Reference
Every cryptic line item on an AWS bill, decoded: what it means, why it spikes, and how to cut it. Each one is verified against official AWS documentation, not guessed.
Last updated 50 line items across 7 categories
Most of the confusion in a usage-type string comes down to a small, consistent grammar — a region code, an optional inter-region pair, a direction, and sometimes an instance-type suffix.
(no prefix)Generally us-east-1 (N. Virginia) is the default region for the classic "AWS Data Transfer" family (DataTransfer-Out-Bytes, DataTransfer-Regional-Bytes). Every other region gets its short code prepended instead. Not universal, though: some services (Elastic Load Balancing, Transit Gateway, Public IPv4) prefix us-east-1 explicitly as USE1- too, so check which service a code belongs to before assuming.
USE1 / USE2us-east-1 (N. Virginia) / us-east-2 (Ohio)
USW1 / USW2us-west-1 (N. California) / us-west-2 (Oregon)
EU / EUW2 / EUW3eu-west-1 (Ireland, note the bare "EU", no trailing "1") / eu-west-2 (London) / eu-west-3 (Paris)
EUC1 / EUN1eu-central-1 (Frankfurt) / eu-north-1 (Stockholm)
APN1 / APN2 / APN3ap-northeast-1 (Tokyo) / ap-northeast-2 (Seoul) / ap-northeast-3 (Osaka)
APS1 / APS2 / APS3ap-southeast-1 (Singapore) / ap-southeast-2 (Sydney) / ap-south-1 (Mumbai)
USE1-USW2- (a paired prefix)An inter-region transfer between the two named regions: the first is the source, the second is the destination. Only the source region's outbound leg is billed; the destination's inbound leg is $0.
-AWS-Out-Bytes / -AWS-In-BytesOutbound (billed) vs. inbound (free) data transfer between AWS regions, or between AWS and the public internet.
:instanceType suffixThe specific instance type or size a charge applies to, e.g. BoxUsage:m5.large. One line per distinct type in use.
Worked example
USE1-USW2-AWS-Out-BytesUSE1 — the source region: us-east-1USW2 — the destination region: us-west-2AWS — the transfer stayed inside AWS's network, not the public internetOut — this is the outbound, billed leg, from the source region's sideBytes — metered per byte (GB), not per hour or per requestThis exact line only appears on the us-east-1 side of the transfer. The us-west-2 side shows the free companion line, USW2-USE1-AWS-In-Bytes, for the same traffic.
The single biggest mystery bucket on most bills: internet egress, cross-AZ, NAT gateways, and the region-code grammar behind all of it.
DataTransfer-Out-BytesAmazon EC2You are being charged per gigabyte for data leaving an AWS region to the public internet.
$0.09 per GB (first 10 TB/month tier) — us-east-1, applies after the AWS-wide free tier; as of 2026-07
USE1-USW2-AWS-Out-BytesAmazon EC2You are being charged for data sent from one AWS region (here, us-east-1) to a different AWS region (here, us-west-2).
DataTransfer-Regional-BytesAmazon EC2You are being charged for data moving between Availability Zones within the same AWS region. It's billed on both the sending and the receiving side.
$0.01 per GB, in each direction — us-east-1; billed as two separate $0.01/GB charges (in + out) for each transfer; as of 2026-07
NatGateway-BytesAmazon VPCYou are being charged per gigabyte for every byte that passes through your NAT gateway, on top of its flat hourly uptime charge and on top of any standard data-transfer charge the traffic would incur anyway.
$0.045 per GB processed — us-east-1; separate from the flat $0.045/hour NAT gateway uptime charge and from any standard data-transfer charge on the same bytes; as of 2026-07
PublicIPv4:InUseAddressAmazon VPCYou are being charged hourly for every public IPv4 address you hold, whether it's actively attached and serving traffic, or allocated but unattached and idle.
$0.005 per hour per address — us-east-1 (uniform across commercial AWS regions); identical whether the address is in-use or idle; as of 2026-07
VpcEndpoint-BytesAmazon VPCYou are being charged an hourly fee per endpoint per Availability Zone, plus a per-gigabyte fee for data processed through an interface VPC endpoint (AWS PrivateLink).
