Importing usage data into Application Cost Proﬁler

Step 1: Preparing your resource usage data

As a resource is being used in your service, you track which tenant is using it. Record this data into a table that you can later upload for Application Cost Proﬁler to import. Each row in the table describes a resource , the tenant that is using the resource, and the start and end times of that usage. An example of a resource is an Amazon Elastic Compute Cloud (Amazon EC2) instance that is being used.

This step requires that you integrate code into your service to output the correct information about the usage.

The ﬁelds that are in a resource usage table are listed in the following table.

Field Description

ApplicationId Identiﬁes the application or product in your

system that is being used. Deﬁnes the scope of the tenant metadata.

TenantId An identiﬁer in your system for the tenant who

is consuming the speciﬁed resource. Application Cost Proﬁler aggregates to this level within the ApplicationId.

TenantDesc (Optional) Additional data about the tenant for

your own additional reporting.

UsageAccountId The account that the resource runs in (important

for accounts that are part of an organization).

Step 1: Preparing your resource usage data

Field Description

StartTime Timestamp (in milliseconds and microseconds)

from Epoch, in UTC. Indicates the start time of the period for the usage by the speciﬁed tenant.

EndTime Timestamp (in milliseconds and microseconds)

from Epoch, in UTC. Indicates the end time of the period for the usage by the speciﬁed tenant.

ResourceId Amazon Resource Name (ARN) for resource being

used.

Name (Optional) As an alternative to specifying a

ResourceId, you can specify a Name resource tag to attribute costs to a set of resources (the ﬁeld must include the value you want to use for the Name tag). Resource tags are enabled as part of your Cost and Usage Report. For more information about resource tags, see Resource tags details in the Cost and Usage Report User Guide.

The output must be in a comma-separated values (.csv) ﬁle that includes a heading row, as shown in the following example.

Save the data as a ﬁle, with a .csv extension (or .csv.gzip if compressed with gzip). When you upload this data to Application Cost Proﬁler, each time slice is assigned to the associated tenant. In this example, the report includes the time slice of the Amazon EC2 instance cost for that tenant. For EC2 instances only, slices that are not associated with a speciﬁc tenant are added to an unattributed tenant. Overlapping time slices are counted multiple times. It's your responsibility to ensure that the data in your usage table is accurate.

NoteYour ﬁle must represent one hour of time. If a resource is used over multiple hours, end the usage on the hour, and have a new record in the next ﬁle that starts at the same time.

You must submit a single ﬁle containing an entire hour's data. If multiple ﬁles are submitted for the same hour's data, Application Cost Proﬁler only considers the data in the latest ﬁle.

For example, the following table shows how Application Cost Proﬁler calculates usage for three tenants, over an hour (3,600,000 milliseconds), based on provided time slices.

Tenant Provided time slices Calculated percent of hourly

cost

Tenant1 1,200,000 ms 33.34%

Tenant2 600,000 ms 16.66%

Step 2: Uploading your resource usage

Tenant Provided time slices Calculated percent of hourly

cost

<unattributed> 50.00%

In this example, Tenant1 is assigned one-third of the hour and Tenant2 is assigned one-sixth of the hour.

The remaining half-hour (1,800,000 ms) is not attributed to either of the clients, which is 50% of the hour.

Note

Currently, the following resources are enabled for Application Cost Proﬁler: Amazon EC2

instances, Lambda functions, Amazon Elastic Container Service (Amazon ECS) instances, Amazon Simple Queue Service (Amazon SQS) queues, Amazon Simple Notiﬁcation Service (Amazon SNS) topics, and Amazon DynamoDB reads and writes.

Amazon SQS, Amazon SNS, and DynamoDB usage is not charged by time, unlike most

resources. In their case, the usage during an hour (for example, a number of reads and writes in DynamoDB), is categorized by the percentage of the hour that you allocate to diﬀerent tenants, regardless of when the reads or writes happened during the hour.

Step 2: Uploading your resource usage

After you have a ﬁle of usage by tenant, upload your data ﬁle to Amazon S3 and make sure that Application Cost Proﬁler has permission to access it.

To learn more about creating an S3 bucket, see Application Cost Proﬁler speciﬁc prerequisites (p. 4).

