Spend Movers Guide
Spend movers highlight period-over-period changes in AWS spend, grouped by service and region. They are powered by Cost Explorer aggregates (no line-item data).
What you’re seeing
- Total change: the overall delta between the current and previous windows.
- Top increases/decreases: the biggest movers by service and region.
- New spend: a service/region that had zero in the previous window.
- Stopped spend: a service/region that dropped to zero in the current window.
How to interpret movers
- Start with the largest increases and confirm whether they are expected changes (deploys, traffic spikes, feature launches, backups).
- Investigate new spend entries for accidental enablement or new services.
- Validate decreases to ensure they align with a planned shutdown or optimization.
- Use the findings list to connect spikes to specific resources (e.g., NAT gateways, idle ELBs, overprovisioned RDS).
Common root causes
- New workloads or environments (preview/staging/DR).
- Traffic spikes (marketing campaigns, incident load).
- Service configuration changes (log retention, backup cadence).
- One-off activities (data migrations, large exports/imports).
Privacy & data scope
Spend movers use Cost Explorer aggregate totals only and never pull line-item billing data. Output is a small table of deltas by service and region.
Next steps
- Confirm Cost Explorer is enabled in your IAM policy.
- Review top mover rows in the HTML report.
- Re-run the audit after remediation to verify the delta shrinks.