TransitGateway-BytesAWS Transit GatewayYou are being charged an hourly fee for each attachment (VPC, VPN, Direct Connect, peering) connected to your Transit Gateway, plus a per-gigabyte fee for data processed through it.
LoadBalancerUsageElastic Load BalancingYou are being charged an hourly rate for each load balancer provisioned, plus a rate per Load Balancer Capacity Unit (LCU) consumed. LCUs are driven by whichever dimension (new connections, active connections, processed bytes, or rule evaluations) is highest that hour, not by a simple sum.
US-DataTransfer-Out-BytesAmazon CloudFrontYou are being charged per gigabyte for content CloudFront serves from its edge locations to end users, plus a per-10,000-requests charge, with rates varying by the edge-location group (US, EU, AP, and so on) that served the request.
EC2, Fargate, EKS, and Lambda: what you pay for per hour, per GB, and per invocation.
BoxUsage:m5.largeAmazon EC2The hourly running time of an On-Demand EC2 instance of the given type, in the given region. This is the base compute rate before other EC2 charges (storage, data transfer) are added.
SpotUsage:m5.largeAmazon EC2The hourly running time of an EC2 Spot Instance of the given type, billed at the fluctuating Spot market price instead of the fixed On-Demand rate.
HeavyUsage:m5.largeAmazon EC2The recurring charge for a Reserved Instance you've already committed to. It's billed whether or not a matching instance is running that hour.
UnusedBox:m5.largeAmazon EC2The instance-hours of an On-Demand Capacity Reservation that were held open but never had an instance launched into them. These bill at the full On-Demand rate for empty, reserved slots.
DedicatedUsage:m5.largeAmazon EC2The hourly running cost of an EC2 instance launched with dedicated tenancy, single-tenant physical hardware billed at a premium over the same instance type's shared-tenancy rate, plus a flat per-region hourly fee if any dedicated instance runs in that region.
Fargate-vCPU-Hours:perCPUAWS FargateThe vCPU-hours and the companion memory GB-hours requested by your container tasks, billed per second from task start to stop. It's metered by resource request, not by underlying node.
AmazonEKS-Hours:perClusterAmazon EKSA flat hourly fee charged per EKS cluster for the managed Kubernetes control plane, independent of how many nodes or pods run underneath it.
Lambda-GB-SecondAWS LambdaThe memory-allocated × duration charge for Lambda execution, metered in GB-seconds from invocation (including cold start) to return; the x86 line and the separate, cheaper Graviton/ARM line (Lambda-GB-Second-ARM) tier and bill independently.
EBS volumes and snapshots, S3's storage classes and request tiers, and the early-delete penalty nobody reads the fine print on.
EBS:VolumeUsage.gp2Amazon EBSBilling for the provisioned capacity (GB-month) of General Purpose SSD EBS volumes: gp2 or its newer, usually cheaper sibling gp3.
EBS:VolumeP-IOPS.piopsAmazon EBSA separate per-IOPS-month charge for the performance you provisioned on io1/io2 volumes, billed apart from the volume's GB-month storage charge.
EBS:SnapshotUsageAmazon EBSGB-month charge for EBS snapshots in the Standard tier, billed incrementally on the changed blocks each snapshot stores.
TimedStorage-ByteHrsAmazon S3The core "you store data, you pay for it" charge: GB-months of object data and metadata held in S3 Standard storage, billed hourly and averaged over the month.
TimedStorage-SIA-ByteHrsAmazon S3GB-month storage charge for objects held in the S3 Standard-IA class. It's cheaper per-GB than Standard, but with per-GB retrieval fees and a 30-day minimum storage duration per object.
TimedStorage-GlacierByteHrsAmazon S3GB-month storage charge for archived objects held in the S3 Glacier Flexible Retrieval class, AWS's low-cost long-term archive tier.
Requests-Tier1Amazon S3Per-request API charges, billed per thousand requests: Tier1 covers PUT, COPY, POST, and LIST calls; a separate Tier2 line covers GET and most other read requests.
EarlyDelete-ByteHrsAmazon S3A prorated penalty charged when an object archived to S3 Glacier Flexible Retrieval is deleted, overwritten, or transitioned before its 90-day minimum storage commitment ends (parallel early-delete charges exist for the Instant Retrieval and Deep Archive classes).
