BCSE355L

AWS Solutions Architect

Dr. [Link]
Assistant Professor Senior Grade II
School of Computer Science and Engineering
Vellore Institute of Technology, Vellore
 BCSE355L -AWS Solutions Architect

Module 5

2
 AWS Management Tools and Cost
Management
• In AWS, Management Tools are a set of services that help you monitor, manage,
automate, and optimize the AWS resources and applications.
• Tools are mainly used by administrators, developers, and DevOps engineers for
governance, compliance, and operational efficiency.
• AWS CloudWatch • AWS Cost Management
• AWS CloudTrail • AWS Free Tier
• AWS Config • AWS Billing and Account Management
• AWS Systems Manager • AWS Budgets
• AWS Trusted Advisor
 AWS Management Tools

• AWS provides several management tools to help you manage your

cloud resources efficiently and securely.

• AWS Management Tools help users manage, automate, monitor,

and deploy cloud resources efficiently in the AWS Cloud.

• These tools provide both graphical interfaces and command-line

options for managing AWS services.
Management Tools

Amazon Amazon EC2 AWS AWS AWS AWS Managed

CloudWatch Systems Manager CloudFormation CloudTrail Config Services

alarm event Automation documents Inventory stack rule

(time-based)

rule Maintenance Parameter Patch Manager template

Windows Store

event Run Command State Manager change set

(event-based)
Management Tools (Continued)

AWS AWS AWS Trusted

OpsWorks Service Catalog Advisor

apps deployments instances checklist checklist cost

layers monitoring permissions checklist fault checklist

tolerance performance

resources stack checklist

security
 AWS CloudWatch
• AWS CloudWatch is a powerful monitoring service that provides real-time insights into your AWS
services, resources, and the applications running on them.
• It collects and tracks metrics and logs, and it can trigger notifications when predefined alarms are
activated.
• AWS CloudWatch has the potential to collect the data as metrics, events, and logs.
• All the operational and monitoring data collected by CloudWatch are of the apps, services, and
resources running over AWS.
 AWS CloudWatch
Amazon CloudWatch is a monitoring and observability service for AWS cloud
resources and applications.

You can use CloudWatch to detect anomalous behavior in your environments,

set alarms, visualize logs and metrics side by side, take automated actions,
troubleshoot issues, and discover insights to keep your applications running
smoothly.

Provides:
✅ Dashboards for visualizing metrics
✅ Alarms to trigger notifications or actions
✅ Logs to capture application and system logs
✅ Events to respond automatically to changes
AWS CloudWatch
How CloudWatch Works?
AWS CloudWatch
CloudWatch Architecture
AWS CloudWatch
AWS CloudWatch
AWS CloudWatch
AWS CloudWatch
How Automation Works with AWS Lambda and
CloudWatch
 AWS CloudWatch
Key Components of CloudWatch
 AWS CloudWatch
Key Components of CloudWatch

CloudWatch is built on several fundamental components:

1. Metrics: Data points that can be visualized on dashboards.
2. Alarms: Automated triggers that perform defined actions when certain
thresholds are crossed.
3. Logs: Storage and search capabilities for application and system logs.
4. Events (EventBridge): Real-time event routing to different targets.
5. Dashboards: Customizable views for monitoring your environment.
 AWS CloudWatch
[Link] in CloudWatch
• AWS services automatically send metrics to CloudWatch upon deployment.
• For example, when you launch an EC2 instance or create a Lambda function, default metrics
such as CPU utilization, network packets, invocation counts, and errors are published without
extra configuration.
 AWS CloudWatch
Metrics in CloudWatch
• A namespace in CloudWatch acts as a container for metrics, isolating data so that metrics
from one application or service do not mix with others.
• Each AWS service automatically groups its metrics in its own namespace, such as AWS/ECS
for ECS metrics or another namespace for Elastic Load Balancer metrics.
 AWS CloudWatch
Metrics in CloudWatch
• Dimensions are key-value pairs that provide additional context for each metric.
• For instance, a metric for disk read bytes might include dimensions such as the disk identifier
or the EC2 instance ID, helping to pinpoint performance characteristics more accurately.
 AWS CloudWatch
Metrics in CloudWatch
Metric Resolution
• CloudWatch supports two types of metric resolutions:
• Standard Resolution: 1-minute granularity (default for AWS services).
• High Resolution: 1-second granularity, available for custom metrics.
• High-resolution metrics can be retrieved at intervals of 1, 5, 10, 30 seconds, or any multiple
of 60 seconds.
 AWS CloudWatch
[Link] in CloudWatch
AWS CloudWatch Alarms allow businesses to set thresholds for metrics and receive notifications
when they are breached.
An alarm has the following attributes:
Metrics
Datapoint to alarm
Evaluation Period
AWS CloudWatch allows us to create four different types of alarm:
Static Threshold (breach of threshold)
Math Expression (combining metrics)
Anomaly detection alarms (pattern-based)
Composite (alarm of alarms)
 AWS CloudWatch
[Link] in CloudWatch
• CloudWatch Logs aggregates, searches, and analyses logs generated by various AWS cloud
services and applications.
• The log is an idempotent record of a discrete event that happened in a system at any point of
time during the request life cycle.
Attributes of Log
Timestamp
Event (fixed pattern)
[Link] in CloudWatch AWS CloudWatch
• Log Groups: Collections of log streams that share retention, monitoring, and access settings.
• Log Streams: Sequences of log events from the same source, such as individual servers or
services.
• For example, if an application is running on two servers, each server generates its own log
stream, and these streams are organized under a single log group for the application.
 AWS CloudWatch
4. Events in CloudWatch
• CloudWatch Events provides automated responses to system changes or anomalies, enabling
integration with other AWS services like Lambda for remediation.
• We can use CloudWatch to generate some events which will trigger our AWS lambda and
using the lambda we can perform certain task.
 AWS CloudWatch
5. Dashboards in CloudWatch
• CloudWatch dashboards allow us to monitor resources in a single view. We can club graph of metrics
based on app tag or service label.
AWS CloudWatch
AWS CloudTrail
 AWS CloudTrail
Types of Events
[Link] events
Management events provide information about management operations that are performed on
resources in your AWS account. These are also known as control plane operations.
Example management events include:
•Configuring security (for example, AWS Identity and Access
Management AttachRolePolicy API operations).
•Registering devices (for example, Amazon EC2 CreateDefaultVpc API operations).
•Configuring rules for routing data (for example, Amazon EC2 CreateSubnet API operations).
•Setting up logging (for example, AWS CloudTrail CreateTrail API operations).
 AWS CloudTrail
Types of Events
2. Data Events
Data events provide information about the resource operations performed on or in a resource. These are also
known as data plane operations. Data events are often high-volume activities.
Example data events include:
•Amazon S3 object-level API activity (for example, GetObject, DeleteObject, and PutObject API operations)
on objects in S3 buckets.
•AWS Lambda function execution activity (the Invoke API).
•CloudTrail PutAuditEvents activity on a CloudTrail Lake channel that is used to log events from outside
AWS.
•Amazon SNS Publish and PublishBatch API operations on topics.
3. Insights Events
CloudTrail Insights events capture unusual API call rate or error rate activity in your AWS account by
analyzing CloudTrail management activity.
AWS CloudTrail
 AWS CloudTrail
• AWS CloudTrail is a service that enables governance, compliance, and operational
and risk auditing of your AWS account.
• It records and logs every API call made on your AWS account, capturing details
such as the identity of the API caller, the time of the API call, the source IP address,
the request parameters, and the response elements returned by the AWS service.
• This comprehensive logging allows you to track changes and activities across
your AWS infrastructure, helping with security analysis, resource change tracking,
troubleshooting, and meeting compliance requirements.
AWS CloudTrail
AWS CloudTrail
 AWS CloudTrail
CloudTrail provides three ways to record events:
•Event history
•CloudTrail Lake
•Trails
 AWS CloudTrail
Event history
•Enabled by default for every AWS account.
•Stores last 90 days of management events.
•Free of cost.
•Provides a viewable, searchable, printable, immutable record.
•Region-specific (records events in the AWS Region where they
occurred).
 AWS CloudTrail
CloudTrail Lake
•Managed data lake for audit and security analysis.
•Converts JSON events → Apache ORC(Optimized Row Columnar)
•ORC is a columnar storage format that is optimized for fast retrieval of data
•Uses event data stores (immutable collections based on filters).
•Retention: up to 7 years (2557 days).
•Can be created for single or multiple AWS accounts (via AWS Organizations).
•Supports importing logs from S3 into Lake.
•Provides dashboards for analyzing event trends.
•Best for long-term analysis & compliance.
 AWS CloudTrail
Trails
•In addition to delivering and storing events in an Amazon S3 bucket
• Trails can also deliver events to Amazon Cloud Watch Logs and the
Amazon Event Bridge.
•Can integrate with security monitoring tools.
•Events can be queried using Athena or third-party tools.
•Good for custom storage, monitoring, and alerting.
 AWS CloudTrail
AWS CloudTrail Architecture
 AWS CloudTrail
AWS CloudTrail Architecture
• When a new account is created, Cloud Trail is activated. An API call is made in
the Back End whenever we carry out any operation using an AWS account, such
as signing in, creating and deleting EC2 instances, creating S3 buckets, and
uploading data into them.
• An API request is made on the backend when the activity occurs.
• The activities that we carry out with our AWS Account can be carried out in a
variety of ways. For instance, we can use the account with the aid of the AWS
CLI (AWS - Command-line Interface), and we can also carry out the activity
using the SDK (Software Development Kit) or AWS Management Console.
 AWS CloudTrail
AWS CloudTrail Architecture
• We may use any method here, and by using that method, whenever we execute an
activity from the account, the backend API is called. When the backend API is
called, an event is generated, and the event log is saved in the Cloud Trail. Only
when we carry out any activity using an AWS Account does an event get created in
Cloud Trail.
• The AWS account activity we perform lasts for 90 days in the same place. It is
possible to keep event logs in an S3 bucket for longer than 90 days. SNS
notification (Simple Notification Service) configuration is also possible in Cloud
Trail.
 AWS CloudTrail
AWS CloudTrail Architecture
AWS CloudTrail
AWS CloudTrail
AWS CloudTrail
 AWS Config
• AWS Config provides a detailed view of the configuration of AWS resources in your AWS
account.