You must make sure that Application Cost Proﬁler has access to your S3 bucket. This only needs to be done once per S3 bucket (you can reuse the same bucket for uploading multiple usage ﬁles). For information about giving access to the bucket, see Giving Application Cost Proﬁler access to your usage data S3 bucket (p. 7). If the bucket is encrypted,see Giving Application Cost Proﬁler access to SSE-KMS encrypted S3 buckets (p. 8).

NoteIt is not required that you encrypt the S3 buckets that you use for usage data.

Upload your data to the S3 bucket as a ﬁle, with a .csv extension (or .csv.gzip if compressed with gzip), at hourly intervals. After you upload a new ﬁle, you must inform Application Cost Proﬁler that you have uploaded it so that the ﬁle can be imported into your report.

NoteBy giving Application Cost Proﬁler access to your usage data, you agree that we may temporarily copy such usage data objects to the US East (N. Virginia) AWS Region while processing reports.

These data objects will be kept in the US East (N. Virginia) Region until the monthly report generation is complete.

Step 3: Importing usage data into Application Cost Proﬁler

After you have uploaded usage data to an Amazon S3 bucket that Application Cost Proﬁler has access to, inform Application Cost Proﬁler that the data exists and to import it into your ﬁnal report. You do this by using the ImportApplicationUsage operation in the Application Cost Proﬁler API.

For information about the AWS Application Cost Proﬁler API, including the ImportApplicationUsage operation, see the AWS Application Cost Proﬁler API Reference.

The following example shows how to call ImportApplicationUsage. Replace the input text in brackets with the values for your S3 bucket and uploaded object.

Step 3: Importing usage data into Application Cost Proﬁler

POST /ImportApplicationUsage HTTP/1.1 Content-type: application/json {

"sourceS3Location" : {

"bucket": "<bucket-name>", "key": "<object-key>", "region": "<region-id>"

} }

Note

The region parameter is only required if your bucket is in an AWS Region that is disabled by default. For more information, see Managing AWS Regions in the AWS General Reference.

Application Cost Proﬁler generates a new report at the frequency that you requested when conﬁguring your report (p. 10), using the data that you imported with ImportApplicationUsage.

After you have conﬁgured your report and automated importing your usage data into Application Cost Proﬁler, you are ready to view your generated reports. For more information about reports, see Using Application Cost Proﬁler reports (p. 15).

Data available in an Application Cost Proﬁler report

Using Application Cost Proﬁler reports

After you have integrated your usage data with AWS Application Cost Proﬁler and are sending the data on an hourly basis, Application Cost Proﬁler automatically generates your report.

Reports are generated either daily or monthly, based on the option you selected when conﬁguring your report (p. 10). Reports are delivered to the Amazon Simple Storage Service (Amazon S3) bucket that you selected when you conﬁgured the report.

Daily reports generated on the ﬁrst day of the month have the previous month's data.

Data available in an Application Cost Proﬁler report

The columns that are created in a usage report are shown in the following table.

Column name Description

PayerAccountId The management account ID in an organization,

or the account ID if the account is not part of AWS Organizations.

UsageAccountId The account ID for the account with usage.

LineItemType The type of record. Always Usage.

UsageStartTime Timestamp (in milliseconds) from Epoch, in UTC.

Indicates the start time of the period for the usage by the speciﬁed tenant.

UsageEndTime Timestamp (in milliseconds) from Epoch, in UTC.

Indicates the end time of the period for the usage by the speciﬁed tenant.

ApplicationIdentiﬁer The ApplicationId speciﬁed in the usage data sent to Application Cost Proﬁler.

TenantIdentiﬁer The TenantId speciﬁed in the usage data sent to

Application Cost Proﬁler. Data with no record in the usage data is collected in unattributed.

TenantDescription The TenantDesc speciﬁed in the usage data sent to Application Cost Proﬁler.

ProductCode The AWS product being billed (for example,

AmazonEC2).

UsageType The type of usage being billed (for example,

BoxUsage:c5.large).

Data available in an Application Cost Proﬁler report

Column name Description

Operation The operation being billed (for example,

RunInstances).

ResourceId The resource ID or Amazon Resource Name (ARN)

for the resource being billed.

ScaleFactor If a resource is over-allocated for an hour, for

example, the usage data reported is equal to 2 hours instead of 1 hour, a scale factor is applied to make the total equal the actual billed amount (in this case, 0.5). This column reports the scale factor used for the speciﬁc resource for that hour. The scale factor is always greater than zero (0) and less than or equal to 1.

