AWS Cost Management lab

AWS Cost Management Lab

Overview

Time to understand where your AWS money is going using the command line. This lab is split into strategic (monthly analysis) and tactical (weekly deep-dive) cost management. You’ll learn to pull spending data, analyze cost patterns, and master the AWS Cost Explorer API.

Prerequisites

EC2 instance with AWS CLI installed and configured or Cloudshell
IAM permissions for Cost Explorer API access

What You’ll Accomplish

Strategic Analysis: Monthly cost patterns for long-term planning
Tactical Analysis: Weekly cost breakdown for operational decisions
Master AWS Cost Explorer CLI commands for automated cost reporting

Part 1: Connect to Your Instance

Get CLI Ready

EC2 Console → your instance → “Connect” → EC2 Instance Connect
Verify AWS CLI is working:

Read and Learn:

aws --version
aws sts get-caller-identity

Copy to Execute:

aws --version && aws sts get-caller-identity

Part 2: Strategic Analysis - Monthly Cost Patterns

Total Monthly Spending

Read and Learn:

aws ce get-cost-and-usage \
    --time-period Start=$(date -d '1 month ago' '+%Y-%m-01'),End=$(date '+%Y-%m-01') \
    --granularity MONTHLY \
    --metrics BlendedCost \
    --query 'ResultsByTime[0].Total.BlendedCost.Amount' \
    --output text

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 month ago' '+%Y-%m-01'),End=$(date '+%Y-%m-01') --granularity MONTHLY --metrics BlendedCost --query 'ResultsByTime[0].Total.BlendedCost.Amount' --output text

What did you observe? This gives you the total AWS spend for strategic budget planning and monthly reviews.

Monthly Spending by Service

Read and Learn:

aws ce get-cost-and-usage \
    --time-period Start=$(date -d '1 month ago' '+%Y-%m-01'),End=$(date '+%Y-%m-01') \
    --granularity MONTHLY \
    --metrics BlendedCost \
    --group-by Type=DIMENSION,Key=SERVICE \
    --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.BlendedCost.Amount]' \
    --output table

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 month ago' '+%Y-%m-01'),End=$(date '+%Y-%m-01') --granularity MONTHLY --metrics BlendedCost --group-by Type=DIMENSION,Key=SERVICE --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.BlendedCost.Amount]' --output table

What did you observe? You’ll see a table showing which services consumed the most budget. This helps identify major cost drivers for strategic decisions like service consolidation or architecture changes.

Monthly Spending by Region

Read and Learn:

aws ce get-cost-and-usage \
    --time-period Start=$(date -d '1 month ago' '+%Y-%m-01'),End=$(date '+%Y-%m-01') \
    --granularity MONTHLY \
    --metrics BlendedCost \
    --group-by Type=DIMENSION,Key=REGION \
    --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.BlendedCost.Amount]' \
    --output table

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 month ago' '+%Y-%m-01'),End=$(date '+%Y-%m-01') --granularity MONTHLY --metrics BlendedCost --group-by Type=DIMENSION,Key=REGION --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.BlendedCost.Amount]' --output table

What did you observe? This shows your geographic cost distribution. Useful for decisions about multi-region deployments, data locality, and compliance requirements.

Part 3: Tactical Analysis - Weekly Operations Focus

From here forward, we’re focusing on last week only for tactical decision-making. Weekly analysis helps you spot trends, catch anomalies, and make operational adjustments before they become expensive problems.

Total Weekly Spending

Read and Learn:

aws ce get-cost-and-usage \
    --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') \
    --granularity DAILY \
    --metrics BlendedCost \
    --query 'sum(ResultsByTime[*].Total.BlendedCost.Amount | [?@ != null] | map(&to_number(@), @))' \
    --output text

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost --query 'sum(ResultsByTime[*].Total.BlendedCost.Amount | [?@ != null] | map(&to_number(@), @))' --output text

What did you observe? This shows your week’s total spend. Compare this to previous weeks to spot trends or unusual spikes that need immediate attention.

Part 4: Weekly Regional Cost Analysis - targeted

We’re focusing specifically on ap-southeast-1 (Asia Pacific - Singapore) for tactical cost analysis. Singapore is a key regional hub for Asia-Pacific operations, and understanding costs here helps optimize your regional deployment strategy.

