Skip to main content

AWS Cost & Usage Reports (CUR)

Integrate AWS Cost & Usage Reports (CUR, also referred to as CUR v1) with Cloudaware to ingest detailed spend and usage data for Cost Management dashboards, allocation, and optimization.

How It Works​

  • AWS delivers Cost & Usage Report files to an S3 bucket in your management (payer) or member account.
  • Cloudaware uses a read‑only cross‑account role, deployed through AWS CloudFormation, to read objects from the CUR bucket and prefix.
  • New CUR files are detected on a schedule and normalized for Cost Management dashboards and reporting.

Prerequisites​

Before you begin, confirm that you have the following:

  • AWS management (payer) account with access to Billing & Cost Management.
  • Dedicated S3 bucket for CUR files (versioning is recommended).
  • AWS management or member account is already connected to Cloudaware. If it is not connected, complete the AWS Setup Guide first.
  • Cloudaware cross‑account role is updated through CloudFormation with these permissions:
    • s3:ListBucket on the CUR bucket
    • s3:GetObject on the CUR bucket prefix
    • s3:GetBucketLocation
    • s3:ListAllMyBuckets
  • If your S3 bucket uses KMS encryption, check security notes.
tip

For AWS Organizations, you can use either a single payer‑level CUR that includes all member accounts or per‑account CURs in individual member accounts.

Locate or Configure the CUR in AWS​

  1. Sign in to the AWS console.
  2. Open Billing & Cost Management → Cost & Usage Reports.
  3. In the navigation pane, under Legacy Pages, select Cost and Usage Reports.
  4. If a CUR already exists:
    • Ensure that:
      • Include resource IDs is enabled.
      • Automatically refresh your Cost & Usage Report when charges are detected for previous months with closed bills is enabled.
  5. To create a new CUR:
    1. Click Create report.
    2. Enter a report name (for example, billing-cur).
    3. Enable Include resource IDs and Refresh automatically.
    4. Select an S3 bucket, then specify a prefix for CUR delivery.
    5. Select the desired time granularity (Hourly, Daily, or Monthly).
    6. Configure report versioning and data integration settings if required.
    7. Select the compression type (ZIP or GZIP).
    8. Complete the wizard and verify that the report status is Active.

For more details, refer to AWS documentation.

tip

Use one CUR per payer account with all member account data, unless you intentionally need per‑account billing integrations.

Grant Cloudaware Access to the CUR Bucket​

For each management or member account whose CUR you want Cloudaware to ingest, you must grant read access to the S3 bucket.

  1. In Cloudaware, go to Admin.
  2. Select Amazon Web Services, then click CONFIGURED.
  3. Select the relevant AWS account, click the three-dot menu, and choose Download CloudFormation Template.
  4. Open the downloaded template in a text editor. Verify that the S3 bucket placeholders are populated with your actual CUR bucket name and prefix.
  5. In the AWS console, open CloudFormation, select the existing Cloudaware stack for that account and click Update.
  6. Upload the updated template and apply the change set.
  7. Wait for the stack update to complete successfully.

The stack update modifies the cross-account role so Cloudaware can read objects from the CUR bucket and prefix.

Validate or Enable AWS CUR Billing Integration in Cloudaware​

  1. In Cloudaware, go to Admin.
  2. Find AWS Billing and click CONFIGURED.
  3. Under Payer Account, locate the payer account entry or review the individual member accounts.
  4. Confirm that Cloudaware has discovered the correct billing report for the expected S3 bucket and prefix. The integration status must be green.
  5. In Cost Fields Handler, confirm the selected report type is set to CUR. Cloudaware uses the selected report type as the billing source for cost data on CMDB objects. For AWS CUR-based billing, CUR must be selected. If needed, click EDIT and select CUR. Click SAVE.
note

After billing is enabled, Cloudaware starts ingesting new CUR files during the next collection cycle.

