Set up a spend-by-service dashboard

What you'll build

You'll create a CloudWatch dashboard named CloudPeek-Spend with two widgets. The first is a bar chart of the five services you've spent most on so far this month, found automatically, with your account's total. The second is that month-to-date total with a sparkline of the past week. In CloudPeek they look like this:

Choose how you'd like to set it up:

Want your alarms on your Home Screen too? See Set up an alarms dashboard.

Before you start

• An AWS account, and a sign-in that can change billing preferences and create CloudWatch dashboards and IAM users and policies, such as an administrator. If your accounts are in AWS Organizations, use the management account to see the whole organisation's spend.
• CloudPeek on your iPhone or iPad.

1. Turn on billing metrics

AWS only sends your estimated charges to CloudWatch after you opt in. You do this once per account.

1. Sign in to the AWS console and open Billing and Cost Management › Billing preferences.
2. Under Alert preferences, choose Edit.
3. Select Receive CloudWatch billing alerts and save the change.

Until the first data arrives, the dashboard you'll create next says No data available. To check whether billing metrics have started, open CloudWatch in us-east-1 and choose Metrics › All metrics: a Billing namespace appears once they have. Metrics Explorer doesn't list billing metrics, so look under All metrics.

2. Create the dashboard

A CloudWatch dashboard is defined by a short piece of JSON. You can paste it into the console or create the dashboard with the AWS CLI.

In the console

1. Open the CloudWatch console in us-east-1 and choose Create dashboard.
2. Name it CloudPeek-Spend and choose Create dashboard. If the Add widget window opens, close it.
3. Choose Actions › View/edit source, replace the source with the JSON below, and choose Update.
4. Choose Save.

{
  "start": "-P7D",
  "widgets": [
    {
      "type": "metric",
      "x": 0,
      "y": 0,
      "width": 12,
      "height": 8,
      "properties": {
        "title": "Top 5 services by spend",
        "view": "bar",
        "region": "us-east-1",
        "start": "-P1D",
        "stat": "Maximum",
        "period": 21600,
        "metrics": [
          [ "AWS/Billing", "EstimatedCharges", "Currency", "USD", { "label": "Total" } ],
          [ { "expression": "SORT(SEARCH('{AWS/Billing,Currency,ServiceName} MetricName=\"EstimatedCharges\" Currency=\"USD\"', 'Maximum', 21600), MAX, DESC, 5)", "label": "${PROP('Dim.ServiceName')}", "id": "top" } ]
        ]
      }
    },
    {
      "type": "metric",
      "x": 12,
      "y": 0,
      "width": 6,
      "height": 8,
      "properties": {
        "title": "Month-to-date spend",
        "view": "singleValue",
        "region": "us-east-1",
        "stat": "Maximum",
        "period": 21600,
        "sparkline": true,
        "metrics": [
          [ "AWS/Billing", "EstimatedCharges", "Currency", "USD", { "label": "Total" } ]
        ]
      }
    }
  ]
}

With the AWS CLI

Download the JSON above, then run:

aws cloudwatch put-dashboard \
  --region us-east-1 \
  --dashboard-name CloudPeek-Spend \
  --dashboard-body file://spend-by-service.json

How it works

• The expression row finds your top services for you. SEARCH finds every service's estimated charges, and SORT(…, MAX, DESC, 5) keeps the five biggest. Services you start using appear on their own. To show more or fewer, change the 5 at the end of the expression.
• The label ${PROP('Dim.ServiceName')} names each bar after its service, such as AmazonEC2 or AWSLambda. CloudPeek shows the short name (EC2, Lambda), lists them biggest first, and adds up any that don't fit into Other.
• The row with only a Currency dimension is your whole account's charges so far this month. CloudPeek shows it as the widget's Total rather than as a bar, so services outside the top five still count. In the CloudWatch console it appears as one more bar.
• Charges count from the start of the month, so the bar chart looks at just the last day ("start": "-P1D"). That way the ranking follows this month's charges rather than last month's. The month-to-date total uses the dashboard's week for its sparkline.
• If your bill isn't in US dollars, change USD in both rows and in the expression to your currency code.
• For a donut of each service's share, change "view": "bar" to "view": "pie". CloudPeek puts the Total in the middle and shows everything outside the top five as an Other slice.

To see every service's charges, open CloudWatch in us-east-1 and choose All metrics › Billing › By Service.

3. Give CloudPeek read-only access

CloudPeek only reads. It needs four CloudWatch permissions and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudPeekReadOnly",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:ListDashboards",
        "cloudwatch:GetDashboard",
        "cloudwatch:GetMetricData",
        "cloudwatch:DescribeAlarms"
      ],
      "Resource": "*"
    }
  ]
}

The AWS managed policy CloudWatchReadOnlyAccess works too, but it grants more than CloudPeek needs. Then choose how you'll sign in.

Option A: an IAM user with an access key

1. In the IAM console, choose Policies › Create policy. Switch to the JSON editor, paste the policy and choose Next. Name it CloudPeekReadOnly and choose Create policy.
2. Choose Users › Create user. Name the user cloudpeek, leave console access off, and choose Next.
3. Choose Attach policies directly, select CloudPeekReadOnly, choose Next, then Create user.
4. Open the new user, go to the Security credentials tab and choose Create access key. Choose Application running outside AWS, then Next and Create access key.
5. Keep the page open, or download the .csv file. The secret access key is shown only once.

