AWS Cost and Usage Report

​

Before you start

1. Turn on split cost allocation data for Amazon EKS in the Billing and Cost Management console, under Cost Management preferences -> Split cost allocation data.
2. In Data Exports, create a standard data export of type CUR 2.0, with these settings:
   • Include resource IDs: selected
   • Split cost allocation data: selected
   • Time granularity: Hourly
   • Compression type and file format: Parquet
   • File versioning: Overwrite existing data export file

​

Grant the worker read access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-cur-bucket"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cur-bucket/my-prefix/my-export/*"
    }
  ]
}

​

Through a bucket policy

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:role/thoras-worker"
  },
  "Action": ["s3:ListBucket", "s3:GetObject"],
  "Resource": [
    "arn:aws:s3:::my-cur-bucket",
    "arn:aws:s3:::my-cur-bucket/my-prefix/my-export/*"
  ]
}

​

Through a role in the payer account

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/thoras-worker"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::999988887777:role/cur-reader"
    }
  ]
}

​

Enable ingestion

thorasWorker:
  enableCurIngestion: true
  curBucket: my-cur-bucket
  curPrefix: my-prefix
  curExportName: my-export
  # Only when reading through a role in another account:
  curRoleArn: arn:aws:iam::999988887777:role/cur-reader

thorasDashboard:
  extras:
    cluster_daily_cost: true

​

With a network policy

• The worker also collects Cost Explorer data or syncs with a console. It can then reach thorasWorker.httpsEgressCidrs, any address by default.
• The policy uses the kubernetes flavor and networkPolicy.apiServerPorts includes 443, as it does by default. That rule allows its ports to any address.

thorasWorker:
  extraEgressRules:
    - toCIDR:
        - 0.0.0.0/0
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP

thorasWorker:
  extraEgressRules:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - port: 443
          protocol: TCP

​

What you see

• The graph shows Billed (CUR): what AWS billed the selected AIScaleTargets’ pods each day or hour. Each pod’s cost is its share of its node’s cost, as AWS splits it in the report. The hourly view is available for a scope even if you don’t collect hourly Cost Explorer data.
• Days or hours with no cost in the report stay on the graph and are marked as such, for example before the report’s history starts or while a workload is scaled to zero.
• Billed cost by AIScaleTarget lists each AIScaleTarget in the scope, with its workloads and its billed cost for the selected days, and a total. Sort it by billed cost or by name. An AIScaleTarget with nothing billed shows ”—”.

​

How costs are matched to AIScaleTargets

• An AIScaleTarget for a Deployment or StatefulSet matches that workload by name, in the AIScaleTarget’s namespace.
• An AIScaleTarget for an Argo Rollout matches the Rollout’s ReplicaSets.
• An AIScaleTarget with a label selector matches the controllers it selects, in its namespace.

​

What Thoras stores

• Each workload’s billed cost by hour for 14 days, and by day for 13 months.
• Only allocated cost: what AWS charged to pods. Unused node capacity isn’t attributed.
• The worker reads up to 14 months back. Each run reads at most 3 months that AWS has changed since the last read, newest first, so a long history fills in over the first few runs. AWS keeps updating a month for a while after it ends, and Thoras reads it again whenever it does.

​

Verify it’s working

kubectl logs -n thoras deploy/thoras-worker | grep -i "cost and usage report"

Ingested a cost and usage report period period=2026-11 executionId=4f6c1d2e-8a3b-4c5d-9e7f-0a1b2c3d4e5f storedRows=52830 skippedRows=2 skippedCost=0

​

Troubleshooting

• no cost and usage report manifest found for the last 14 billing periods — the worker found no export at s3://<curBucket>/<curPrefix>/<curExportName>/. Check the three values against the export, and that its File versioning is Overwrite existing data export file. If the message ends with access denied, check the permissions in Grant the worker read access, including s3:ListBucket and the bucket policy or the role’s trust policy.
• cost and usage report access denied — the worker found the export but can’t read its files. Check s3:GetObject on the export, and kms:Decrypt if the bucket uses a KMS key.
• cost and usage report export is not usable: … — the export’s settings don’t match Before you start. The message names what is missing, such as split cost allocation data, resource IDs, the Parquet format, or hourly granularity. Change the export’s settings; AWS applies them from the next delivery.