TenantAttributionPercent The percentage of the usage attributed to the speciﬁed tenant (between zero (0) and 1).

UsageAmount The amount of usage attributed to the speciﬁed

tenant.

CurrencyCode The currency that the rate and cost are in (for

example, USD).

Rate The billing rate for the usage, per unit.

TenantCost The total cost for that resource for the speciﬁed

tenant.

Region The AWS Region of the resource.

Name If you created resource tags for your resources

on the Cost and Usage report, or through the resource usage data, the Name tag is shown here.

For more information about resource tags, see Resource tags details in the Cost and Usage Report User Guide.

The following is an example of the output report for one resource for two hours.

PayerAccountId,UsageAccountId,LineItemType,UsageStartTime,UsageEndTime,ApplicationIdentifier,TenantIdentifier,TenantDescription,ProductCode,UsageType,Operation,ResourceId,ScaleFactor,TenantAttributionPercent,UsageAmount,CurrencyCode,Rate,TenantCost,Region,Name

In this example, the ﬁrst hour is allocated to Tenant1 for half of the time. A half hour remains as unattributed. In the second hour, four tenants are all allocated the full hour. In this case, the scale

Data available in an Application Cost Proﬁler report

factor scales them all down by 0.25, and they are all allocated one-quarter of the hour. You can see the ﬁnal cost in the TenantCost column.

Service quotas

AWS Application Cost Proﬁler quotas and endpoints

Your AWS account has default quotas, formerly referred to as limits, for each AWS service. Unless otherwise noted, each quota is AWS Region-speciﬁc. You can request increases for some quotas, and other quotas cannot be increased.

The following tables list the service quotas per account and the AWS Region endpoints for Application Cost Proﬁler.

Service quotas

Resource Default value Description

Rate of PutReportDefinition

requests 5 The maximum number of

PutReportDefinition

requests 5 The maximum number of

GetReportDefinition

Maximum size of usage data ﬁle 10 MB The maximum size of an hourly usage data ﬁle.

Service endpoints

Application Cost Proﬁler is a global service. All API calls must be made to the US East (N. Virginia) endpoint.

• US East (N. Virginia) – application-cost-profiler.us-east-1.amazonaws.com

Data protection

Security in AWS Application Cost Proﬁler

Cloud security at AWS is the highest priority. As an AWS customer, you beneﬁt from a data center and network architecture that is built to meet the requirements of the most security-sensitive organizations.

Security is a shared responsibility between AWS and you. The shared responsibility model describes this as security of the cloud and security in the cloud:

• Security of the cloud – AWS is responsible for protecting the infrastructure that runs AWS services in the AWS Cloud. AWS also provides you with services that you can use securely. Third-party auditors regularly test and verify the eﬀectiveness of our security as part of the AWS Compliance Programs.

To learn about the compliance programs that apply to Application Cost Proﬁler, see AWS Services in Scope by Compliance Program.

• Security in the cloud – Your responsibility is determined by the AWS service that you use. You are also responsible for other factors including the sensitivity of your data, your company’s requirements, and applicable laws and regulations

This documentation helps you understand how to apply the shared responsibility model when using AWS Application Cost Proﬁler. It shows you how to conﬁgure Application Cost Proﬁler to meet your security and compliance objectives. You also learn how to use other AWS services that help you to monitor and secure your Application Cost Proﬁler resources.

Contents

• Data protection in AWS Application Cost Proﬁler (p. 19)

• Identity and access management for AWS Application Cost Proﬁler (p. 20)

• Compliance validation for AWS Application Cost Proﬁler (p. 31)

• Resilience in AWS Application Cost Proﬁler (p. 32)

• Infrastructure security in AWS Application Cost Proﬁler (p. 32)

Data protection in AWS Application Cost Proﬁler

The AWS shared responsibility model applies to data protection in AWS Application Cost Proﬁler.

As described in this model, AWS is responsible for protecting the global infrastructure that runs all of the AWS Cloud. You are responsible for maintaining control over your content that is hosted on this infrastructure. This content includes the security conﬁguration and management tasks for the AWS services that you use. For more information about data privacy, see the Data Privacy FAQ. For information about data protection in Europe, see the AWS Shared Responsibility Model and GDPR blog post on the AWS Security Blog.

