AWS per-resource cost (CUR)

By default, CloudOptify reads AWS cost from Cost Explorer, which is grouped by service only — so the AWS cost drill-down can’t show individual resources (unlike Azure, which exposes per-resource cost natively). To get exact, per-resource AWS cost for every service, connect an AWS Cost & Usage Report (CUR) delivered as an AWS Data Export to an S3 bucket.

This is optional. Leave the CUR fields blank and CloudOptify keeps using Cost Explorer. When a CUR is configured, CloudOptify ingests it and the cost drill-down shows real resources and their real cost across every linked account and region in your organization.

Where to do this

Set this up in your AWS Organization’s management (payer) account — a single CUR from the payer covers every linked account. It’s the same account where you created the read-only role.

Why connect a billing export

The CUR becomes your cost backbone instead of a live API call, which unlocks a step change in both reliability and depth:

• Billing-accurate numbers. Costs come straight from the same export AWS uses to generate your invoice — no estimation, no rounding drift.
• No rate limits. Refreshes read your own S3 bucket instead of calling the throttled Cost Explorer API, so large organizations with many linked accounts stop hitting 429 errors during scheduled syncs.
• Deeper history, automatically. AWS backfills up to ~12 months of history into a newly enabled Data Export on its own — CloudOptify pulls all of it on first ingest, versus Cost Explorer’s slower, capped pagination.
• Real per-resource drill-down. Cost Explorer shows exact, billed cost per resource — every linked account, every region — instead of an inventory-weighted estimate.
• Tag-based cost allocation. Cloud Groups can allocate spend by resource tag — the “business mapping” model — pulling in tagged resources across accounts, not just the ones explicitly assigned to a group.
• Cost by Region. (Enterprise) See exactly where in the world your spend lives, split by provider — for data-residency checks and catching unexpected egress.
• Top Resources & usage types. An org-wide, cross-cloud ranking of your most expensive resources, plus AWS’s most granular billing dimension — usage type — for pinpointing exactly what’s driving a service’s cost.

A. Create the Data Export (CUR 2.0)

1. AWS Console → Billing and Cost Management → left nav, under Cost and Usage Analysis → Data Exports.
2. Create → Standard data export.
3. Export name: e.g. cloudoptify-cur.
4. Data table: CUR 2.0.
5. Enable Include resource IDs — this is what gives you per-resource cost.
6. Delivery options:
   • Compression type and file format → Parquet
   • File versioning → Overwrite existing data export file
7. Time granularity → Daily.
8. S3 bucket → Configure → create a new bucket (or pick existing). Accept the bucket policy the console proposes (it lets AWS Billing write the export). Set an S3 path prefix, e.g. cur.
9. Create export.

Note these three values for CloudOptify:

Field	Example
S3 bucket	my-cloudoptify-cur
Prefix	cur
Export name	cloudoptify-cur

B. Grant the read-only role access to the bucket

Add an inline policy to your CloudOptifyReadOnly role so CloudOptify can read the export (IAM → Roles → CloudOptifyReadOnly → Add permissions → Create inline policy → JSON):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "CloudOptifyReadCur",
    "Effect": "Allow",
    "Action": [
      "s3:GetBucketLocation",
      "s3:ListBucket",
      "s3:GetObject"
    ],
    "Resource": [
      "arn:aws:s3:::<bucket>",
      "arn:aws:s3:::<bucket>/<prefix>/*"
    ]
  }]
}

Replace <bucket> and <prefix> with your values. s3:GetBucketLocation and s3:ListBucket apply to the bucket itself; s3:GetObject to the objects under the prefix. Name it CloudOptifyReadCur and create it.

Caution

s3:GetBucketLocation is required — CloudOptify resolves the bucket’s region before reading. Without it the connection test will fail.

C. Point CloudOptify at it

In the portal → Cloud Connections → your AWS connection → the Cost & Usage Report section → enter the bucket, prefix, and export name → save. CloudOptify tests S3 access before saving (it lists the bucket/prefix with the role), so a wrong name or missing permission fails immediately with a clear message.

Timing

AWS writes the first export within a few hours (sometimes up to ~24h). Until then CloudOptify keeps using Cost Explorer, and the CUR ingest simply reports “no data files found yet” — it picks up automatically once the first file lands. After that, each scan refreshes the current month’s data (CUR restates the whole month on every update, which CloudOptify handles).