Capstone: estimate, build, tag and trace the cost of a small project

Steps

1. Open AWS CloudShell. Confirm your identity and the Region, and count the budgets before you start:

aws sts get-caller-identity --query Arn --output text
echo $AWS_REGION
aws budgets describe-budgets --account-id 111122223333 --query 'length(Budgets)'

The ARN should contain assumed-role/AWSReservedSSO_ or :user/. If it ends in :root, sign out now: this lab must not run as the root user. Write down the number of budgets. It must be the same at the end. 2. Estimate first. Open the AWS Pricing Calculator at calculator.aws and start a new estimate named clf-lab24. Add Amazon S3 with 1 GB of S3 Standard storage and a few thousand requests, Amazon DynamoDB in on-demand mode with 1 GB of storage and a few thousand reads and writes, and Amazon SNS with a few thousand notifications, all in the Region CloudShell printed. Write down the monthly total and which service makes up most of it. Leave the estimate unsaved and unshared: a shared estimate link can be opened by anyone who has it. 3. Write the template. It describes the three resources and nothing else. The bucket name ends in your account ID, which CloudFormation fills in, so it is globally unique, and Block Public Access is on for all four settings. Paste this into CloudShell as one block:

cat > clf-lab24.yaml <<'EOF'
AWSTemplateFormatVersion: "2010-09-09"
Description: Lesson 24 capstone, a small tagged project
Resources:
  ProjectBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "clf-lab24-data-${AWS::AccountId}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  ProjectTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: clf-lab24-orders
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: orderId
          AttributeType: S
      KeySchema:
        - AttributeName: orderId
          KeyType: HASH
  ProjectTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: clf-lab24-alerts
EOF

Check the file with cat clf-lab24.yaml and read it through before you build anything from it. 4. Build the stack, tagging it with three user-defined tags. CloudFormation passes stack tags on to every resource in the stack that supports tags:

aws cloudformation deploy --stack-name clf-lab24-capstone --template-file clf-lab24.yaml --tags Project=clf-lab24 CostCentre=training Environment=lab
aws cloudformation describe-stack-resources --stack-name clf-lab24-capstone --query 'StackResources[].[LogicalResourceId,ResourceStatus]' --output table

The deploy waits until the stack is built, usually a minute or two. The table should list three resources, each CREATE_COMPLETE. 5. Give the project a little invented data. Write a sample order to the table and a small text file to the bucket:

aws dynamodb put-item --table-name clf-lab24-orders --item '{"orderId": {"S": "sample-001"}, "note": {"S": "invented test order"}}'
echo "invented sample export for lesson 24" > sample.txt
aws s3 cp sample.txt s3://clf-lab24-data-111122223333/sample.txt

6. Read the tags back from each resource:

aws s3api get-bucket-tagging --bucket clf-lab24-data-111122223333 --output table
aws dynamodb list-tags-of-resource --resource-arn arn:aws:dynamodb:$AWS_REGION:111122223333:table/clf-lab24-orders --output table
aws sns list-tags-for-resource --resource-arn arn:aws:sns:$AWS_REGION:111122223333:clf-lab24-alerts --output table

Each resource carries Project, CostCentre and Environment, from the one --tags option. The bucket also carries tags whose keys begin aws:cloudformation:. You did not write those: AWS applied them, and like every key beginning aws: they cannot be edited. That is the difference between the tags you define and the tags AWS applies, which this lesson describes. 7. Follow the tags into billing. In Billing and Cost Management, open Cost allocation tags and search the User-defined cost allocation tags tab for Project. AWS says a new tag key can take up to 24 hours to appear here, so it will probably be missing. Then open Cost Explorer, open the Group by list and pick Tag: Project is not offered, because only activated tags are. This is the lesson's key point. Your resources are tagged, but no cost can be split by Project until the tag is activated, and costs from before that point carry it only if you request a backfill. Leave the tag inactive; the Notes explain why. Finally open Data Exports and read where a Cost and Usage Report would be delivered to an S3 bucket, with activated tags as columns. 8. Compare the estimate with reality. In Cost Explorer, group by Service for this month. Your three resources have existed for minutes and Cost Explorer refreshes about once a day, so they add nothing visible yet; the Pricing Calculator figure was for a whole month of the usage you typed in. If your account is a management account, group by Linked account to see how consolidated billing still shows each account's share. Then open Budgets and read lesson 1's budget: this is the alert that would catch the project if it started to cost money. Change nothing in it.