• This includes how the resources are related to one another and how they were
configured in the past so that you can see how the configurations and relationships
change over time.

• An AWS resource is an entity you can work with in AWS, such as an Amazon Elastic
Compute Cloud (EC2) instance, an Amazon Elastic Block Store (EBS) volume, a
security group, or an Amazon Virtual Private Cloud (VPC).
 AWS Config
• AWS Config focuses on tracking resource configuration changes according to your
defined rules
• It continuously records configuration changes across your AWS resources, allowing
you to review what was configured and how it changed over time.
 AWS Config
Key functions of AWS Config include:
• Maintaining a historical version of your service settings.
• Keeping an inventory of all AWS resources.
• Continuously monitoring resources for changes.
• Notifying you or triggering automated responses (e.g., via AWS Lambda) when a
configuration rule is violated.
 AWS Config
AWS Config is a service that helps you:
•Audit → Track and review configurations of AWS
resources.
•Report → Generate compliance and configuration
reports.
•Locate resources → Identify all AWS resources in your
account.
•Check configurations → Compare current setups against
best practices.
•Assess compliance → Ensure resources comply with
organizational or regulatory requirements.
 AWS Config
Configuration item

• Each configuration item in AWS Config represents a snapshot of a resource’s metadata,

attributes, relationships (for example, S3 buckets associated with Lambda functions), its

current configuration, and related API events.

• AWS collectively refers to these snapshots as "resources.“

• AWS Config automatically creates a configuration item whenever a resource is created,

updated, or deleted. You can set the recording frequency to trigger on every change, every

10 minutes, hourly, or daily—depending on your resource sensitivity.

AWS Config
 AWS Config
Configuration History
• The historical collection of these items, known as configuration history, provides
valuable context regarding how a resource evolves over time. This data is stored in
an S3 bucket, where records are grouped by creation, updates, and deletions.
 AWS Config
Configuration Recorder
• The Configuration Recorder continuously records changes in your AWS resources.
• Every time a resource is created, modified, or deleted, the recorder captures the details.
• These details are stored as Configuration Items (CIs), which describe the resource and
its settings at a specific point in time.
• By aggregating these records, AWS Config helps in tracking changes, auditing,
troubleshooting, and ensuring compliance.
 AWS Config
Delivery Channel
• AWS Config delivers configuration data to various destinations:
• Storing data in an S3 bucket.
• Publishing notifications through SNS.
• Triggering AWS Lambda functions for automated remediation.

• For example, if you choose S3 as your

storage destination, ensure that AWS
Config has the necessary permissions
to access the bucket.
• Alternatively, using SNS allows
subscribers to receive emails or text
messages, and even trigger Lambda
functions.
 AWS Config
Delivery Channel :S3
• In this example, AWS Config monitors services such as S3, EC2, ECS, and DynamoDB
for configuration changes. When a change is detected, it records the change, triggers
remediation actions, and sends notifications concurrently.
 AWS Config
AWS config rules
• An AWS Config Rule is a statement that defines the desired configuration settings for
AWS resources, which AWS Config uses to evaluate compliance
AWS Managed Rules
• Managed rules are predefined rules created and maintained by AWS.
• You only need to select the rule and provide minimal configuration parameters.
Customer Managed Rules
• Customer Managed Rules are custom rules created by users to meet specific
compliance needs.
• These rules are built using AWS Lambda functions, where you define the
compliance logic
 AWS Config
AWS config rules-Managed rules
 AWS Config
AWS config rules-Managed rules
 AWS Config
AWS config rules-Managed rules and custom rules
 AWS Config
AWS Config Rules and Evaluation
 AWS Config
AWS Config Rules and Evaluation
An AWS Config rule represents your desired configuration settings for specific AWS resources or for an entire AWS
account. If a resource does not pass a rule check, AWS Config flags the resource and the rule as noncompliant, and
AWS Config notifies you through Amazon SNS. The following are the possible evaluation results for an AWS
Config rule:

• COMPLIANT - the rule passes the conditions of the compliance check.

• NON_COMPLIANT - the rule fails the conditions of the compliance check.

• ERROR - the one of the required/optional parameters is not valid, not of the correct type, or is formatted
incorrectly.

• NOT_APPLICABLE - used to filter out resources that the logic of the rule cannot be applied to. For example,
the alb-desync-mode-check rule only checks Application Load Balancers, and ignores Network Load Balancers
and Gateway Load Balancers.
 AWS Config
Rule Evaluation modes in AWS Config
Evaluation modes define how compliance is checked (before or after)
 AWS Config
Trigger types in AWS Config
Triggers define when the rules are executed.