Singapore Region Weekly Spending

Read and Learn:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' \
'+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost \
--group-by Type=DIMENSION,Key=REGION --query \
'ResultsByTime[*].{Date:TimePeriod.Start,Region:Groups[?Keys[0]==`ap-southeast-1`].Keys[0] | \
[0],Cost:Groups[?Keys[0]==`ap-southeast-1`].Metrics.BlendedCost.Amount | [0]}' --output table

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost --group-by Type=DIMENSION,Key=REGION --query 'ResultsByTime[*].{Date:TimePeriod.Start,Region:Groups[?Keys[0]==`ap-southeast-1`].Keys[0] | [0],Cost:Groups[?Keys[0]==`ap-southeast-1`].Metrics.BlendedCost.Amount | [0]}' --output table

What did you observe? You’ll see output like:

--------------------------------------------
|  Date        | Region         | Cost     |
--------------------------------------------
|  2025-08-12  | ap-southeast-1 | 12.45    |
|  2025-08-13  | ap-southeast-1 | 15.23    |
|  2025-08-14  | ap-southeast-1 | 8.67     |
|  2025-08-15  | ap-southeast-1 | 14.55    |
|  2025-08-16  | ap-southeast-1 | 16.78    |
|  2025-08-17  | ap-southeast-1 | 11.23    |
|  2025-08-18  | ap-southeast-1 | 9.87     |
--------------------------------------------

Look for patterns:

Weekday spikes: Higher costs Mon-Fri might indicate business hour workloads
Weekend drops: Lower weekend costs suggest you might benefit from auto-scaling
Sudden jumps: Unexpected spikes could indicate runaway processes or data transfer events

Part 5: Weekly Service Cost Analysis

Focus on the services that matter most for week-to-week operational decisions.

EC2 Weekly Costs

Read and Learn:

aws ce get-cost-and-usage \
    --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') \
    --granularity DAILY \
    --metrics BlendedCost \
    --group-by Type=DIMENSION,Key=SERVICE \
    --query 'ResultsByTime[*].{Date:TimePeriod.Start,Service:Groups[?Keys[0]==`Amazon Elastic Compute Cloud - Compute`]|[0].Keys[0],Cost:Groups[?Keys[0]==`Amazon Elastic Compute Cloud - Compute`]|[1].Metrics.BlendedCost.Amount}' \
    --output table

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost --group-by Type=DIMENSION,Key=SERVICE --query 'ResultsByTime[*].{Date:TimePeriod.Start,Service:Groups[?Keys[0]==`Amazon Elastic Compute Cloud - Compute`]|[0].Keys[0],Cost:Groups[?Keys[0]==`Amazon Elastic Compute Cloud - Compute`]|[0].Metrics.BlendedCost.Amount}' --output table

What did you observe? You’ll see output like:

---------------------------------------------------------------------
|  Date         | Service                                | Cost     |
---------------------------------------------------------------------
|  2025-08-12   | Amazon Elastic Compute Cloud - Compute | 45.67    |
|  2025-08-13   | Amazon Elastic Compute Cloud - Compute | 52.34    |
|  2025-08-14   | Amazon Elastic Compute Cloud - Compute | 48.92    |
|  2025-08-15   | Amazon Elastic Compute Cloud - Compute | 51.23    |
|  2025-08-16   | Amazon Elastic Compute Cloud - Compute | 49.78    |
|  2025-08-17   | Amazon Elastic Compute Cloud - Compute | 35.12    |
|  2025-08-18   | Amazon Elastic Compute Cloud - Compute | 33.45    |
---------------------------------------------------------------------

Typical patterns:

Consistent costs: Steady numbers suggest reserved instances or constant workloads
Weekday peaks: Higher Mon-Fri costs indicate business-hour scaling
Weekend dips: Lower Sat-Sun costs show successful auto-scaling policies
Gradual increases: Rising trend might indicate growing usage or inefficient resource management

S3 Weekly Costs

Read and Learn:

aws ce get-cost-and-usage \
    --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') \
    --granularity DAILY \
    --metrics BlendedCost \
    --group-by Type=DIMENSION,Key=SERVICE \
    --query 'ResultsByTime[*].Groups[?Keys[0]==`Amazon Simple Storage Service`].Metrics.BlendedCost.Amount' \
    --output text

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost --group-by Type=DIMENSION,Key=SERVICE --query 'ResultsByTime[*].Groups[?Keys[0]==`Amazon Simple Storage Service`].Metrics.BlendedCost.Amount' --output text

What did you observe? You’ll see output like:

0.0000002225
0.0000002476
0.0000002463
0.0000002464
0.0000672604
0.0056448208
0.0001368392

S3 costs should show these patterns:

