How to Audit Your AWS Bill in 60 Seconds (CSV Walkthrough · Feb 2026)

Almost every AWS account we audit hides 25–40% waste. The good news: you don't need access to anyone's console, no IAM keys, no read-only role — just the billing CSV that AWS already generates every day.

This is the exact 60-second audit we run before any customer call.

Step 1 — Get the CSV (90 seconds)

In the AWS Console:

1. Go to Billing & Cost Management → Bills
2. Pick the most recent closed month
3. Click Download CSV (top right of the Charges by service card)

You'll get a file like bill-2026-01.csv. That's the only input you need.

💡 If you want the full Cost & Usage Report (line-item granularity), enable CUR 2.0 once and have it land in S3 every night. The basic monthly CSV is fine for a first audit.

Step 2 — The 5 columns that matter

Open the CSV in any spreadsheet. Look at exactly these:

Column	What it tells you
product/ProductName	Which AWS service the line came from
lineItem/UsageType	The specific SKU (e.g. USE1-BoxUsage:m5.large)
lineItem/UsageAmount	How much you used
lineItem/UnblendedCost	What you paid
product/region	Where the spend happened

Sort descending by UnblendedCost. The top 20 rows are usually 80% of your bill.

Step 3 — The 5 patterns we look for first

1. Idle EC2 (the easiest $5K/month)

Search for rows where UsageType contains BoxUsage: and the cost is significant but you don't recognize the instance. Cross-reference with CloudWatch CPU average. Anything <15% CPU average for 30 days is a candidate to right-size. Median savings: ~50–70% per instance.

2. NAT Gateway data transfer (the silent killer)

UsageType like USE1-NatGateway-Bytes. At $0.045/GB processed, a single chatty VPC can burn $2–10K/month. The fix is almost always a VPC Gateway Endpoint for S3 — free, takes 11 minutes, kills the line item.

3. EBS volumes attached to nothing

UsageType like USE1-EBS:VolumeUsage.gp3. Look at the cost vs your active EC2 row count. If EBS spend is >35% of EC2 spend, you almost certainly have orphan volumes from terminated instances. We see 100–800 GB of orphan EBS on most accounts.

4. CloudWatch Logs ingestion (everyone gets this wrong)

UsageType like USE1-DataProcessing-Bytes under product AmazonCloudWatch. At $0.50/GB ingested, an unbounded INFO-level log can rack up $4K/month. The fix is a 1-line filter pattern.

5. S3 egress (the $0.09/GB tax)

UsageType like DataTransfer-Out-Bytes under product AmazonS3. If this is >5% of your S3 cost, you're paying full egress without CloudFront. Adding a distribution typically cuts this 30–80%.

Step 4 — Pivot the CSV in 30 seconds

In any spreadsheet, build a quick pivot:

• Rows: product/ProductName
• Columns: product/region
• Values: lineItem/UnblendedCost (sum)

You'll instantly see:

• Spend per service — anything in your top 5 you don't recognize?
• Cross-region spend — is anything running in a region you've never deployed to? (Common cause: forgotten dev account, or a CDN test you never tore down.)

Step 5 — Write down the dollar amount, the line item, and the fix

For each of the 5 patterns above, the audit deliverable is a 3-column note:

Pattern	$/month	Fix
Idle EC2 i-09…	$840	Right-size to t3.large
NAT egress to S3	$1,420	VPC Gateway Endpoint
Orphan EBS volumes	$190	Delete (3)
CloudWatch Logs from payments-svc	$660	Filter pattern
S3 → internet	$980	CloudFront on assets/*

Total found in 60 seconds: $4,090/month — $49K/year. That's a typical result.

Step 6 — Now do the same with the free CARTIE auditor

Doing this manually is a great first pass. Doing it every month is a job.

CARTIE's free AWS bill audit eats your CSV, ranks the top 5 leaks by $/month automatically, gives you the SQL/CLI command to verify each, and shows the dollar fix. No signup, no credentials, no retention — the CSV is processed in-memory and never stored.

Drop your CSV. Get an audit before the page finishes scrolling.

---

Liked this? See the Anatomy of a $100K AWS Bill — a line-by-line walkthrough of a real invoice.