•Configuration Changes Trigger: Evaluation occurs immediately after a configuration change.

•Periodic Trigger: Evaluations are performed at regular, configured intervals.
•Hybrid Trigger – Combines both: evaluates on configuration changes and at periodic intervals.
 AWS Systems Manager
• AWS Systems Manager is a service that helps centrally manage, automate, and monitor
AWS resources and on-premises infrastructure.
• Amazon Systems Manager is a management service that helps you automatically collect
software inventory, apply OS patches, create system images, and configure Windows and
Linux operating systems.
• AWS Systems Manager supports the management of operating systems at scale
• It features multiple sub-services such as State Manager, Change Calendar, Application
Manager, Session Manager, and Incident Manager.
AWS Systems Manager

Configuration Distributor
Session Manager
Compliance
AWS Systems Manager
 AWS Systems Manager
1. AWS Tools and SDKs
Software Development Kits (SDKs) let developers interact programmatically with AWS Systems
Manager.
Enables automation through scripts or code.
2. AWS Management Console
A web-based UI for administrators.
You can access Systems Manager, configure automation, run commands, and monitor resources.
3. AWS Command Line Interface (CLI)
A command-line tool to interact with AWS services.
You can execute Systems Manager commands directly from a terminal (useful for DevOps and
automation).
4. AWS Identity and Access Management (IAM)
Provides secure access control.
Ensures only authorized users or roles can run Systems Manager tasks.
Policies define which actions can be taken (e.g., who can run commands on instances).
5. AWS Systems Manager
The central service connecting everything.
Orchestrates management tasks like patching, updating, and configuration.
Communicates with resources (instances, containers) using Run Command and automation
documents.
 AWS Systems
6. SSM Documents (Systems Manager Documents)
Manager
JSON/YAML documents that define the actions Systems Manager performs.
Example: Install a package, patch OS, start/stop services.
Reusable automation templates.
7. Run Command
A Systems Manager feature to remotely execute commands on multiple instances/containers at once.
No need to SSH into each machine.
8. AWS Region → VPC Subnet
Defines the AWS infrastructure boundary where resources (EC2 instances, containers) live.
Systems Manager connects securely to these resources inside a Virtual Private Cloud (VPC).
9. Instances (EC2)
Virtual machines running applications.
Systems Manager can patch, configure, or run scripts on them.
10. Containers
Lightweight application environments (like Docker).
Systems Manager can manage containerized workloads too (start, stop, configure, monitor).
 AWS Systems Manager
How does Systems Manager work?
 AWS Systems Manager
How does Systems Manager work?
[Link] Systems Manager – The AWS Console provides access to the Systems Manager. You can use the AWS
Command Line Interface, AWS Tools for Windows PowerShell, or the AWS SDK to manage resources
programmatically. You may use Systems Manager to configure, schedule, automate, and execute operations on
your AWS resources and managed nodes. AWS resources include users, groups, and roles in AWS Identity and
Access Management (IAM); AWS Lambda functions; Amazon EC2 Auto Scaling groups; and Amazon Simple
Storage Service (Amazon S3) buckets, to mention a few.
[Link] a Systems Manager capability – More than two dozen functions are included in Systems Manager to
assist you in performing activities on your resources. Only a handful of the features that administrators employ to
configure and manage their resources are shown in the illustration.
[Link] and processing – Systems Manager verifies configurations, including permissions, and makes
requests to the AWS Systems Manager agent (SSM Agent) running on your hybrid environment’s instances, edge
devices, or servers and VMs. The configuration changes given by SSM Agent are implemented.
[Link] – SSM Agent notifies the user, Systems Manager in the AWS Cloud, Systems Manager operations
management capabilities, and various AWS services, if configured, about the status of the configuration changes
and actions.
[Link] Manager operations management capabilities – In reaction to events or issues with your resources,
Systems Manager operations management features such as Explorer OpsCenter and Incident Manager aggregate
operations data or create artifacts such as operational work items (OpsItems) and incidents if enabled. These
features might assist you in investigating and troubleshooting issues
 AWS Systems Manager
SSM Agent
• The AWS Systems Manager Agent (SSM Agent) is Amazon software that operates on Amazon
EC2 instances, edge devices, and on-premises servers and virtual computers (VMs).
• Systems Manager may update, manage, and configure these resources using the SSM Agent. The
agent receives requests from the AWS Cloud’s Systems Manager service and executes them as
stated in the request.
• The SSM Agent then uses the Amazon Message Delivery Service (service prefix: ec2messages) to
deliver status and execution information back to the Systems Manager service.
 AWS Systems Manager
AWS Systems Manager features

Systems Manager Inventory:

• AWS Systems Manager gathers data about your instances and the software they run,
allowing you to better understand your system configurations and installed applications.
• Data on apps, files, network configurations, Windows services, registries, server roles,
updates, and other system attributes can be collected.
• You can use the information acquired to manage application assets, track licensing,
check file integrity, and find apps that aren’t installed by a standard installer, among
other things.
 AWS Systems Manager
AWS Systems Manager features

