Amazon SOA-C02: Cost Management and Resource Tagging — Study Guide

By Laurynas Brazys · 2 August 2026 · #amazon #soa-c02 #certification #exam-prep #study-guide

Part of the AWS SysOps Administrator Associate SOA-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.

Cost management and resource tagging are core operational activities that keep cloud spending visible, predictable, and governed. Accurate billing and reporting let operators attribute costs to teams, projects, and environments; tagging plus enforced policies enable automated chargeback and cleanup. Active use of Cost Explorer, Cost and Usage Reports, Budgets, and optimization tools limits waste and informs commitment decisions such as Savings Plans or Reserved Instances. Understanding service-specific drivers (network, storage, load balancers, NAT) prevents surprise egress and managed-service fees.

Billing, cost reports, and cost explorer basics

Enable consolidated billing through AWS Organizations and deliver the Cost and Usage Report (CUR) to an S3 bucket with hourly granularity and resource IDs to support detailed attribution. In the Billing console enable cost allocation tags (both AWS-generated and user-defined) so Cost Explorer and CUR include tag columns. For programmatic access use the Cost Explorer API or CLI: for example, aws ce get-cost-and-usage –time-period Start=2026-01-01,End=2026-01-31 –granularity MONTHLY –metrics “UnblendedCost” –group-by Type=DIMENSION,Key=SERVICE.

Use Cost Explorer for interactive trend analysis and rightsizing views: enable the Rightsizing Recommendations report, filter by tag or linked account, and export recommendation CSVs. For automated workflows ingest CUR into Athena (create an external table against the CUR files) to run SQL queries across dimensions (linkedAccountId, productName, usageType, resourceId, tags). Combine Athena queries with Glue crawlers to build dashboards in QuickSight or to feed billing-driven automation.

Decision criteria for choosing reporting granularity and retention:

Use hourly CUR if you need per-instance chargeback or automation based on short-lived instances.
Use daily CUR for month-to-month trend analysis when hourly noise is unnecessary.
Activate resource IDs when you want to join billing data to inventory (Tag Editor, Resource Groups) for accurate attribution.

Tagging strategies for cost allocation and governance

Adopt a disciplined tag key taxonomy (for example: CostCenter, Owner, Project, Environment, Lifecycle) and enforce it at creation. Activate those keys as Cost Allocation Tags in Billing so they appear in Cost Explorer and CUR. Implement enforcement with:

AWS Organizations Tag Policies to prescribe allowed keys and values.
AWS Config managed rule required-tags to detect missing tags.
IAM permissions or Service Control Policies to deny resource creation without required tags (use Condition keys aws:RequestTag and aws:TagKeys).

Use the Resource Groups Tagging API and Tag Editor to audit and remediate tags across regions: for example, aws resourcegroupstaggingapi get-resources –tag-filters Key=Environment,Values=dev. Automate tag propagation from CI/CD or CloudFormation by attaching stack-level tags and using lambda-based hooks to add runtime metadata (instanceId, launchTime) to resources.

Tradeoffs when choosing tag enforcement:

Strict enforcement (deny create without tags) prevents untagged drift but may block ephemeral developer workflows unless exceptions exist.
Detect-and-remediate (Config + automation) is lower friction but introduces lag between creation and correction.

Savings Plans, Reserved Instances, and rightsizing

Decide between on-demand, Savings Plans, and Reserved Instances based on predictability of compute usage and flexibility needs. Key differences:

Savings Plans: Compute Savings Plans apply across EC2, Fargate, and Lambda and offer flexibility across instance sizes/regions; EC2 Instance Savings Plans target families in a region with higher discounts but less cross-service coverage.
Reserved Instances (RIs): Standard RIs give the largest discounts for fixed instance types and can be regional or zonal; Convertible RIs allow instance-family changes but require reconfiguration.
On-demand: No commitment, highest per-hour cost, best for bursty or unknown workloads.

Use Compute Optimizer and Cost Explorer rightsizing reports to identify underutilized instances (CPU, network, EBS throughput) and overprovisioned storage. Combine CloudWatch (aws cloudwatch get-metric-statistics) metrics with Compute Optimizer recommendations to justify downsizing or instance-family changes. When usage is steady (e.g., baseline vCPU-hours for production), calculate break-even and coverage: purchase Savings Plans or RIs for predictable baseline, keep a buffer of on-demand for spiky usage.

