AWS Cost & Usage

Bring your AWS Cost and Usage Report (CUR) into groundcover.

Connect your AWS Cost and Usage Report (CUR 2.0) as a data source to see cloud spend inside groundcover, right next to your telemetry. Point it at a single account, or at your management account for organization-wide cost.

What you get

• The ready-made AWS Cost Overview dashboard from the dashboard catalog, showing total spend, spend over time, and spend by service.

• Data Explorer with the Cloud Costs source to slice the data yourself. Group by service, account, region, or your allocation tags, and switch between net unblended and amortized cost.

• Cost figures labeled with their measure: net unblended cost (spend after discounts, before credits, taxes, and refunds) by default, or amortized cost (effective spend, spreading Reserved-Instance and Savings-Plan fees over their term). The two totals differ.

• Automatic refresh: groundcover picks up each new report as AWS delivers it. The first arrives within 24–48 hours of connecting, and the current day is always partial.

Setup options

The setup creates four things in your AWS account: a CUR 2.0 data export, a delivery S3 bucket, an SQS notifications queue, and a read-only IAM role that groundcover's integrations agent assumes to read the reports. Pick whichever path fits your workflow. The wizard pre-fills the CloudFormation stack with your values.

AWS Data Exports operate in us-east-1, so the delivery bucket must live there.

Two paths, same result. Start from Add a data source → AWS Cost & Usage in the app (Admin only).

CloudFormation

1. Click Launch CloudFormation in the wizard. The stack opens pre-filled with your bucket and export name.

2. Review the stack and click Create stack.

3. When it completes, copy NotificationsQueueUrl from the Outputs tab into the next step. That is all groundcover needs. It derives your account and the read-only reader role from the queue URL.

Manual setup

1. Create the Cost and Usage Report export

In AWS Billing → Data Exports, create a Standard data export (CUR 2.0):

• Content: Include resource IDs, Split cost allocation data

• Delivery: Hourly granularity, Overwrite existing data export file, Parquet compression

• Deliver to an S3 bucket in us-east-1 (existing buckets work, just note your export path prefix)

For the full console walkthrough, see AWS's Creating Standard data exports guide.

Already exporting a CUR? Reuse it only if it matches the settings above: a CUR 2.0 export with hourly granularity, resource IDs, split cost allocation data, overwrite delivery, and Parquet compression. If any of these differ, create a new export; otherwise you only need the queue and role below.

2. Locate the export details

Note the bucket name, bucket region (us-east-1), export path prefix (no leading/trailing /; cost/hourly is fine), and export name.

3. Create the notifications queue

groundcover learns about new reports from S3 event notifications and never scans the bucket.

• Create a standard SQS queue in the bucket's region (us-east-1).

• Add a bucket event notification: event s3:ObjectCreated:*, prefix filter <EXPORT_PATH_PREFIX>/ (omit if no prefix), suffix filter -Manifest.json, destination = the queue.

• Queue access policy: allow sqs:SendMessage from s3.amazonaws.com with source ARN = the bucket.

Use a dedicated queue per connection. groundcover consumes and deletes messages from the queue as it reads them, so pointing two CUR connections at the same queue makes them delete each other's notifications and silently stop ingestion. The CloudFormation path creates a dedicated queue automatically.

4. Create the IAM role

This is the role groundcover's integrations agent assumes. Your integrations-agent role ARN is shown in the wizard.

The role must be named <export-name>-reader (matching the connection/export name you use in the wizard). groundcover derives the reader role from your queue URL plus this exact name, so a role with any other name won't be found.

Permissions policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadCurObjects",
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::BUCKET_NAME/EXPORT_PATH_PREFIX/*"
    },
    {
      "Sid": "ListCurBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::BUCKET_NAME",
      "Condition": {
        "StringLike": {
          "s3:prefix": ["EXPORT_PATH_PREFIX", "EXPORT_PATH_PREFIX/*"]
        }
      }
    },
    {
      "Sid": "GetCurBucketLocation",
      "Effect": "Allow",
      "Action": ["s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::BUCKET_NAME"
    },
    {
      "Sid": "ConsumeCurNotifications",
      "Effect": "Allow",
      "Action": ["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"],
      "Resource": "QUEUE_ARN"
    }
  ]
}

Replace EXPORT_PATH_PREFIX with your export path prefix. If the export has no prefix, drop it from both places: set the ReadCurObjects resource to arn:aws:s3:::BUCKET_NAME/* and remove the s3:prefix condition from ListCurBucket. On a shared bucket, always keep the prefix so the role is scoped to your export only.

If the bucket uses SSE-KMS, also allow kms:Decrypt and kms:DescribeKey on the bucket's key.

Trust policy (AGENT_ACCOUNT_ID = the account in the agent role ARN):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::AGENT_ACCOUNT_ID:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "ArnEquals": { "aws:PrincipalArn": "INTEGRATIONS_AGENT_ROLE_ARN" }
      }
    }
  ]
}

5. Connect groundcover

In the wizard, enter the name, S3 bucket, and (for an existing export) the export path prefix, then paste the Notifications queue URL. groundcover derives your account and the reader role from the queue URL, so there is no role ARN to enter.

Once data arrives, install the AWS Cost Overview dashboard from the catalog, or explore the raw data yourself in Data Explorer.