With the AWS CLI

aws iam create-policy \
  --policy-name CloudPeekReadOnly \
  --policy-document file://cloudpeek-read-only-policy.json

aws iam create-user --user-name cloudpeek

aws iam attach-user-policy \
  --user-name cloudpeek \
  --policy-arn "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):policy/CloudPeekReadOnly"

aws iam create-access-key --user-name cloudpeek

Option B: IAM Identity Center

If your organisation signs in through the AWS access portal, give CloudPeek a permission set instead of a long-lived access key.

1. In the IAM Identity Center console, choose Permission sets › Create permission set, then Custom permission set.
2. Under Inline policy, paste the policy above and choose Next. If the account already has the CloudPeekReadOnly policy (the CloudFormation template creates it), you can attach it as a customer managed policy instead.
3. Name the permission set CloudPeekReadOnly, choose Next, then Create. CloudPeek renews the role's credentials automatically, so the default session duration is fine.
4. Choose AWS accounts, select the account with your dashboard, and choose Assign users or groups. Pick the people who'll use CloudPeek, select the CloudPeekReadOnly permission set, and choose Submit.
5. Note your AWS access portal URL, such as https://my-company.awsapps.com/start. It's shown on the IAM Identity Center dashboard.

4. Sign in and pin your widgets

1. Open CloudPeek and tap Add Account (later, it's on the Accounts tab). Give the account a label if you like.
   • Access key: choose IAM keys. Enter the access key ID and secret access key, or copy them and tap Paste credentials block. Choose us-east-1 as the default region, then tap Validate & Save.
   • IAM Identity Center: choose SSO, enter your AWS access portal URL and tap Continue in Safari. Approve the request (check that the code matches the one in CloudPeek), then choose the account and the CloudPeekReadOnly role and tap Validate & Save.
2. On Home, open the CloudPeek-Spend dashboard and tap Pin on Top 5 services by spend and Month-to-date spend. If you've added several accounts, choose this one at the top of Home first.
3. Touch and hold an empty area of your Home Screen until the apps jiggle. Tap Edit, then Add Widget. Find CloudPeek, pick a size and tap Add Widget. Medium suits the bar chart; small suits the total.
4. New widgets show your first pinned widget. To choose another, touch and hold the widget and tap Edit Widget.

The total also works well on the Lock Screen, where widgets show the latest value.

Or: set it all up with CloudFormation

One stack creates the dashboard, the read-only policy and, if you want one, the IAM user. Turn on billing metrics first (step 1): CloudFormation can't change that setting.

What it creates

Parameters

In the console

1. Download cloudpeek-setup.yaml.
2. Open the CloudFormation console in us-east-1. Choose Upload a template file, select the file, and choose Next.
3. Name the stack CloudPeek, check the parameters, and choose Next twice.
4. Select I acknowledge that AWS CloudFormation might create IAM resources with custom names, then choose Submit.
5. When the stack reaches CREATE_COMPLETE, its Outputs tab links to the dashboard and shows the next step.

Then create the user's access key (Option A, steps 4 and 5), or for IAM Identity Center, attach CloudPeekReadOnly to a permission set (Option B). Finish with step 4.

With the AWS CLI

aws cloudformation deploy \
  --region us-east-1 \
  --stack-name CloudPeek \
  --template-file cloudpeek-setup.yaml \
  --capabilities CAPABILITY_NAMED_IAM

aws iam create-access-key --user-name cloudpeek

To change the defaults, add --parameter-overrides, for example --parameter-overrides CreateUser=false for IAM Identity Center, or TopServices=10 to chart your ten biggest services.

Removing it

CloudFormation can't delete a user that still has an access key, or a policy that something outside the stack still uses. Delete the user's access key and detach the policy from any permission sets first, then delete the stack:

aws iam list-access-keys --user-name cloudpeek
aws iam delete-access-key --user-name cloudpeek --access-key-id <access-key-id>
aws cloudformation delete-stack --region us-east-1 --stack-name CloudPeek

Troubleshooting

The widgets are empty, or the dashboard says “No data available”

Billing metrics aren't reaching CloudWatch yet. Check that they're turned on (step 1) and give them a few hours. Then look for the Billing namespace under All metrics in us-east-1 (Metrics Explorer doesn't list billing metrics). In AWS Organizations, set this up in the management account, which sees the whole organisation's charges.

CloudPeek says access is denied

Check that the CloudPeekReadOnly policy is attached to the user, or that the permission set is assigned to you for this account. Also check that you signed in to the account that has the dashboard.

A service is missing

It isn't one of your five biggest this month. To chart more, raise the number at the end of the SORT expression (see how it works), or set TopServices in the template. Its charges are already included in the Total.

The Total is bigger than the bars added up

That's expected. The Total is your whole bill so far this month, including services outside your top five.

Still stuck?

Email support@cloudpeek.app. Never send us your secret access key.