RDS, Aurora, DynamoDB, and ElastiCache: instance hours, storage I/O, and the Multi-AZ charge that doubles a bill.
InstanceUsage:db.m5.largeAmazon RDSThe hourly on-demand compute charge for a single-AZ RDS database instance of a given class, billed from launch until the instance is stopped or deleted.
Multi-AZUsage:db.m5.largeAmazon RDSThe hourly compute charge for a Multi-AZ RDS deployment, which bills for both the primary instance and its synchronous standby replica in another Availability Zone.
RDS:GP3-StorageAmazon RDSThe per-GB-month charge for General Purpose SSD (gp3) storage provisioned on a single-AZ RDS instance, separate from the instance-hour and IOPS/throughput charges.
RDS:ChargedBackupUsageAmazon RDSThe per-GB-month charge for RDS automated backups and manual snapshots once their combined size exceeds the free allotment (up to 100% of total provisioned database storage).
Aurora:ServerlessV2UsageAmazon AuroraThe per-second (billed hourly) charge for Aurora Capacity Units (ACUs) consumed by an Aurora Serverless v2 instance, where each ACU is roughly 2 GiB of memory plus corresponding CPU and networking.
Aurora:StorageIOUsageAmazon AuroraThe per-operation charge for read and write I/O requests against Aurora's distributed storage layer, under the default storage configuration.
WriteCapacityUnit-HrsAmazon DynamoDBThe hourly charge for provisioned write capacity units reserved on a DynamoDB table, billed whether or not the capacity is consumed.
NodeUsage:cache.m5.largeAmazon ElastiCacheThe hourly on-demand charge per provisioned ElastiCache node of a given instance class, billed from launch until the node is terminated (partial hours round up to a full hour).
CloudWatch, Config, and CloudTrail: the tools you turned on to control cost that can themselves become a line item.
DataProcessing-BytesAmazonCloudWatchCharges for every byte of log data your applications, agents, or functions push into CloudWatch Logs.
$0.50 per GB ingested (Standard log class) — us-east-1, as of 2026-07
VendedLog-BytesAmazonCloudWatchThe per-GB charge for logs that other AWS services generate and deliver into CloudWatch Logs on your behalf (VPC flow logs, DNS query logs, CDN logs, WAF logs), billed separately from logs your own code writes.
CW:MetricMonitorUsageAmazonCloudWatchThe per-metric-per-month charge for every unique custom metric (and dimension combination) published to CloudWatch, whether from your own application, embedded metric format logs, or detailed instance monitoring.
$0.30 per metric per month (first 10,000 custom metrics) — us-east-1, as of 2026-07
CW:AlarmMonitorUsageAmazonCloudWatchThe per-alarm hourly charge (prorated to per-month) for every standard-resolution metric alarm that exists in your account, whether or not it has ever fired.
CW:RequestsAmazonCloudWatchThe per-1,000-request charge for CloudWatch API calls beyond the free tier (most visibly reads of metric data), billed once you exceed the free allotment.
ConfigurationItemRecordedAWS ConfigThe per-item charge AWS Config bills every time it detects and records a change to a tracked resource's configuration. It's metered by how often your infrastructure changes, not a flat monthly fee.
PaidEventsRecordedAWS CloudTrailA per-100,000-events charge for CloudTrail data events (fine-grained, resource-level API activity such as object reads or function invocations) once data-event logging is turned on for a trail; management events are logged free by default.
KMS, Secrets Manager, and GuardDuty: small per-unit charges that add up fast at scale.
KMS-KeysAWS Key Management ServiceA flat monthly charge (prorated hourly) for every customer-managed key you've created in KMS, whether or not it's ever used to encrypt anything.
KMS-RequestsAWS Key Management ServiceBilling for KMS API calls (encrypt, decrypt, generate-data-key, and similar) once you exceed the monthly free-tier request allotment.
AWSSecretsManager-SecretsAWS Secrets ManagerA flat monthly charge (prorated hourly) for every secret stored in Secrets Manager, including each cross-region replica, regardless of how often it's used.
AWSSecretsManagerAPIRequestAWS Secrets ManagerBilling for API calls to Secrets Manager (retrieving, describing, writing, and listing secrets) at a small per-10,000-requests rate; every operation counts, not just retrievals.
