elastic · gpop63 · Jun 26, 2025 · Jun 26, 2025 · Jun 26, 2025 · Jun 27, 2025
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -485,3 +485,4 @@
 /packages/cisco_meraki_metrics @elastic/obs-infraobs-integrations
 /packages/panw_metrics @elastic/obs-infraobs-integrations
 /packages/o365_metrics @elastic/obs-infraobs-integrations 
+/packages/aws_billing @elastic/obs-infraobs-integrations 
@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.
@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: [email protected]
@@ -0,0 +1,96 @@
+# AWS CUR 2.0 Billing
+
+## Overview
+
+[Amazon Cost and Usage Reports (CUR)](https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html) provide the most detailed information available about your AWS costs and usage. CUR 2.0 enhances this reporting format with greater structure and compatibility for analytics.
+
+The **AWS CUR 2.0 Billing integration** allows you to seamlessly collect and ingest Cost and Usage Report (CUR) version 2.0 data exported to an Amazon S3 bucket, using the Elastic Agent. This enables you to monitor, analyze, and visualize AWS billing data with the power of the Elastic Stack.
+
+This integration is designed specifically to support standard CUR 2.0 exports with predefined configuration requirements.
+
+> **IMPORTANT:** The integration currently supports only CUR 2.0 reports **without** resource IDs and **split cost allocation data**, and requires a very specific configuration of the CUR export.
+
+## Compatibility
+
+This integration supports CUR 2.0 reports only with the specified configurations. If your report includes resource IDs or split allocation data, the integration **will not work**.
+
+## Data Streams
+
+This integration collects data into a single stream:
+
+* `billing`: Contains all metrics from your CUR 2.0 billing reports.
+
+## Requirements
+
+You need Elasticsearch for storing and searching your data and Kibana for
+visualizing and managing it. You can use our hosted Elasticsearch Service on
+Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your
+own hardware.
+
+Before using any AWS integration you will need:
+
+* **AWS Credentials** to connect with your AWS account.
+* **AWS Permissions** to make sure the user you're using to connect has permission to share the relevant data.
+
+For more details about these requirements, please take a look at the [AWS integration documentation](https://docs.elastic.co/integrations/aws#requirements).
+
+To collect AWS CUR reports, you would need specific AWS permissions to access the necessary data. Here's a list of permissions required for an IAM user to collect AWS CUR metrics:
+
+- `s3:GetObject`
+- `s3:ListBucket`
+
+### AWS Cost and Usage Report (CUR) Export
+
+To use this integration, you must first create a **standard CUR 2.0 data export** in AWS. This will automatically create an S3 bucket if one does not already exist.
+
+#### Required CUR Export Configuration
+
+When creating your CUR export, the following **configuration is required** for compatibility:
+
+* **Compression type and file format**: `gzip - text/csv`
+* **File versioning**: `Overwrite existing data export file`
+* **Additional export content**:
+
+  * **Include resource IDs**: ❌ Disabled
+  * **Split cost allocation data**: ❌ Disabled
+  * **Include all available columns (113 total)**: ✅ Default
+* **S3 bucket**: Must exist and be accessible by the Elastic Agent.
+
+You can follow AWS documentation for setup:
+🔗 [Creating Cost and Usage Reports in AWS](https://docs.aws.amazon.com/cur/latest/userguide/cur-create.html)
+
+#### S3 Bucket Configuration
+
+* Ensure the **S3 bucket used for the CUR export is accessible** via the credentials provided to the Elastic Agent.
+* The integration requires **ListBucket** permission on the bucket.
+
+### Minimum Bucket Polling Interval: **24 Hours**
+
+CUR 2.0 reports are cumulative, meaning they are overwritten daily with the full billing data. Therefore, **setting the bucket polling interval to less than 24 hours will result in duplicate ingestion** of the same data.
+
+> ✅ **REQUIRED:** Set the **S3 polling interval** to **at least 24 hours** to avoid duplicating report ingestion.
+
+Learn more:
+🔗 [Understanding CUR Overwrite Behavior](https://docs.aws.amazon.com/cur/latest/userguide/what-is-data-exports.html)
+
+### Elastic Agent
+
+* You must install and configure [Elastic Agent](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html) to collect and ship data from the S3 bucket.
+* Only one Elastic Agent should be installed per host.
+
+## Setup
+
+1. In AWS, [create a CUR 2.0 export](https://docs.aws.amazon.com/cur/latest/userguide/cur-create.html) with the required settings.
+2. Ensure the report is stored in a reachable S3 bucket with proper permissions.
+3. Configure this integration in Elastic using the required AWS credentials or role.
+4. Set the S3 polling interval to **24h** (minimum).
+5. Monitor the `billing` data stream in Kibana for insights and visualizations.
+
+## Metrics
+
+### CUR Metrics
+
+AWS CUR contains all metrics from your CUR 2.0 billing reports.
