How cost data arrives
Cost data is a day late and sometimes two, and every design in this space has to start by accepting that. What is worth knowing is exactly how late, what granularity you can get, and which faster signals exist for the handful of services that can run away faster than a day.
Key takeaways
- Billing data settles about 24 hours behind, and some lines take longer.
- Two sources: a daily API for service totals, and detailed reports for resource level.
- Some services have no resource-level attribution at all, and the report says so.
- Yesterday’s figure can still change; re-fetch the last three days each run.
- For the fastest-moving services, a usage metric is a same-hour proxy worth adding.
The delay
- Database
- App integration
- Machine learning
- Management
- Analytics
Why three days
Yesterday’s figure is provisional. Some usage is reported late, some is reallocated between services, and credits and discounts land afterwards. A figure fetched on Wednesday for Tuesday can be meaningfully different when fetched again on Friday.
So each run re-fetches the last three days and updates the history rather than only appending. Without that, a day that was restated upwards stays in the baseline at its provisional value, and the baseline slowly drifts away from what the bill actually says.
Two granularities
| Level | What you get | Latency |
|---|---|---|
| Service, daily | Total per service per day | About 24 hours |
| Resource, daily | Per function, bucket, table, instance | 24–48 hours, and not for everything |
| Usage metrics | Invocations, requests, GB stored | Minutes |
The third row is the interesting one. Usage metrics are not cost data, they are available almost immediately, and for the services that can run away fastest they are a very good proxy. A Lambda function running four hundred thousand times in an hour is visible in metrics within minutes and in cost data tomorrow.
Where resource attribution does not exist
Several services report only at the account level, or aggregate resources in ways that make attribution impossible. Data transfer is the classic example: a large egress charge is real, attributable to nothing specific in the billing data, and frequently the hardest anomaly to chase.
The honest handling is to say so in the report rather than to guess. “Data transfer up £18; this service does not report at resource level, so the likely candidates by volume are these three buckets” is more useful than either silence or a confident wrong attribution.
The fast proxies
- Compute
- Storage
- Machine learning
Adding those three as separate hourly checks, compared against their own patterns exactly like the cost lines, turns a one-day detection into a one-hour one for the three services that most often produce a genuinely expensive surprise. They are not cost data and the report says so — “invocations are 200x normal; the cost impact will appear tomorrow” — which is both honest and completely actionable.
Next: how an anomaly is judged.
All posts