AWS cost and usage
Two Cost Explorer queries: the daily cost of every service, and the daily cost of the accelerated instance families. Never a resource, never a log, never anything but money.
Access
- Kind
- A read-only key you paste
- What to give
- Read-only IAM access keys
- Why that one
- An IAM user with ce:GetCostAndUsage and nothing else. Keys are tested, then stored encrypted for this organization.
What it attributes on its own
- From the source
- day · service as AWS bills it · accelerated instance family · what AWS charged
- Needs a rule or a trace
- the model and the tokens — a GPU hour and a Textract page have neither · Bedrock, which has its own source that does carry tokens · team, workflow and agent unless a rule maps the service · outcome
The addresses it calls
- https://ce.us-east-1.amazonaws.com/ (Cost Explorer GetCostAndUsage)
Only these. A call anywhere else is refused before it leaves, and every call is logged.
Connecting it
- Create a read-only IAM user. Click Create user and fill the form: Open ↗
- Give it one read action. Open the user, then Permissions → Add permissions → Create inline policy:
- Create an access key. Open the user, then Security credentials → Create access key. Open ↗
- Paste both and click Test and connect. Valistry reads the last seven days, reports which services it found and which it left out, then fills thirty.
Run this on the payer account. A member account usually cannot see its own cost, and Cost Explorer answers $0.00 rather than refusing — which is why the run says so plainly when it happens.