Systems Manager Inventory:

 AWS Systems Manager
AWS Systems Manager features

Configuration Compliance
• AWS Systems Manager allows you to check for patch compliance and configuration
inconsistencies on your managed instances.
• You can collect and aggregate data from many AWS accounts and Regions, then drill
down into non-compliant resources.
• AWS Systems Manager shows statistics about patching and associations by default. You
can also personalise the service by creating your own compliance categories to meet
your specific needs.
 AWS Systems Manager
AWS Systems Manager features

Configuration Compliance
 AWS Systems Manager
AWS Systems Manager features
Automation:
• AWS Systems Manager enables you to automate common and repetitive IT operations and
management tasks across AWS resources in a safe and secure manner.
• You can use JSON documents to specify a specific list of tasks in Systems Manager, or you can
utilize community-published documents.
• These documents can be run immediately from the AWS Management Console, CLIs, and
SDKs, scheduled in a maintenance window, or triggered by Amazon CloudWatch Events based
on changes to AWS resources.
• You can keep track of how each step in the papers is being completed, as well as request
approvals for each step.
• You can also roll out updates in stages and have them stop when mistakes occur.
 AWS Systems Manager
AWS Systems Manager features
Run Command:
• Use the Systems Manager Run Command to manage the configuration of your managed
instances at scale remotely and securely.
• Use Run Command to make on-demand changes to a target group of dozens or hundreds of
instances, such as updating software or running Linux shell scripts and Windows PowerShell
commands.
 AWS Systems Manager
AWS Systems Manager features
Run Command:
 AWS Systems Manager
AWS Systems Manager features
Session Manager:
• AWS Systems Manager allows you to manage your instances at scale safely and securely
without having to log into your servers, eliminating the need for bastion hosts, SSH, or
remote PowerShell.
• It provides a simple way to automate basic administration operations such as registry
modifications, user management, and software and patch deployments across groups of
instances.
• You may apply granular permissions to govern the tasks users can conduct on instances by
integrating with AWS Identity and Access Management (IAM).
• AWS CloudTrail records all actions performed with Systems Manager, allowing you to audit
changes across your environment.
 AWS Systems Manager
AWS Systems Manager features
Session Manager:
• .
 AWS Systems Manager
AWS Systems Manager features
Patch Manager:
• AWS Systems Manager allows you to choose and apply operating system and software
patches to large groups of Amazon EC2 or on-premises instances automatically.
• Patch baselines allow you to create rules to automatically approve or reject certain kinds of
patches, such as operating systems or high-severity fixes, and you can also specify a list of
patches that override these rules and are approved or refused automatically.
• You can also plan patch maintenance windows so that they are only applied at specific times.
• Systems Manager assists you in keeping your software up to date and compliant with your
regulations.
 AWS Systems Manager
AWS Systems Manager features
Maintenance Windows:
• AWS Systems Manager allows you to schedule administrative and maintenance operations
across all of your instances.
• This means that you can install patches and updates or make other configuration changes at a
time that is convenient and safe for you, boosting the availability and reliability of your
services and applications
 AWS Systems Manager
AWS Systems Manager features
Maintenance Windows:
 AWS Systems Manager
AWS Systems Manager features
Distributor:
• AWS Systems Manager’s Distributor feature allows you to securely store and distribute
software packages around your organization.
• To control the lifespan of the packages running on your instances, you can utilize Distributor
in conjunction with current Systems Manager tools like Run Command and State Manager.
 AWS Systems Manager
AWS Systems Manager features
State Manager:
• AWS Systems Manager enables configuration management, allowing you to keep your
Amazon EC2 or on-premises instances configured consistently.
• You can manage configuration parameters such as server configurations, anti-virus
definitions, firewall settings, and more with Systems Manager.
• You can leverage existing scripts, PowerShell modules, or Ansible playbooks directly from
GitHub or Amazon S3 buckets to set configuration policies for your servers using the AWS
Management Console.
• Systems Manager applies your configurations to all of your instances at the time and
frequency you specify.
• You may check the status of your instance configurations in Systems Manager at any time,
giving you on-demand visibility into your compliance status.
 AWS Systems Manager
AWS Systems Manager features
Parameter Store:
• AWS Systems Manager acts as a single repository for all of your configuration data,
including plain-text data like database strings and secrets like passwords.
• This allows you to segregate your code from your secrets and configuration data. Parameters
can be labeled and arranged into hierarchies to make it easier to handle them.
• To save various values, you can use the same parameter name, “db-string,” but a different
hierarchical path, “dev/db-string” or “prod/db-string.”
• AWS Key Management Service (KMS) is linked with Systems Manager, allowing you to
automatically encrypt the data you save.
• You may also use AWS Identity and Access Management to control user and resource access
to parameters (IAM). Other AWS services, such as Amazon Elastic Container Service, AWS
Lambda, and AWS CloudFormation, can reference parameters
 AWS Systems Manager
AWS Systems Manager features
Parameter Store:
 AWS Cost Management
• AWS Cost Management is an important part of the effective use of cloud services in
order to help ensure organizations can monitor costs, optimize the use of resources, and
maintain financial accountability.
• The days of staff with a technical inclination who run and build clusters of servers are
long behind us, but simply using AWS has left most organizations with little knowledge
of how to manage costs on the AWS platform.
• The company offers several tools and best practices for AWS cost monitoring, analysis,
and managing spend.
• AWS Cost Management offers a full suite of ways to help set budgets and forecast costs,
including the use of discounted pricing models, RIs, and Savings Plans.
 AWS Cost Management
AWS Billing and Cost Management provides a suite of features to help you set up your
billing, retrieve and pay invoices, and analyze, organize, plan, and optimize your costs.
Features of AWS Billing and Cost Management:
• Billing and payments
• Cost analysis
• Cost organization
• Budgeting and planning
• Savings and commitments
 Billing and payments
Understand your monthly charges, view and pay invoices, and manage preferences
for billing, invoices, tax, and payments.