PaidEventsAnalyzed-BytesAmazon GuardDutyGuardDuty's charge for the volume (in GB) of network flow and DNS query log data it analyzes each month, billed on a tiered per-GB schedule after any free-trial allowance.
Bedrock tokens and SageMaker instance-hours, plus the AI spend that never touches an AWS bill at all.
USE1-Claude4.6Sonnet-input-tokensAmazon BedrockEvery token sent into a Bedrock model as part of the prompt (system instructions, chat history, retrieved context, few-shot examples) is metered and billed separately per model, distinct from output tokens.
USE1-Claude4.6Sonnet-output-tokensAmazon BedrockTokens the model generates in its response are billed as a separate line item from input tokens, usually at a materially higher per-token rate.
USE1-Claude4.6Sonnet-cache-read-input-token-countAmazon BedrockTokens served from Bedrock's prompt cache (instead of being reprocessed as full input) appear as their own usage type, billed at a steep discount versus a normal input token.
USE1-Host:ml.g5.xlargeAmazon SageMakerBilled for every hour a SageMaker real-time inference endpoint's instance is running, regardless of whether it's actively serving prediction traffic.
USE1-Notebk:ml.g4dn.8xlargeAmazon SageMakerBilled for every hour a classic SageMaker notebook instance sits in an active state, independent of whether anyone is actively working in it.
AI spend that never touches an AWS bill is easy to miss entirely: a direct Anthropic API subscription, an OpenAI API key billed straight to a corporate card, or a third-party AI vendor invoice appears nowhere in Cost Explorer or a Cost and Usage Report, no matter how closely you watch every line item above. A team can be disciplined about every Bedrock token and still get blindsided by spend building up entirely outside AWS. That's why AI cost visibility has to span every model provider a team uses, not just the one that happens to bill through the AWS account. See LLM API pricing, the AI agent cost guide, and AI/LLM cost monitoring.
No line items match that filter — try a different word, or search everything on CostMon instead.
FAQ
In the AWS Cost Explorer console, set "Group by" to Usage type instead of just Service. That's the field this page decodes. For row-by-row detail beyond what Cost Explorer's UI shows, turn on a Cost and Usage Report (CUR) and look at the lineItem/UsageType column; it's the identical string.
Usage types are region-scoped: a code with no region prefix generally represents us-east-1 for the classic data-transfer family, while every other region gets its short code (USE2, USW2, EUC1, APS1, and so on) prepended. Some services (Elastic Load Balancing, Transit Gateway, Public IPv4) prefix us-east-1 explicitly too, so the "no prefix = us-east-1" rule isn't universal across every service.
Usage type is the billing meter: the dimension AWS charges you on, like NatGateway-Bytes or BoxUsage:m5.large. Operation (lineItem/Operation in a CUR) is the specific API call that triggered it, like RunInstances or GetObject. Several different operations can roll up into the same usage type, and the same usage type can be triggered by more than one operation, which is why filtering by usage type alone sometimes isn't specific enough to find the root cause.
A NAT gateway bills three separate ways: a flat hourly uptime charge, a per-GB data-processing charge for every byte that passes through it, and then whatever standard data-transfer charge that traffic would have incurred anyway. Traffic that could instead reach an AWS service through a VPC endpoint (which has no per-GB processing fee for gateway endpoints) is the most common avoidable driver.
Generally yes: data transfer from the public internet into an AWS region, and the inbound leg of a transfer between two AWS regions, is priced at $0. Only the sending side (internet egress out of a region, or the outbound leg of an inter-region transfer) carries a charge. Cross-AZ (regional) transfer is the one common exception, billed on both the sending and receiving side.
AWS began charging for every public IPv4 address on February 1, 2024, not just "extra" or idle Elastic IPs, as before. An unattached Elastic IP left over from a decommissioned instance now bills at the same hourly rate as one that's actively serving traffic, so idle allocations are pure waste and worth releasing.
That's the point of it. CostMon pulls these same usage-type-level records automatically, normalizes them alongside your other cloud and AI spend, and alerts you before a spike like an unattached Elastic IP or a runaway CloudWatch Logs group turns into a surprise on the invoice. That means you don't have to reverse-engineer usage types by hand every month.
Reading one export line by line takes real work. CostMon reads the next one for you, every day, for every provider you connect.