For data protection purposes, we recommend that you protect AWS account credentials and set up individual user accounts with AWS Identity and Access Management (IAM). That way each user is given only the permissions necessary to fulﬁll their job duties. We also recommend that you secure your data in the following ways:

• Use multi-factor authentication (MFA) with each account.

Encryption at rest

• Use SSL/TLS to communicate with AWS resources. We recommend TLS 1.2 or later.

• Set up API and user activity logging with AWS CloudTrail.

• Use AWS encryption solutions, along with all default security controls within AWS services.

• Use advanced managed security services such as Amazon Macie, which assists in discovering and securing personal data that is stored in Amazon S3.

• If you require FIPS 140-2 validated cryptographic modules when accessing AWS through a command line interface or an API, use a FIPS endpoint. For more information about the available FIPS endpoints, see Federal Information Processing Standard (FIPS) 140-2.

We strongly recommend that you never put conﬁdential or sensitive information, such as your customers' email addresses, into tags or free-form ﬁelds such as a Name ﬁeld. This includes when you work with Application Cost Proﬁler or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into tags or free-form ﬁelds used for names may be used for billing or diagnostic logs. If you provide a URL to an external server, we strongly recommend that you do not include credentials information in the URL to validate your request to that server.

Encryption at rest

AWS Application Cost Proﬁler always encrypts all data stored in the service at rest without requiring any additional conﬁguration. This encryption is automatic when you use Application Cost Proﬁler.

For Amazon S3 buckets you provide, you must encrypt the report bucket, and can encrypt the usage data bucket and give Application Cost Proﬁler access. For more information, see Setting up Amazon S3 buckets for Application Cost Proﬁler (p. 5).

Encryption in transit

AWS Application Cost Proﬁler uses Transport Layer Security (TLS) and client-side encryption for encryption in transit. Communication with Application Cost Proﬁler is always done over HTTPS so your data is always encrypted in transit. This encryption is conﬁgured by default when you use Application Cost Proﬁler.

Identity and access management for AWS Application Cost Proﬁler

AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Application Cost Proﬁler resources. IAM is an AWS service that you can use with no additional charge.

Topics

• Audience (p. 21)

• Authenticating with identities (p. 21)

• Managing access using policies (p. 23)

• How AWS Application Cost Proﬁler works with IAM (p. 24)

• AWS Application Cost Proﬁler identity-based policy examples (p. 26)

• Troubleshooting AWS Application Cost Proﬁler identity and access (p. 29)

Audience

How you use AWS Identity and Access Management (IAM) diﬀers, depending on the work that you do in Application Cost Proﬁler.

Service user – If you use the Application Cost Proﬁler service to do your job, then your administrator provides you with the credentials and permissions that you need. As you use more Application Cost Proﬁler features to do your work, you might need additional permissions. Understanding how access is managed can help you request the right permissions from your administrator. If you cannot access a feature in Application Cost Proﬁler, see Troubleshooting AWS Application Cost Proﬁler identity and access (p. 29).

Service administrator – If you're in charge of Application Cost Proﬁler resources at your company, you probably have full access to Application Cost Proﬁler. It's your job to determine which Application Cost Proﬁler features and resources your employees should access. You must then submit requests to your IAM administrator to change the permissions of your service users. Review the information on this page to understand the basic concepts of IAM. To learn more about how your company can use IAM with Application Cost Proﬁler, see How AWS Application Cost Proﬁler works with IAM (p. 24).

IAM administrator – If you're an IAM administrator, you might want to learn details about how you can write policies to manage access to Application Cost Proﬁler. To view example Application Cost Proﬁler identity-based policies that you can use in IAM, see AWS Application Cost Proﬁler identity-based policy examples (p. 26).

Authenticating with identities

Authentication is how you sign in to AWS using your identity credentials. For more information about signing in using the AWS Management Console, see Signing in to the AWS Management Console as an IAM user or root user in the IAM User Guide.

You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles.

When you access AWS using credentials from another company, you are assuming a role indirectly.

To sign in directly to the AWS Management Console, use your password with your root user email address or your IAM user name. You can access AWS programmatically using your root user or IAM

在文檔中 Application Cost Proﬁler (頁 14-38)