Bills page – Download invoices and view detailed monthly billing data to understand
how your charges were calculated.
Purchase orders – Create and manage your purchase orders to comply with your
organization’s unique procurement processes.
Payments – Understand your outstanding or past-due payment balance and payment
history.
Payment profiles – Set up multiple payment methods for different AWS service
providers or parts of your organization.
Credits – Review credit balances and choose where credits should be applied.
Billing preferences – Enable invoice delivery by email and your preferences for
credit sharing, alerts, and discount sharing.
 Cost analysis
Analyze your costs, export detailed cost and usage data, and forecast your spending.
AWS Cost Explorer – Analyze your cost and usage data with visuals, filtering, and grouping. You can
forecast your costs and create custom reports.
Data exports – Create custom data exports from Billing and Cost Management datasets.
Cost Anomaly Detection – Set up automated alerts when AWS detects a cost anomaly to reduce
unexpected costs.
AWS Free Tier – Monitor current and forecasted usage of free tier services to avoid unexpected costs.
Split cost allocation data – Enable detailed cost and usage data for shared Amazon Elastic Container
Service (Amazon ECS) resources.
Cost Management preferences – Manage what data that member accounts can view, change account
data granularity, and configure cost optimization preferences.
 Cost organization
Organize your costs across teams, applications, or end customers.
Cost categories – Map costs to teams, applications, or environments, and then view
costs along these dimensions in Cost Explorer and data exports. Define split charge rules
to allocate shared costs.
Cost allocation tags – Use resource tags to organize, and then view costs by cost
allocation tag in Cost Explorer and data exports.
 Budgeting and planning
Estimate the cost of a planned workload, and create budgets to track and control
costs.

Budgets – Set custom budgets for cost and usage to govern costs across your
organization and receive alerts when costs exceed your defined thresholds.
 Savings and commitments
Optimize resource usage and use flexible pricing models to lower your bill.
AWS Cost Optimization Hub – Identify savings opportunities with tailored
recommendations including deleting unused resources, rightsizing, Savings Plans, and
reservations.
Savings Plans – Reduce your bill compared to on-demand prices with flexible pricing
models. Manage your Savings Plans inventory, review purchase recommendations, and
analyze Savings Plan utilization and coverage.
Reservations – Reserve capacity at discounted rates for Amazon Elastic Compute Cloud
(Amazon EC2), Amazon Relational Database Service (Amazon RDS), Amazon Redshift,
Amazon DynamoDB, and more.
 AWS pricing model
Three fundamental drivers of cost with AWS

Compute Storage Data transfer

• Charged per • Charged typically • Outbound is aggregated
hour/second* per GB and charged
• Inbound has no charge
• Varies by instance (with some exceptions)
type
• Charged typically per GB

99
How do you pay for AWS?

100
Pay for what you use
Pay only for the services that you consume,
with no large
upfront expenses.

On premises AWS

101
 Pay less when you reserve
Invest in Reserved Instances (RIs):
Save up to 75 percent
Options:
All Upfront Reserved Instance EC2
(AURI) → largest instance

discount
Partial Upfront Reserved NURI PURI AURI

Instance (PURI) → lower

discounts
No Upfront Payments Reserved
Instance (NURI) →
102
smaller discount
 Pay less by using more
• Realize volume-based discounts:
• Savings as usage increases.
• Tiered pricing for services like Amazon
Simple Storage Service (Amazon S3),
Amazon Elastic Block Store (Amazon
EBS), or Amazon Elastic File System
(Amazon EFS) → the more you use, the less
you pay per GB.
• Multiple storage services deliver lower
103
storage costs based on needs.
 Pay even less as AWS grows

• As AWS grows:
• AWS focuses on lowering cost of doing business.
• This practice results in AWS passing savings from economies
of scale to you.
• Since 2006, AWS has lowered pricing 75 times (as of
September 2019).
• Future higher-performing resources replace current resources
for no extra charge.

