> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Linking AWS Cost Explorer as a source

Canonical URL: https://posthog.com/docs/data-pipelines/sources/aws-cost-explorer

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://us.posthog.com` or `https://app.posthog.com` (app host for links).

## On this page

- [Prerequisites](#prerequisites)
- [Adding a data source](#adding-a-data-source)
- [Creating IAM credentials](#creating-iam-credentials)
- [Sync modes](#sync-modes)
- [Configuration](#configuration)
- [Supported tables](#supported-tables)
- [Troubleshooting](#troubleshooting)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d)

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

`npx @posthog/wizard warehouse`

![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)

![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you

The AWS Cost Explorer connector syncs your AWS cost and usage data into PostHog, so you can analyze cloud spend alongside your product data.

## Prerequisites

You need an AWS account with Cost Explorer enabled. Cost Explorer can take up to 24 hours to prepare data after it is first enabled.

You also need an IAM user or role with the following permissions:

-   `ce:GetCostAndUsage`
-   `ce:GetCostAndUsageWithResources`
-   `ce:GetDimensionValues`
-   `ce:GetReservationUtilization`
-   `ce:GetReservationCoverage`
-   `ce:GetSavingsPlansUtilization`
-   `ce:GetSavingsPlansCoverage`

The existing tables work without the four new permissions. Add them only if you want the new tables.

To see spend across every member account, connect the management (payer) account.

## Adding a data source

1.  In PostHog, go to the [Sources tab](https://app.posthog.com/data-management/sources) of the data pipeline section.
2.  Click **\+ New source** and click **Link** next to this source.
3.  Enter your credentials (see [Configuration](#configuration) below) and click **Next**.
4.  Select the tables you want to sync, choose a sync method and frequency, then click **Import**.

Once the syncs are complete, you can start querying this data in PostHog.

When linking AWS Cost Explorer, you'll need:

-   **AWS access key ID** – the access key ID for your IAM user or role (starts with `AKIA...`).
-   **AWS secret access key** – the corresponding secret access key.
-   **AWS session token** (optional) – only required if you are using temporary STS credentials.
-   **Start date** (optional) – the earliest date to sync from, in `YYYY-MM-DD` format. Defaults to 12 months ago.

## Creating IAM credentials

1.  In the AWS Console, go to **IAM** > **Users** and create a new user (or use an existing one).
2.  Attach a policy with the following permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources",
        "ce:GetDimensionValues",
        "ce:GetReservationUtilization",
        "ce:GetReservationCoverage",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansCoverage"
      ],
      "Resource": "*"
    }
  ]
}
```

3.  Create an access key for the user under **Security credentials** > **Access keys**.
4.  Copy the **Access key ID** and **Secret access key** – you'll need both when linking the source in PostHog.

> **Note:** AWS charges $0.01 per Cost Explorer API request. PostHog uses wide date windows per request to keep costs low.

## Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

-   **Webhook** (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
-   **Incremental** – only new or updated rows are synced on each run, using a cursor field (such as an `updated_at` timestamp). Cheaper than a full refresh, but deletes aren't captured.
-   **Append only** – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
-   **Full refresh** – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See [sync methods](https://posthog.com/docs/data-pipelines/sources.md#sync-methods) for a full explanation of how each mode works and how to choose between them.

Most tables support incremental sync using `period_start` as the cursor. The `dimension_values` table is full refresh only.

AWS restates recent cost periods until bills finalize (rows come back marked as estimated). To capture these corrections, incremental syncs automatically re-read a trailing window behind the last synced value:

| Table | Lookback window | Notes |
| --- | --- | --- |
| `cost_and_usage_daily` | 7 days |  |
| `cost_and_usage_monthly` | 45 days |  |
| `cost_and_usage_with_resources_daily` | 7 days | Only covers last 14 days. Requires resource-level data enabled in Cost Explorer settings. |
| `dimension_values` | – | Full refresh only (no incremental sync). |
| `reservation_utilization_daily` | 7 days |  |
| `reservation_coverage_daily` | 7 days | Covers EC2, RDS, ElastiCache, and Redshift. |
| `savings_plans_utilization_daily` | 7 days |  |
| `savings_plans_coverage_daily` | 7 days |  |

Duplicate rows are merged by primary key, so re-read periods don't create duplicates.

## Configuration

| Option | Type | Required |
| --- | --- | --- |
| `AWS access key ID` | text | Yes |
| `AWS secret access key` | password | Yes |
| `AWS session token (only for temporary credentials)` | password | No |
| `Start date (defaults to 12 months ago)` | text | No |

## Supported tables

| Table | Description | Sync method | Incremental field | Primary key |
| --- | --- | --- | --- | --- |
| `cost_and_usage_daily` | Daily cost and usage metrics grouped by AWS service and linked account. | Incremental, Full refresh | period\_start | — |
| `cost_and_usage_monthly` | Monthly cost and usage metrics grouped by AWS service and linked account. | Incremental, Full refresh | period\_start | — |
| `reservation_utilization_daily` | Daily Reserved Instance utilization and savings totals. | Incremental, Full refresh | period\_start | — |
| `savings_plans_utilization_daily` | Daily Savings Plans commitment utilization and net savings. | Incremental, Full refresh | period\_start | — |
| `dimension_values` | Linked accounts, services and regions seen in the synced range, with linked account names. | Full refresh | — | — |
| `cost_and_usage_with_resources_daily` | Daily cost and usage per resource for the last 14 days. Requires resource-level data to be enabled in Cost Explorer settings. | Incremental, Full refresh | period\_start | — |
| `reservation_coverage_daily` | Daily share of eligible EC2, RDS, ElastiCache and Redshift usage covered by reservations. | Incremental, Full refresh | period\_start | — |
| `savings_plans_coverage_daily` | Daily share of eligible spend covered by Savings Plans, and the remaining On-Demand cost. | Incremental, Full refresh | period\_start | — |

## Troubleshooting

-   If you see "AWS rejected the access key", check that the access key ID and secret access key are correct and that the key is still active in IAM.
-   If you see a signature error, re-enter the secret access key. If you are using temporary credentials, the session token may have expired.
-   If you see "missing Cost Explorer permissions", grant `ce:GetCostAndUsage`, `ce:GetCostAndUsageWithResources`, `ce:GetDimensionValues`, `ce:GetReservationUtilization`, `ce:GetReservationCoverage`, `ce:GetSavingsPlansUtilization`, and `ce:GetSavingsPlansCoverage` to the IAM user or role.
-   If you see "no Cost Explorer data", make sure Cost Explorer is enabled on the AWS account. It can take up to 24 hours after enabling for data to appear.
-   If you see "dates are older than the data AWS keeps", move the start date forward and try again.
-   If the `cost_and_usage_with_resources_daily` table has no data, enable resource-level data in your AWS Cost Explorer settings. Go to **AWS Console** > **Cost Explorer** > **Settings** > **Cost Explorer Settings** and turn on resource-level data for EC2, Lambda, and any other services you want to track.
-   If the start date is older than 14 days for the resource table, the sync automatically clamps it to 14 days ago. AWS does not serve resource-level data beyond this window.

If your sync is failing or data looks wrong, see the [Data warehouse troubleshooting guide](https://posthog.com/docs/data-warehouse/troubleshooting.md). If that doesn't help, [contact support](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) – we're happy to help.