Fetch Monthly AWS Spend by Service from the CLI

aws ce get-cost-and-usage queries the Cost Explorer API for actual AWS spend. With a MONTHLY granularity and GroupBy SERVICE, you get a clean breakdown of which services cost what. This is the snippet I run on the first of every month to pull a finops report.

Tested on AWS CLI v2.17.

When to Use This

• Monthly finops reports for engineering leadership
• Detecting cost anomalies (a service that doubled month-over-month)
• Auditing which services are actually being used in an account
• Feeding cost data into Slack/Datadog/your dashboard

Don't use this when you need real-time cost (Cost Explorer data lags 24-48 hours) or sub-daily granularity (use DAILY granularity, but it's still 24h delayed).

Code

# Last full month, grouped by service
aws ce get-cost-and-usage \
  --time-period Start=2026-05-01,End=2026-06-01 \
  --granularity MONTHLY \
  --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE \
  --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.UnblendedCost.Amount]' \
  --output table

Output looks like:

----------------------------------------------------
|              GetCostAndUsage                      |
+-------------------------------------+------------+
|  Amazon Elastic Compute Cloud       |  234.56    |
|  Amazon Relational Database Service |   89.12    |
|  Amazon Simple Storage Service      |   42.78    |
|  AWS Lambda                         |   12.34    |
|  Amazon CloudWatch                  |    8.91    |
+-------------------------------------+------------+

The --query filters the response to a flat array of [service, amount] pairs that the table formatter renders as a clean two-column report.

Usage

A monthly report script that emails the breakdown:

#!/usr/bin/env bash
set -euo pipefail
 
# Get the first day of the previous month and the first day of this month
START=$(date -v1d -v-1m +%Y-%m-%d)   # macOS
END=$(date -v1d +%Y-%m-%d)
# Linux equivalents:
# START=$(date -d "$(date +%Y-%m-01) -1 month" +%Y-%m-%d)
# END=$(date -d "$(date +%Y-%m-01)" +%Y-%m-%d)
 
echo "→ AWS spend for $START to $END"
echo
 
aws ce get-cost-and-usage \
  --time-period "Start=$START,End=$END" \
  --granularity MONTHLY \
  --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE \
  --output json \
  | jq -r '.ResultsByTime[0].Groups[]
      | "\(.Keys[0])\t$\(.Metrics.UnblendedCost.Amount)"' \
  | sort -t$'\t' -k2 -rn \
  | column -t -s$'\t'
 
# Total
TOTAL=$(aws ce get-cost-and-usage \
  --time-period "Start=$START,End=$END" \
  --granularity MONTHLY \
  --metrics UnblendedCost \
  --query 'ResultsByTime[0].Total.UnblendedCost.Amount' \
  --output text)
 
echo
echo "Total: \$$TOTAL"

The output is sorted by amount descending, formatted into aligned columns, with a total at the bottom. Run it from cron on the 2nd of every month and you have automated finops reporting in 20 lines of bash.

Caveats

• Cost Explorer data is 24-48 hours behind. Don't query "today" — you'll get incomplete data. Always query closed days.
• UnblendedCost is the most useful metric for engineering reports. BlendedCost averages reserved instance pricing across linked accounts, which makes per-account reports misleading.
• Each API call costs $0.01. Cache the result to a file if you're going to render it multiple times.
• The End date is exclusive. End=2026-06-01 means "up to but not including June 1". For all of May, that's correct. Off-by-one bugs are common here.
• SERVICE is the most common grouping but not the only one. Try LINKED_ACCOUNT, REGION, INSTANCE_TYPE, or USAGE_TYPE for different angles.
• Cost Explorer must be enabled in your account first. It's free to enable but takes 24 hours to start collecting data after enablement.

Related Snippets & Reading

• List Running EC2 Instances — for the "what is actually running" view
• Debug Which AWS Identity You're Using — when CE returns access denied
• aws ce get-cost-and-usage reference — official docs