104
 Custom pricing

• Meet varying needs through custom

pricing.
• Available for high-volume projects
with unique
requirements.

105
 AWS Pricing calculator

• AWS Pricing Calculator is a web-based planning tool to create estimates for

your AWS use cases.
• Use it to model your solutions before building them, explore the AWS service
price points, and review the calculations behind your estimates.
• AWS Pricing Calculator help you to plan how you spend, find cost saving
opportunities, and make informed decisions when using AWS.
• AWS Pricing Calculator is useful if you’re new to AWS and for those who want
to reorganize or expand their AWS usage.
AWS Pricing calculator
 AWS Billing and cost Management
• AWS Billing and Cost Management is the service that you use to pay your
AWS bill, monitor your usage, and budget your costs. Billing and Cost
Management enables you to forecast and obtain a better idea of what your
costs and usage might be in the future so that you can plan ahead.

• You can set a custom time period and determine whether you would like to
view your data at a monthly or daily level of granularity.

• With the filtering and grouping functionality, you can further analyze your
data using a variety of available dimensions. The AWS Cost and Usage
Report Tool enables you to identify opportunities for optimization by
understanding your cost and usage data trends and how you are using your
AWS implementation.
108
AWS Billing Dashboard

109
 AWS Billing Dashboard
• The AWS Billing Dashboard lets you view the status of your month-to-date
AWS expenditure, identify the services that account for the majority of your
overall expenditure, and understand at a high level how costs are trending.
• One of the graphs that is located on the dashboard is the Spend Summary. The
Spend Summary shows you how much you spent last month, the estimated costs
of your AWS usage for the month to date, and a forecast for how much you are
likely to spend this month.
• Another graph is Month-to-Date Spend by Service, which shows the top services
that you use most and the proportion of costs that are attributed to that service
Monthly bills

111
Cost Explorer

112
Forecast and track costs

113
Cost and usage reporting

114
 AWS Free Tier
The AWS Free Tier lets you try services for free for the specified
period.

It has three different offerings:

➢ Always Free

➢ 12 Months Free

➢ Trials
 AWS Budgets
• You can use AWS Budgets to track and take action on your AWS
costs and usage.

• AWS Budgets used to monitor your aggregate utilization and

coverage metrics for your Reserved Instances (RIs) or Savings
Plans.

• You can use AWS Budgets to enable simple-to-complex cost and

usage tracking. Some examples include:

• Setting a monthly cost budget with a fixed target amount

to track all costs associated with your account. You can
choose to be alerted for both actual (after accruing) and
forecasted (before accruing) spends.

.
• Setting a monthly cost budget with a variable target amount, with each
subsequent month growing the budget target by 5 percent. Then, you can configure
your notifications for 80 percent of your budgeted amount and apply an action. For
example, you could automatically apply a custom IAM policy that denies you the
ability to provision additional resources within an account.
• Setting a monthly usage budget with a fixed usage amount and forecasted
notifications to help ensure that you are staying within the service limits for a
specific service. You can also be sure you are staying under a specific AWS Free
Tier offering.
• Setting a daily utilization or coverage budget to track your RI or Savings Plans.
You can choose to be notified through email and Amazon SNS topics when your
utilization drops below 80 percent
 Budget Types
• AWS Budgets information is updated up to three times a day. Updates typically occur 8–12 hours
after the previous update. Budgets can track your unblended, amortized, and blended costs.
Budgets can include or exclude charges such as discounts, refunds, support fees, and taxes.
• You can create the following types of budgets:
• Cost budgets – Plan how much you want to spend on a service.
• Usage budgets – Plan how much you want to use one or more services.
• RI utilization budgets – Define a utilization threshold and receive alerts when your RI usage
falls below that threshold. This lets you see if your RIs are unused or under-utilized.
• RI coverage budgets – Define a coverage threshold and receive alerts when the number of
your instance hours that are covered by RIs fall below that threshold. This lets you see how
much of your instance usage is covered by a reservation.
• Savings Plans utilization budgets – Define a utilization threshold and receive alerts
when the usage of your Savings Plans falls below that threshold. This lets you see if
your Savings Plans are unused or under-utilized.
• Savings Plans coverage budgets – Define a coverage threshold and receive alerts
when your Savings Plans eligible usage that is covered by Savings Plans fall below
that threshold. This lets you see how much of your instance usage is covered by
Savings Plans.
• You can set up optional notifications that warn you if you exceed, or are forecasted to exceed, your
budgeted amount for cost or usage budgets. Or if you fall below your target utilization and coverage for RI
or Savings Plans budgets. You can have notifications sent to an Amazon SNS topic, to an email address, or
to both.
• If you use consolidated billing in an organization and you own the management account, you can use
IAM policies to control access to budgets by member accounts. By default, owners of member accounts can
create their own budgets but can't create or edit budgets for other users. You can create roles with
permissions that allow users to create, edit, delete, or read budgets in a specific account. However, we don't
support cross-account usage.
• A budget is only visible to users with access to the account that created the budget, and with access to
the budget itself. For example, a management account can create a budget that tracks a specific member
account's cost, but the member account can only view the same budget if they receive access to the
management account.
 Budget Creation using budget template (simplified)