Budgets, alerts, and forecasting

Create budgets in AWS Budgets for cost, usage, and RI/Savings Plan coverage with threshold types Actual and Forecasted. Use the console or CLI (aws budgets create-budget --account-id <id> --budget file://budget.json) and attach SNS topics, email, or Lambda action notifications. For programmatic remediation wire SNS to Lambda to tag or stop ephemeral resources or to open tickets in ITSM when forecasts cross thresholds.

Add Cost Anomaly Detection to detect sudden spend spikes and link anomalies to SNS/SQS for automated investigation workflows. Forecasting in Cost Explorer uses historical spend; combine it with business signals (start of quarter campaigns, open tickets) to set realistic budget alerts. For operational decisions:

Use forecasted thresholds to catch growing trends earlier.
Use actual thresholds to prevent overshoot near month-end.
Tie alerts to automated guardrails (stop/scale down) for noncritical accounts.

Data transfer and service-specific cost drivers

Network and storage are common, high-variance cost drivers. Understand these specifics:

Data transfer: inter-region egress is billed per GB; inter-AZ traffic can be free or charged depending on service (some services charge for cross-AZ). NAT Gateway charges include an hourly fee plus GB processed — NAT Gateway bills can dominate egress costs for high-throughput workloads.
Load balancers: ALB/NLB incur per-hour and per-GB processed charges; forwarding-heavy traffic increases costs.
S3/EBS: S3 storage pricing depends on class (Standard, Intelligent-Tiering, Glacier) and requests; lifecycle policies move objects to lower-cost tiers to reduce storage spend. EBS snapshot storage is billed per GB-month and for cross-region copy operations.
Managed services: RDS I/O, DynamoDB read/write capacity and on-demand backups, and ElasticSearch (OpenSearch Service) storage and snapshot costs.

Optimization tactics:

Use VPC endpoints for S3 to reduce internet egress and use S3 Transfer Acceleration or CloudFront to reduce origin egress when serving global users.
Consolidate cross-region traffic or co-locate services to the same region to avoid inter-region egress.
Replace NAT Gateways with VPC endpoints, Gateway Load Balancers, or NAT instances when appropriate and after testing performance trade-offs.

Common Pitfalls and Decision Criteria

Leaving resources untagged and unaccounted for: enforce required-tags with AWS Config and use Resource Groups Tagging API to find and remediate untagged resources automatically.
Misunderstanding Savings Plan/RI scope: confirm whether Compute Savings Plans (cross-service) or EC2 Instance Savings Plans / RIs (family/zone scope) map to your workloads before committing.
Relying only on CPU for rightsizing: include memory, network, and disk IOPS metrics (CloudWatch and Compute Optimizer) to avoid performance regressions after downsizing.
Ignoring data transfer costs between regions/services: map traffic flows, measure egress via VPC Flow Logs/Athena, and co-locate heavy producers/consumers or use CloudFront/VPC endpoints.
Budget misconfiguration: choose Actual vs Forecasted appropriately and attach programmatic actions (SNS → Lambda) to throttle or notify early.
Leaving orphaned storage/snapshots and idle ELBs: schedule automated cleanup for unattached EBS volumes, outdated snapshots, and unused load balancers.

Practical Problem: Use-Case Scenario

ApexAnalytics experiences a 40% month-over-month cost spike after a marketing campaign; engineers spun up many dev stacks across regions and relied on NAT Gateways for internet access. The finance team needs immediate visibility and remediation.

Turn on hourly CUR with resource IDs and deliver to a dedicated S3 cost-bucket; create an Athena table to query top cost drivers by linkedAccountId, region, and usageType.
Activate and enforce Cost Allocation Tags (CostCenter, Project, Owner) via Tag Policies and AWS Config required-tags, and backfill missing tags using Resource Groups Tagging API.
Run Cost Explorer rightsizing and Compute Optimizer reports, identify steady baseline compute, and purchase an appropriate Savings Plan for baseline hours; schedule downsizing for underutilized instances.
Audit network egress with VPC Flow Logs → Athena; replace NAT Gateways with VPC endpoints where possible and centralize regional test workloads to avoid inter-region transfers.
Create AWS Budgets with forecasted thresholds, attach SNS to trigger Lambda to quarantine noncritical dev accounts or notify owners, and enable Cost Anomaly Detection for sudden spikes.

Rationale: Delivering CUR and enforcing tags establishes precise chargeback and historical analysis. Rightsizing and measured commitments (Savings Plans) reduce predictable spend while network optimizations and automated budget actions prevent future surprise egress costs.

← Serverless and Application Integration · All domains

Practice these questions → · Timed practice on ExamRoll.io →