Connect AWS

CostReveal reads AWS spend from a Cost and Usage Report (CUR 2.0) export in your own account. Nothing is installed in your workloads, and the role CostReveal uses can read that export and nothing else.

What you need

• Access to your AWS management account, so the export covers every account in your organization.
• Permission to deploy a CloudFormation stack in us-east-1. AWS Data Exports runs only in that region; the stack refuses to deploy anywhere else.
• An owner or admin role in CostReveal.

Connect

1. Go to Connections and choose Connect AWS. CostReveal issues an external ID for this connection.
2. Choose Download template and deploy it in CloudFormation, or run the AWS CLI command shown. The template already holds your external ID and CostReveal's account; the only value to choose is a name for the new bucket. It creates:
   • a private, encrypted bucket that only AWS billing can write to;
   • a daily CUR 2.0 export in Parquet, with resource IDs and the identity of each Amazon Bedrock caller, of exactly the columns CostReveal reads;
   • a role CostReveal can assume only with your external ID, allowed to read that export folder, your Cost Explorer totals, which tags are activated for cost allocation, and AWS's own Savings Plans, Reserved Instance and rightsizing recommendations.
3. Copy the stack's outputs into CostReveal and choose Verify and connect. CostReveal assumes the role and reads the export before saving anything, and points at the field to fix if something is wrong.

AWS delivers the first report within 24 hours of the export being created. Home fills in as soon as it arrives, and after that AWS updates the report up to three times a day.

History starts from the month the export is created, as an export holds no month before it. AWS adds earlier billing periods to the export on request: open a support case under Billing that names the export and the periods, and CostReveal reads every period the export holds, however old. AWS cannot add months from before the account was created, or before it joined its current organization.

Make tags explain the spend

CostReveal names who each cost is for from your existing resource tags. For each owner (team, feature, customer and user) it reads a list of tag keys in order, and the first one present wins. The defaults cover common names such as team, owner, feature and customer; change them per project in Settings, Projects, Tag keys.

AWS includes a tag in the report only after it is activated as a cost allocation tag, from the management account. Until then, spend carrying that tag stays unknown in CostReveal. Activate the keys in the Billing console under Cost allocation tags, or with the command shown under Connections, Read automatically. Tag keys are case sensitive in AWS, so activate each exactly as your resources spell it. A key appears in AWS only after a resource has used it, which can take up to a day.

Once the connection has been read, Read automatically shows where each of your project's keys stands:

• In the report: AWS includes it, so CostReveal reads it.
• Not activated: your resources carry it, but it is not activated, so their costs arrive without it. The command activates exactly these, spelled as AWS has them.
• Not seen: it is not in the report.

AWS shares its list of cost allocation tags only with the management account, or a standalone account, and the role may read it with ce:ListCostAllocationTags. When the export is in a member account, CostReveal still knows which keys reach the report, but cannot tell a key waiting for activation from one on no resource yet, so it suggests activating every key not seen. CostReveal matches a key however the report spells it: CUR 2.0 writes a resource's Cost-Center tag as user_cost_center, and both read as the key cost-center.

Spend that no tag names is shown as unknown, never spread across teams. Home shows the single change that would explain the most of it.

Amazon Bedrock

Bedrock spend arrives through the same export; there is nothing more to connect.

• One service, by model. Every line AWS files under its Amazon Bedrock product family is shown as Bedrock, whichever vendor's model it is and whatever product code it is sold under. Its model is AWS's own name for it, as the Bedrock console's model catalog shows it, such as Claude Sonnet 4.6 or Nova Pro, so model is DIRECT.
• Who called. The export splits Bedrock lines by the IAM user or role that made each call. Tag those principals in IAM, such as team or customer, and activate the tags in the Billing console under Cost allocation tags, filtered to IAM principal tags. CostReveal then reads them with the project's tag keys, as it reads resource tags. A tag on the resource itself, such as an application inference profile or a Bedrock project tagged for a customer, comes first; the caller's tag explains what the resource's tags do not. AWS lists a principal's tags for activation only after it has made a call, and each step can take up to a day.
• Tokens. Each Bedrock line states what it billed, such as input, output, cache read or cache write tokens, and CostReveal records the quantity with it.

Usage data does not yet divide Bedrock spend by customer. AWS names models by their console names, not the model IDs applications report, and the two are matched only once certified against a real account. Until then, Bedrock spend that no tag names stays unknown by customer.

A stack deployed with an earlier template still works. Its export lacks the quantities and Bedrock's details, and the connection says so: update the stack in CloudFormation with the template under Connections, Settings.

How figures are checked

• Every line is recorded exactly as AWS reported it. When AWS restates a period, CostReveal adds the correction and keeps what was said before.
• Attribution must add up to what AWS billed, on every dimension, or the period is flagged.
• CostReveal reads AWS's Savings Plans, Reserved Instance and rightsizing recommendations once a day for Insights. AWS charges a cent for each Cost Explorer request: seven a day for recommendations, one on each read to check which tags are activated, and one for each report AWS delivers, about sixteen a day, or five dollars a month. A stack set up before this permission existed keeps working; update it with the current template to see them.
• CostReveal compares the report with AWS Cost Explorer for the same month. While the month is open the two can briefly differ; once AWS issues the invoice they must agree to the cent.

Removing the connection

Removing the connection under Connections deletes every figure it brought in from the project, and the archived report files are deleted within a day. The stack in your account is left as it is; delete it in CloudFormation to remove the export, the role and the bucket.