Discrepancy between the calculation of AWS EC2 on-demand hours using CloudTrail events and the data provided by AWS Billing

Question

Hi, I'm currently working on comprehending my EC2 billing but have come across some inconsistencies in the process. I have been calculating the exact amount of hours one of my on demand instances ran the two past months using the instance's Cloud Trail events. Unfortunately, the monthly values I get differ from 1 hour with the value indicated in AWS billing.

The instance type is c5ad.xlarge, and I can know how much it costed the last two months because it is the only one I have with this type. The number of hours calculation is very simple. The instance was created in June, and started and stopped some times. What I do is sum the hours the instances was running (from 1st of June at 00:00:00 UTC to 30th of June at 23:59:59 UTC). The event time is also in UTC.  The number I get is 423.8h, and in the billing console of June I see a usage of 424.8h.

What is weird is that when I calculate the hours for July, instead of getting what is in the Billing console -1 hour, I get + 1 hour (I get 108.9, in console is 107.9). The process is the same, now taking from 1st of July at 00:00:00 UTC to 31th of July at 23:59:59 UTC. It is strange because the math is very simple.

The only difference I see between the two months is that in June the EC2 instances was created (RunInstances event), and after some start and stops it was left started the 14th of June. It then was stopped the 3rd of July. So in June it was open the whole end of the month (until 23:59:59), and in July it was open during the start of the month (starting from day 1 00:00:00). I don't know if that might make some differences.

In this other [question](https://repost.aws/knowledge-center/ec2-instance-hour-billing) I have seen that it mentions that starting and stopping the instance might cause more charges, but I haven't seen that in the documentations. Furthermore, if that was true my calculations would have a positive deviation as I don't have this into account, but in one case they are negative.

As I said, all the times are used in UTC. Which might be the reason of the mismatch between the calculated hours and the indicated ones in the Billing console?  Is there any EC2 On Demand billing detail I am not taking into account? Maybe as AWS cost calculation is a little bit slow, it doesn't charge the last hour of the month of June (as the instance was running), and compensates by charging it on July (instance wasn't running the last day of the month), and that is why we see -1 hour in June and +1 hour in July?

Accepted Answer

Not here to offer a solution unfortunately, but just some comments.

Your figures are based on the month ending at exactly midnight UTC on the first day of the month, which is also when AWS says the billing cycle starts and ends https://repost.aws/knowledge-center/monthly-aws-billing But it seems the total number of hours that AWS is charging you for will align with your figures only if the billing period starts and ends at 01:00 UTC on the first day of the month.

UTC+1 is the timezone for all of the eu-central, eu-south & eu-north regions, as well as eu-west-3 (Paris), albeit just now during the northern hemisphere summer they're on UTC+2.

eu-west-1 & 2 (Dublin & London) timezone is GMT, which is to all intents and purposes the same as UTC. But just now in the summer they're on UTC+1.

Is your instance in any of these regions? Whilst it wouldn't be consistent with what's in the knowledge doc above, it may be a plausible explanation for why things are out by an hour.

And/or the tool that you are using to parse the CloudTrail logs, is it reading the raw data in UTC and then "localising" the time when it formats the output? If your location, or the region of the AWS service that's parsing the logs, is one hour ahead of UTC that could explain why things have slipped by an hour.

It doesn't look like you are out of pocket, the cumulative number of hours of EC2 running time is correct. The worst that can happen is you are over-billed by 0.2% in June, and under-billed by the same in July.

It may be an interesting exercise to spin up a temporary EC2 in ap-southeast-2 (UTC+10) for a few hours at the end of this month & start of next, and then see what quantities you get billed for in each period. This would clearly show whether the billing period starts and ends at midnight UTC or midnight in the region where the instance is running.

Answer

I think what you are looking for is the AWS Cost and Usage Reports (CUR).  Full documentation on CUR is available at the following link.

https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html

# What are AWS Cost and Usage Reports?

The AWS Cost and Usage Reports (AWS CUR) contains the most comprehensive set of cost and usage data available. You can use Cost and Usage Reports to publish your AWS billing reports to an Amazon Simple Storage Service (Amazon S3) bucket that you own. You can receive reports that break down your costs by the hour, day, or month, by product or product resource, or by tags that you define yourself. AWS updates the report in your bucket once a day in comma-separated value (CSV) format. You can view the reports using spreadsheet software such as Microsoft Excel or Apache OpenOffice Calc, or access them from an application using the Amazon S3 API.

AWS Cost and Usage Reports tracks your AWS usage and provides estimated charges associated with your account. Each report contains line items for each unique combination of AWS products, usage type, and operation that you use in your AWS account. You can customize the AWS Cost and Usage Reports to aggregate the information either by the hour, day, or month.

AWS Cost and Usage Reports can do the following:
- Deliver report files to your Amazon S3 bucket
- Update the report up to three times a day
- Create, retrieve, and delete your reports using the AWS CUR API Reference

Discrepancy between the calculation of AWS EC2 on-demand hours using CloudTrail events and the data provided by AWS Billing

What are AWS Cost and Usage Reports?

Relevant content