AWS Organizations and Member Accounts​

If you do not want to add the management account to Cloudaware, use per-account CUR integrations instead:

note

Important prerequisite: Member accounts can only create their own CURs if the management (payer) account has explicitly enabled Member account cost and usage reports in the AWS Billing preferences.

Create a Cost & Usage Report in each member account:

  1. Follow the steps in the Locate or Configure the CUR in AWS section for the member account.
  2. Deliver the report to an S3 bucket in that same member account.

For each member account:

  1. In Cloudaware, go to Admin.
  2. Select Amazon Web Services, click CONFIGURED.
  3. Select the AWS member account, click the three-dot menu, and select Download Cloudaware CloudFormation template.
  4. Verify that the CUR bucket name and prefix for that account are present in the template.
  5. Update the CloudFormation stack in AWS with the new template.
  6. Go back to Cloudaware. Locate the member account, and verify that the integration status shows green.

This approach allows Cloudaware to collect billing data for each account without using a payer-level integration.

note

As you add new member accounts to your AWS Organization over time, you must repeat these configuration steps for each new account to ensure their billing data is ingested into Cloudaware.

Verification​

After you enable the integration, wait until the next collection cycle for data to appear.

  • In Cloudaware, go to Admin → AWS Billing → CONFIGURED. Verify that the CUR integration status is green and that CUR is selected in Cost Fields Handler.
  • Verify that AWS costs appear as expected on Cloudaware CMDB objects.
  • In Cost Management dashboards when provided:
    • Filter to AWS if needed, and verify that account IDs, services, regions, and cost allocation tags appear as expected.

See also: AWS Billing Verification

Troubleshooting​

Data collection and processing time in Cloudaware depends on the volume of billing files. If costs do not appear within 24 hours, check the following:

  • In the AWS console, verify that the CUR is still Active and delivering files to the expected S3 bucket and prefix.
  • In Amazon S3, verify that new CUR objects are being created on schedule and that object timestamps are recent.
  • Verify that the CloudFormation stack and IAM role used by Cloudaware grant:
    • s3:ListBucket on the CUR bucket
    • s3:GetObject on the CUR prefix
    • s3:GetBucketLocation
    • s3:ListAllMyBuckets
  • In Cloudaware, go to Admin → AWS Billing, and verify that the CUR billing source is discovered, enabled, and healthy (green).
  • Review any error or warning messages shown for the affected integration.

See also: AWS Billing Troubleshooting

note

If costs do not match AWS Cost Explorer, note that AWS billing totals may differ depending on the source used for comparison. AWS Cost Explorer is the recommended reference point for customers to validate AWS costs, but Cloudaware uses AWS Cost and Usage Report (CUR) line-item data. Because CUR and Cost Explorer can use different aggregation timing, cost views, rounding, and line-item treatment, the values may not match exactly.

In addition, CUR data is subject to reporting latency because AWS requires time to aggregate, process, and publish detailed cost data across services. As a result, CUR-based data in Cloudaware may not reflect the most recent charges immediately.

For more details, refer to AWS documentation.

Security Notes​

  • Cloudaware uses a read‑only cross‑account role and never writes to your S3 buckets.

  • Restrict the role to the minimal required permissions on the CUR bucket and prefix.

  • Use separate buckets or prefixes for billing data if you require tighter access control.

  • If your S3 bucket uses KMS encryption, Cloudaware needs permission to decrypt the billing files. Because Cloudaware uses a cross-account IAM role, you must use a Customer Managed Key (CMK); the default AWS managed key (aws/s3) does not support cross-account sharing.

    Update your configuration with the following:

    • KMS Key Policy: Explicitly allow the Cloudaware IAM role ARN to perform kms:Decrypt. (You can also include kms:DescribeKey as an auditing best practice, though it is not strictly required).
    • Cloudaware IAM Role: Add the kms:Decrypt permission to the Cloudaware cross-account role deployed via CloudFormation, scoped to your CMK's ARN.