To create a budget using a template

1. Sign in to the AWS Management Console and open the AWS Cost Management
console at [Link]
2. In the navigation pane, choose Budgets.
3. At the top of the page, choose Create budget.
4. Under Budget setup, choose Use a template (simplified).
5. Under Templates, choose a template that best matches your use case:
• Zero spend budget: A budget that notifies you after your spending exceeds AWS Free Tier
limits.
• Monthly cost budget: A monthly budget that notifies you if you exceed, or are forecasted to
exceed, the budget amount.
• Daily Savings Plans coverage budget: A coverage budget for your Savings Plans that
notifies you when you fall below the defined target. This helps you to identify your on
demand spend sooner so that you can consider purchasing a new commitment.
• Daily reservation utilization budget: A utilization budget for your Reserved Instances that
notifies you when you fall below the defined target. This helps you to identify when you're
not using some of your hourly commitment that you already purchased.
6. Update the details and settings for your specific template.
7. Choose Create budget.
 Customizing a budget (advanced)
Customizing a budget (advanced) You can customize a budget to set parameters specific to your
use case. You can customize the time period, the start month, and specific accounts. Creating a
customized budget involves a 5-step workflow.
You can choose between four main budget types that track against the following:
• Cost (see Creating a cost budget)
• Usage (see Creating a usage budget)
• Savings Plans (see Creating a Savings Plans budget)
• Savings Plans utilization
• Savings Plans coverage
• Reservation (see Creating a reservation budget)
• Reservation utilization
• Reservation coverage
 AWS Trusted Advisor

• Trusted Advisor inspects your AWS environment, and then makes

recommendations when opportunities exist to save money, improve system

availability and performance, or help close security gaps.

• Trusted Advisor checks your account, evaluates, and recommends.

• It recommends helping you follow AWS best practices.

 How Trusted Advisor Works
Trusted Advisor is a web-based, real-time recommendation service.
The service checks your account and compares its findings to the following
categories:
• Cost optimization
• Performance
• Security
• Fault tolerance
• Service limits
It will also provide recommendations for learning material to understand AWS
best practices better.
 AWS Trusted Advisor Dashboard

Trusted Advisor has a dashboard which is web-based.

The dashboard gives you an overview of the completed checks and results per
category.
Green check: no problems
Orange triangle: recommended investigations
Red circle: recommended actions
AWS Trusted Advisor

127
 Best Practices Of AWS Trusted Advisor At
No Charge
Service Limits Check – This check inspects your usage with regard to the most
important service limits for each AWS product. It alerts you when you are using more
than 80% of your allocation resources such as EC2 instances and EBS volumes.
Security Groups – Specific Ports Unrestricted Check – This check will look for and
notify you of overly permissive access to your EC2 instances and help you to avoid
malicious activities such as hacking, denial-of-service attacks, and loss of data.
IAM Use Check – This check alerts you if you are using account-level credentials to
control access to your AWS resources instead of following security best practices by
creating users, groups, and roles to control access to the resources.

128
 Best Practices Of AWS Trusted Advisor At
No Charge

MFA on Root Account Check – This check recommends the use of multi-
factor authentication (MFA), to improve security by requiring additional
authentication data from a secondary device.

129
 AWS Trusted Advisor

© 2019 Amazon Web 130

Services, Inc. or its Affiliates.
AWS Trusted Advisor

131
AWS Trusted Advisor Automation –
Scenario-1

132
AWS Trusted Advisor Automation –
Scenario-1

133
 AWS Trusted Advisor
To sign in to the Trusted Advisor console

Sign in to the Trusted Advisor console at [Link]

On the Trusted Advisor Recommendations page, view the summary for each check category:
Action recommended (red) – Trusted Advisor recommends an action for the check. For example, a
check that detects a security issue for your IAM resources might recommend urgent steps.
Investigation recommended (yellow) – Trusted Advisor detects a possible issue for the check. For
example, a check that reaches a quota for a resource might recommend ways to delete unused
resources.
Checks with excluded items (gray) – The number of checks that have excluded items, such as
resources that you want a check to ignore. For example, this might be Amazon EC2 instances that
you don't want the check to evaluate.
 AWS Trusted Advisor
• You can do the following on the Trusted Advisor Recommendations page:
• To refresh all checks in your account, choose Refresh all checks.
• To create an .xls file that includes all check results, choose Download all
checks.
• Under Checks summary, choose a check category, such as Security, to view
the results.
• Under Potential monthly savings, you can view how much you can save for
your account and the cost optimization checks for recommendations.
• Under Recent changes, you can view changes to check statuses within the last
30 days. Choose a check name to view the latest results for that check or choose
the arrow icon to view the next page.