Steady baseline: Storage costs remain consistent day-to-day
Small variations: Minor daily fluctuations (few cents) are normal for API requests
Sudden spikes: Large jumps indicate data uploads, transfers, or increased API activity
Trending up: Gradual increases suggest growing data storage needs

Data Transfer Weekly Costs

Read and Learn:

aws ce get-cost-and-usage --time-period Start=$(date \
 -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') \
--granularity DAILY --metrics BlendedCost --group-by \
Type=DIMENSION,Key=USAGE_TYPE --query \
'ResultsByTime[*].{Date:TimePeriod.Start,UsageType:Groups[?contains(Keys[0], \
`DataTransfer-Out`)].Keys[0] | [0],Cost:Groups[?contains(Keys[0], \
`DataTransfer-Out`)].Metrics.BlendedCost.Amount | [0]}' --output table

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost --group-by Type=DIMENSION,Key=USAGE_TYPE --query 'ResultsByTime[*].{Date:TimePeriod.Start,UsageType:Groups[?contains(Keys[0], `DataTransfer-Out`)].Keys[0] | [0],Cost:Groups[?contains(Keys[0], `DataTransfer-Out`)].Metrics.BlendedCost.Amount | [0]}' --output table

What did you observe? You’ll see output like:

----------------------------------------------------
|  Date        | UsageType              | Cost     |
----------------------------------------------------
|  2025-08-12  | DataTransfer-Out-Bytes | 5.23     |
|  2025-08-13  | DataTransfer-Out-Bytes | 7.45     |
|  2025-08-14  | DataTransfer-Out-Bytes | 4.12     |
|  2025-08-15  | DataTransfer-Out-Bytes | 8.67     |
|  2025-08-16  | DataTransfer-Out-Bytes | 6.34     |
|  2025-08-17  | DataTransfer-Out-Bytes | 3.89     |
|  2025-08-18  | DataTransfer-Out-Bytes | 4.56     |
----------------------------------------------------

Data transfer patterns to watch:

Consistent baseline: Normal application traffic should be predictable
Business hour spikes: Higher costs during peak usage times
Unexpected jumps: Large increases might indicate data sync jobs or backup operations
Regional patterns: Higher costs might correlate with specific regional data movements

Part 6: Singapore Service Cost Breakdown

Focus on understanding how key services are performing specifically in the Singapore region for tactical optimization.

EC2 Costs in Singapore (Weekly)

Read and Learn:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost --group-by Type=DIMENSION,Key=SERVICE Type=DIMENSION,Key=REGION --output json | jq -r '.ResultsByTime[] | .TimePeriod.Start as $date | .Groups[] | select(.Keys[0] == "Amazon Elastic Compute Cloud - Compute" and .Keys[1] == "ap-southeast-1") | "\($date)\t\(.Keys[0])\t\(.Keys[1])\t\(.Metrics.BlendedCost.Amount)"'

Copy to Execute:

aws ce get-cost-and-usage --time-period Start=$(date -d '1 week ago' '+%Y-%m-%d'),End=$(date '+%Y-%m-%d') --granularity DAILY --metrics BlendedCost --group-by Type=DIMENSION,Key=SERVICE Type=DIMENSION,Key=REGION --output json | jq -r '.ResultsByTime[] | .TimePeriod.Start as $date | .Groups[] | select(.Keys[0] == "Amazon Elastic Compute Cloud - Compute" and .Keys[1] == "ap-southeast-1") | "\($date)\t\(.Keys[0])\t\(.Keys[1])\t\(.Metrics.BlendedCost.Amount)"'

What did you observe? You’ll see output like:

2026-01-31      Amazon Elastic Compute Cloud - Compute  ap-southeast-1  0.6859728824
2026-02-01      Amazon Elastic Compute Cloud - Compute  ap-southeast-1  0.7008
2026-02-02      Amazon Elastic Compute Cloud - Compute  ap-southeast-1  0.7008
2026-02-03      Amazon Elastic Compute Cloud - Compute  ap-southeast-1  0.7008
2026-02-04      Amazon Elastic Compute Cloud - Compute  ap-southeast-1  0.7198324836
2026-02-05      Amazon Elastic Compute Cloud - Compute  ap-southeast-1  17.7764483866
2026-02-06      Amazon Elastic Compute Cloud - Compute  ap-southeast-1  12.6115706301

What You’ve Built

You now have both strategic (monthly) and tactical (weekly) cost analysis capabilities. The monthly view helps with budget planning and architectural decisions, while the weekly view gives you the operational visibility to catch cost anomalies quickly and optimize day-to-day spending patterns.