AWS cost and usage
Daily cost and credits of every AWS service. Cost of SageMaker endpoints and GPU servers. Never resource contents, logs or prompts.
Access
- Kind
- Sign in on the vendor's page; nothing typed here
- What to give
- Read-only IAM access keys
- Why that one
- An IAM user with ce:GetCostAndUsage and budgets:ViewBudget, nothing else. AWS bills each Cost Explorer request $0.01; a nightly read makes about ten. Keys are tested, then stored encrypted for this organization.
What it attributes on its own
- From the source
- day; service as AWS bills it; accelerated instance family; what AWS charged; what credits covered, by service and day; Kiro and Amazon Q charges by plan, seat fees included; SageMaker endpoint hours and the calls they answered, by region; the owner of a GPU server, from your AI tag
- Needs a rule or a trace
- the model and the tokens — a GPU hour and a Textract page have neither; Bedrock, which has its own source that does carry tokens; team, workflow and agent unless a rule maps the service; outcome
The addresses it calls
- https://ce.us-east-1.amazonaws.com/ (Cost Explorer GetCostAndUsage)
- https://monitoring.<region>.amazonaws.com/ (CloudWatch ListMetrics, GetMetricData: SageMaker endpoint calls, role only)
- https://sts.us-east-1.amazonaws.com/ (STS AssumeRole, only for a connected role)
Valistry calls only these addresses. It blocks any other call and logs every call.
Connecting it
- Create the user. Sign in to your management (payer) account. Search IAM → Users → Create user. Open ↗
- Add the read policy. In IAM → Users, click valistry-cost. Open ↗
- Create an access key. Search IAM → Users. AWS shows the secret once: copy both. Open ↗
A member account reads its own cost, unless your management account turned off Linked account access.