Skip to main content

AWS Billing Exports: Data Exports and CUR

Spotto reads AWS cost data from a billing export that AWS delivers to S3: an AWS Data Export (recommended) or a legacy Cost and Usage Report (CUR). Billing is optional. Without it, Spotto still shows resources, security and recommendations, but no costs.

Spotto uses an export you already have. It never creates or changes exports, buckets or KMS keys. Adding billing takes three steps:

  1. Find your export details in AWS.
  2. Add the billing source in Spotto.
  3. Give the roles billing access.

No export yet? See create a billing export first.

How Spotto Reads A Billing Export​

Up to three accounts are involved. They're often the same account:

The export definition account, usually the management account, holds the Data Export or CUR. The billing payer account is whose charges the export covers; Spotto uses it to label the data and it needs no extra access. AWS delivers the files to your billing bucket in the S3 storage account, which can be the same account or a separate billing or data account; the first files can take up to 24 hours. Spotto reads the one export definition with SpottoBillingExportRead in the definition account, and lists and reads the export folder with the storage account's role, plus the KMS key policy if a key is used. It checks the definition matches what you entered, then imports cost history. Example path: s3://example-billing/cur2/111122223333/cid-cur2/data/…, where example-billing is the bucket name, cur2/111122223333 is the S3 base prefix, cid-cur2 is the export name and AWS adds the rest. The base prefix and export name together are the only folder Spotto can read. Enter the prefix exactly as configured on the export and the export name separately.The export definition account, usually the management account, holds the Data Export or CUR. The billing payer account is whose charges the export covers; Spotto uses it to label the data and it needs no extra access. AWS delivers the files to your billing bucket in the S3 storage account, which can be the same account or a separate billing or data account; the first files can take up to 24 hours. Spotto reads the one export definition with SpottoBillingExportRead in the definition account, and lists and reads the export folder with the storage account's role, plus the KMS key policy if a key is used. It checks the definition matches what you entered, then imports cost history. Example path: s3://example-billing/cur2/111122223333/cid-cur2/data/…, where example-billing is the bucket name, cur2/111122223333 is the S3 base prefix, cid-cur2 is the export name and AWS adds the rest. The base prefix and export name together are the only folder Spotto can read. Enter the prefix exactly as configured on the export and the export name separately.

For a standalone account, all three are the same account. In an organization, the export is usually defined in the management account, and sometimes delivered to a bucket in a separate billing or data account. All three must be accounts you've included in Spotto.

Step 1: Find Your Export Details​

In the AWS console, sign in to the account where the export is defined, usually the management account. Open Billing and Cost Management > Data Exports and select your export. Copy:

Spotto fieldWhere to find it
Data Export ARNThe export's ARN
Data Export Name (Export.Name)The export name, such as cid-cur2
S3 Bucket NameThe destination bucket, without s3://
AWS-Configured S3 Base PrefixThe destination path prefix, exactly as shown. Leave it empty if the export delivers to the bucket root.
S3 Bucket RegionThe destination Region
Copy the prefix, not the full path

AWS delivers files to <base prefix>/<export name>/.... Enter the prefix and the export name separately, as in the example path above. A prefix that already includes the export name points Spotto at the wrong folder.

You also need two values only in some setups:

  • KMS Key ARN: only if the bucket encrypts files with a customer-managed KMS key. Check the bucket's Properties > Default encryption in the S3 console. If it shows a key you manage, copy the full key ARN, not an alias.
  • S3 Bucket Owner Account ID: only if a different account owns the bucket than the account whose role will read it.
Prefer the AWS CLI?

Run these in AWS CloudShell in the account where the export is defined:

aws bcm-data-exports list-exports --region us-east-1
aws bcm-data-exports get-export --export-arn <export-arn> --region us-east-1

From get-export, copy Export.ExportArn, Export.Name, and under Export.DestinationConfigurations.S3Destination, S3Bucket, S3Prefix and S3Region.

For a legacy CUR, run aws cur describe-report-definitions --region us-east-1 and copy ReportName, S3Bucket, S3Prefix and S3Region.

To check for a KMS key, run aws s3api get-bucket-encryption --bucket <bucket-name>. If SSEAlgorithm is aws:kms and KMSMasterKeyID is a key you manage, get its full ARN with aws kms describe-key --key-id <value> --query KeyMetadata.Arn.

Step 2: Add The Billing Source In The Portal​

On the AWS setup page, go to the Billing step:

  1. Select Add Billing Source.
  2. Choose the Export Type: AWS Data Exports (Recommended) or Legacy Cost and Usage Report (CUR).
  3. With more than one account, choose the Export Definition Account, Billing Payer Account and S3 Storage Account.
  4. Under Data Export Details, enter the values from step 1. For a legacy CUR, enter the Legacy CUR Report Name instead of the ARN and export name.
  5. With more than one account, choose the Billing Coverage: All Accounts, or Selected Accounts if the export covers only some of them.

Then select Create or Update. Spotto checks that the export definition matches what you entered.

Step 3: Give The Roles Billing Access​

The export definition account and the S3 storage account need billing permissions in their roles.

Two AWS policies outside the role may also need a change:

  • KMS key policy: if you entered a KMS key, the key policy must allow the storage account's role to use kms:Decrypt and kms:DescribeKey. The role's own permissions aren't enough for KMS.
  • S3 bucket policy: if another account owns the bucket, its bucket policy must allow the storage account's role.

The exact permissions are in AWS permissions Spotto needs.

Create A Billing Export​

If you don't have an export yet, create one in the management account so it covers every account in the organization:

  1. In Billing and Cost Management > Data Exports, select Create.
  2. Choose Standard data export with the CUR 2.0 table, and the Parquet format.
  3. Choose an S3 bucket for delivery, then create the export.

See the AWS guide to creating Data Exports. AWS can take up to 24 hours to deliver the first files. You can add the export to Spotto straight away.

Discover A Data Export Instead​

If you can't get the export details yourself, Spotto can list the exports for you. It takes two rounds in AWS, because the role has to exist before it can see your exports:

  1. Deploy the export definition account's role first, without billing.
  2. Add the billing source in Spotto and choose the Export Definition Account. Leave the export details empty.
  3. On Deploy Access, choose Manual IAM. For that account, select Generate Role Instructions and add the first SpottoBillingExportRead policy to its role. It can only list exports.
  4. Back on Billing, under Or Discover Data Exports from AWS, select Discover Exports, and choose your export under Discovered Export.
  5. On Deploy Access, select Generate Role Instructions again and replace SpottoBillingExportRead with the new version, which can read only the export you chose.
  6. On Billing, select Validate Export Destination. Spotto fills in the S3 destination.

Download Setup Package, for Bash, PowerShell or Terraform, stays disabled until every billing source has its export details, so with those tools you run them once before discovery and once after.

Waiting For The First Files​

If AWS hasn't delivered any files yet, the billing source waits. It isn't flagged as a problem, and scanning carries on. Spotto starts importing costs as soon as files appear. If nothing arrives within 24 hours, check the export's status in Billing and Cost Management > Data Exports, and that it delivers to the bucket and prefix you entered.

Troubleshooting​

See billing source needs attention for validation, KMS and discovery errors.