:

Date range — change from the default 6 months to any range up to 12 months back, or narrow to a specific week or month to investigate a spike.

Granularity — switch between monthly, daily, and (for some views) hourly. Daily granularity is essential for finding the day a cost spike started.

Group by — this is the most powerful filter. You can group costs by:

• Service (EC2, RDS, CloudWatch, etc.)
• Region (find if unexpected spend is in the wrong region)
• Usage type (more granular than service — shows EC2 hours vs EBS storage separately)
• Tag (requires tagging your resources — groups by any tag key)
• Account (in an Organizations setup — see cost per linked account)
• Availability Zone

Filters — narrow the view to a specific service, region, instance type, or linked account. Filtering to a single service and then grouping by usage type gives you a detailed breakdown of that service.

Finding your most expensive service

The default Cost Explorer view already shows this: the tallest bar in the chart is your most expensive service. But to get an exact number:

1. Set Group by: Service
2. Set date range to last month
3. Switch to Table view (instead of chart)
4. Sort by Total cost descending

You’ll see a ranked list of every service with its monthly cost. For most compute-heavy teams, EC2 is at the top. For data-heavy teams, S3 or data transfer often ranks second.

To find which region is driving most spend:

1. Set Group by: Region
2. If you see spend in a region you don’t use, investigate immediately — it could be a misconfigured resource or, in rare cases, a security incident

Investigating a cost spike: real scenario

A team running a serverless application noticed a $300 spike in costs over one week in November. Their usual weekly spend was around $80. Here’s how they used Cost Explorer to find the cause.

Step 1: Identify the spike week Set granularity to daily, date range to last 30 days. The chart clearly shows one week with much higher bars. The spike starts on November 14.

Step 2: Find which service spiked Set Group by: Service, filter to the spike week. CloudWatch jumps from $3/week to $290/week. Everything else is normal.

Step 3: Drill into CloudWatch Filter to service = CloudWatch. Set Group by: Usage Type. The expensive line item is “USE1-DataProcessing-Bytes” — CloudWatch Logs ingestion. Volume went from 2GB/week to 580GB/week.

Step 4: Find the source Go to CloudWatch Logs console. Sort log groups by stored bytes. One Lambda function’s log group has ingested 570GB in the spike period. Check the Lambda function — a developer added verbose debug logging (logging the entire request body of every invocation) and pushed it on November 14.

Fix: remove the verbose logging, set a log retention policy on the log group (CloudWatch Logs have no default retention — they store forever by default), delete the accumulated logs.

This entire investigation took about 15 minutes using Cost Explorer.

Cost anomaly detection

AWS Cost Anomaly Detection is a feature within Cost Explorer that uses machine learning to identify unusual spending patterns and alert you without you needing to set specific thresholds.

To enable it:

1. In Cost Explorer, go to Anomaly Detection
2. Create an anomaly monitor (account-level, service-level, tag-level, or linked account)
3. Create an alert subscription specifying how you want to be notified and at what dollar threshold (e.g., anomalies above $20)

Anomaly Detection learns your normal spending pattern and flags deviations. It sends daily or immediate alerts depending on your configuration. Unlike Budgets, which compare against a fixed limit, Anomaly Detection adapts to your baseline — so it won’t alert on normal month-end increases that are expected.

Anomaly Detection is a complement to Budgets, not a replacement. Use Budgets for absolute limits. Use Anomaly Detection for unexpected patterns.

Tracking costs by team using tags

If your resources are tagged consistently (e.g., Team: platform, Team: payments), Cost Explorer can show you spend per team. This is the foundation of chargeback and showback models.

To see cost by team:

1. Group by: Tag — select your tag key (e.g., Team)
2. Any untagged resources appear as “No tag value” — this is often a significant slice initially

Tag coverage is rarely 100% from the start. AWS Config can enforce tagging with managed rules. For a tagging strategy that works, see resource tags.

Blended vs unblended costs

In an AWS Organizations context, Cost Explorer can show costs in two ways:

Unblended costs show the actual rate each account was charged. If a linked account’s usage didn’t qualify for any discount, it shows full price. This is the most straightforward for per-account billing.

Blended costs average the discount rates across the entire organization. This can make individual accounts look cheaper than they actually are if they’re benefiting from Reserved Instances purchased in the management account. Blended costs are useful for showing teams what their “fair share” cost is.

For most purposes, unblended costs are clearer and more actionable.

Saving reports and programmatic access

Cost Explorer lets you save custom report configurations so you can return to the same view without reconfiguring filters. Look for Save to report library after setting up a view you want to revisit.

You can also schedule CSV exports of Cost Explorer data to S3, which is useful for loading cost data into BI tools or spreadsheets for further analysis.

For programmatic access, the Cost Explorer API lets you query cost and usage data from scripts or dashboards. The primary API call is GetCostAndUsage:

aws ce get-cost-and-usage \
  --time-period Start=2026-02-01,End=2026-03-01 \
  --granularity MONTHLY \
  --metrics "BlendedCost" \
  --group-by Type=DIMENSION,Key=SERVICE

API calls cost $0.01 each, so don’t call the API on every page load of a dashboard — cache results or schedule exports.