القائمة
Reconcile AWS Cost and Usage Report (CUR) data with CloudWatch metrics to validate billing accuracy, identify data lag, and troubleshoot cost discrepancies for networking resources.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | cur-cloudwatch-correlation |
| description | Reconcile AWS Cost and Usage Report (CUR) data with CloudWatch metrics to validate billing accuracy, identify data lag, and troubleshoot cost discrepancies for networking resources. |
Reconcile AWS Cost and Usage Report (CUR) data with CloudWatch metrics to validate billing accuracy, identify data lag, and troubleshoot cost discrepancies for networking resources (NAT Gateway, Transit Gateway, VPC Endpoints, Load Balancers).
CUR_GB × 1024³ = CloudWatch_Bytes4.694e-07 GB × 1,073,741,824 = 504 bytesTransitGateway dimension alone aggregates all attachmentsTransitGateway + TransitGatewayAttachment level for accurate per-flow data| Resource | CUR Usage Type | What It Measures |
|---|---|---|
| NAT Gateway | NatGateway-Bytes | Bytes processed (in + out) |
| Transit Gateway | TransitGateway-Bytes | Bytes processed per attachment |
| Transit Gateway | *-AWS-Out-Bytes | Cross-region peering transfer |
Query CUR to see exactly which time periods have billing records:
SELECT
line_item_usage_start_date,
line_item_usage_end_date,
line_item_usage_type,
line_item_operation,
line_item_usage_amount,
pricing_unit
FROM cur_reports
WHERE line_item_resource_id = 'tgw-xxxxx'
AND line_item_usage_type LIKE '%Bytes%'
ORDER BY line_item_usage_start_date
Or use the CUR MCP tool:
getResourceCostDetail(resource_id, start_date, end_date)
Note: The MCP tool aggregates data — for hourly granularity, use Athena directly.
Once you know CUR covers (for example) April 6th 13:00-14:00 UTC:
get_metric_statistics(
Namespace='AWS/TransitGateway',
MetricName='BytesIn',
Dimensions=[
{'Name': 'TransitGateway', 'Value': 'tgw-xxxxx'},
{'Name': 'TransitGatewayAttachment', 'Value': 'tgw-attach-xxxxx'}
],
StartTime='2026-04-06T13:00:00Z',
EndTime='2026-04-06T14:00:00Z',
Period=3600,
Statistics=['Sum']
)
| Source | Raw Value | Converted |
|---|---|---|
| CUR | 4.694e-07 GB | 504 bytes |
| CloudWatch | 504 bytes | 504 bytes |
| Match? | ✅ | ✅ |
Transit Gateway metrics exist at multiple levels:
| Dimensions | What It Shows |
|---|---|
| TransitGateway only | Aggregate across all attachments (may double-count) |
| TransitGateway + TransitGatewayAttachment | Per-attachment traffic (accurate) |
| TransitGateway + TransitGatewayAttachment + AvailabilityZone | Per-AZ breakdown |
Always query at the attachment level to avoid double-counting when traffic flows through multiple attachments.
For a VPC → TGW → Peering flow:
The actual data transfer is ~3GB, but TGW-level aggregate would show ~6GB.
| Usage Type Pattern | Meaning |
|---|---|
| USE1-TransitGateway-Bytes | VPC attachment processing in us-east-1 |
| USE1-EUC1-AWS-Out-Bytes | Cross-region transfer us-east-1 → eu-central-1 |
| TransitGatewayVPC operation | Traffic through VPC attachment |
| TGWPeering-Out operation | Traffic through peering attachment |
| Dimensions | Metrics |
|---|---|
| NatGatewayId | BytesInFromDestination, BytesInFromSource, BytesOutToDestination, BytesOutToSource |
| CloudWatch Metric | Direction | CUR Equivalent |
|---|---|---|
| BytesOutToDestination | EC2 → NAT → Internet | NatGateway-Bytes (egress portion) |
| BytesInFromDestination | Internet → NAT → EC2 | NatGateway-Bytes (ingress portion) |
Total billable = BytesOutToDestination + BytesInFromDestination
| Symptom | Likely Cause | Resolution |
|---|---|---|
| CUR shows much less than CloudWatch | CUR lag (24-48h) | Wait or compare only overlapping periods |
| CUR shows more than CloudWatch | Resource ID mismatch, or metric retention expired | Verify resource IDs match |
| Numbers close but not exact | Rounding, sampling differences | Acceptable variance < 1% |
| CUR shows $0 cost but has usage | Free tier, or RI/SP coverage | Check line_item_line_item_type |
SELECT
line_item_usage_start_date,
line_item_usage_end_date,
line_item_usage_type,
line_item_operation,
line_item_usage_amount,
line_item_unblended_cost,
pricing_unit
FROM cur_reports.cur_reports
WHERE line_item_resource_id = 'nat-xxxxx'
AND line_item_usage_start_date >= timestamp '2026-04-01'
AND line_item_usage_type LIKE '%Bytes%'
ORDER BY line_item_usage_start_date
list_metrics(
Namespace='AWS/TransitGateway',
Dimensions=[{'Name': 'TransitGateway', 'Value': 'tgw-xxxxx'}]
)
get_metric_statistics(
Namespace='AWS/TransitGateway',
MetricName='BytesIn',
Dimensions=[
{'Name': 'TransitGateway', 'Value': 'tgw-xxxxx'},
{'Name': 'TransitGatewayAttachment', 'Value': 'tgw-attach-xxxxx'}
],
StartTime='2026-04-01T00:00:00Z',
EndTime='2026-04-08T00:00:00Z',
Period=86400, # Daily
Statistics=['Sum']
)