+
+{{event "cur"}}
+{{fields "cur"}}
@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.1.0"
+  changes:
+    - description: Initial draft of the package
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/14318
@@ -0,0 +1,8 @@
+bill_bill_type,bill_billing_entity,bill_billing_period_end_date,bill_billing_period_start_date,bill_invoice_id,bill_invoicing_entity,bill_payer_account_id,bill_payer_account_name,cost_category,discount,discount_bundled_discount,discount_total_discount,identity_line_item_id,identity_time_interval,line_item_availability_zone,line_item_blended_cost,line_item_blended_rate,line_item_currency_code,line_item_legal_entity,line_item_line_item_description,line_item_line_item_type,line_item_net_unblended_cost,line_item_net_unblended_rate,line_item_normalization_factor,line_item_normalized_usage_amount,line_item_operation,line_item_product_code,line_item_tax_type,line_item_unblended_cost,line_item_unblended_rate,line_item_usage_account_id,line_item_usage_account_name,line_item_usage_amount,line_item_usage_end_date,line_item_usage_start_date,line_item_usage_type,pricing_currency,pricing_lease_contract_length,pricing_offering_class,pricing_public_on_demand_cost,pricing_public_on_demand_rate,pricing_purchase_option,pricing_rate_code,pricing_rate_id,pricing_term,pricing_unit,product,product_comment,product_fee_code,product_fee_description,product_from_location,product_from_location_type,product_from_region_code,product_instance_family,product_instance_type,product_instancesku,product_location,product_location_type,product_operation,product_pricing_unit,product_product_family,product_region_code,product_servicecode,product_sku,product_to_location,product_to_location_type,product_to_region_code,product_usagetype,reservation_amortized_upfront_cost_for_usage,reservation_amortized_upfront_fee_for_billing_period,reservation_availability_zone,reservation_effective_cost,reservation_end_time,reservation_modification_status,reservation_net_amortized_upfront_cost_for_usage,reservation_net_amortized_upfront_fee_for_billing_period,reservation_net_effective_cost,reservation_net_recurring_fee_for_usage,reservation_net_unused_amortized_upfront_fee_for_billing_period,reservation_net_unused_recurring_fee,reservation_net_upfront_value,reservation_normalized_units_per_reservation,reservation_number_of_reservations,reservation_recurring_fee_for_usage,reservation_reservation_a_r_n,reservation_start_time,reservation_subscription_id,reservation_total_reserved_normalized_units,reservation_total_reserved_units,reservation_units_per_reservation,reservation_unused_amortized_upfront_fee_for_billing_period,reservation_unused_normalized_unit_quantity,reservation_unused_quantity,reservation_unused_recurring_fee,reservation_upfront_value,resource_tags,savings_plan_amortized_upfront_commitment_for_billing_period,savings_plan_end_time,savings_plan_instance_type_family,savings_plan_net_amortized_upfront_commitment_for_billing_period,savings_plan_net_recurring_commitment_for_billing_period,savings_plan_net_savings_plan_effective_cost,savings_plan_offering_type,savings_plan_payment_option,savings_plan_purchase_term,savings_plan_recurring_commitment_for_billing_period,savings_plan_region,savings_plan_savings_plan_a_r_n,savings_plan_savings_plan_effective_cost,savings_plan_savings_plan_rate,savings_plan_start_time,savings_plan_total_commitment_to_date,savings_plan_used_commitment
+Bill,BillingEntity,2025-08-01T00:00:00.000Z,2025-07-01T00:00:00.000Z,,"Amazon Web Services, Inc.",123456789012,tech-innovators,"{""c"":""test"",""b"":""test"",""a"":""test""}","{""enterprise_rate"":""15%""}",,0.0,abcdef12345ghjklmnpq789xyz,2025-07-01T00:00:00Z/2025-08-01T00:00:00Z,,120.0,,USD,"Amazon Web Services, Inc.",Tax for product code EC2 usage type APN2-EC2:Compute,Tax,12.0,,120.0,12.0,,AmazonEC2,CT,100.0,,450345623178,tech-solutions,1.0,2025-08-01T00:00:00.000Z,2025-07-01T00:00:00.000Z,APN2-EC2:Compute,,,,0.0,,,,,,,"{""product_name"":""AmazonEC2""}",,,,,,,,,,,,,,,,,,,,,,0.0,0.0,,0.0,,,0.0,0.0,0.0,0.0,0.0,0.0,0.0,"","",0.0,,,,"","","",0.0,0.0,0.0,0.0,0.0,"{""Environment"":""Production"",""Owner"":""alice.wang"",""Project"":""NeuralNet-ML"",""Department"":""AI Research"",""CostCenter"":""AI-421""}",0.0,,,0.0,0.0,0.0,,,,0.0,,,0.0,0.0,,0.0,0.0
+Anniversary,AWS,2025-08-15T00:00:00.000Z,2025-07-15T00:00:00.000Z,,"Amazon Web Services, Inc.",987654321098,global-tech,"{""c"":""test"",""a"":""test"",""b"":""test""}","{""bulk_rate_discount"":""20%""}",,0.0,xyz678pqr90bknfhjvtncbwpmk3461hzl,2025-07-15T00:00:00Z/2025-08-15T00:00:00Z,,300.0,,USD,"Amazon Web Services, Inc.",Tax for product code S3 usage type APN3-S3:Storage,Tax,50.0,,250.0,50.0,,AmazonS3,CT,200.0,,891234567890,global-tech-co,1.0,2025-08-15T00:00:00.000Z,2025-07-15T00:00:00.000Z,APN3-S3:Storage,,,,0.0,,,,,,,"{""product_name"":""AmazonS3""}",,,,,,,,,,,,,,,,,,,,,,0.0,0.0,,0.0,,,0.0,0.0,0.0,0.0,0.0,0.0,0.0,"","",0.0,,,,"","","",0.0,0.0,0.0,0.0,0.0,{},0.0,,,0.0,0.0,0.0,,,,0.0,,,0.0,0.0,,0.0,0.0
+Standard,AWS,2025-09-01T00:00:00.000Z,2025-08-01T00:00:00.000Z,,"Amazon Web Services, Inc.",123456789012,green-solutions,"{""edp_discount"":""12%""}","{""private_rate_discount"":""25%""}",,0.0,abc234def56ghjklmno789xyz12pqrst,2025-08-01T00:00:00Z/2025-09-01T00:00:00Z,,400.0,,USD,"Amazon Web Services, Inc.",Tax for product code Lambda usage type APN4-Lambda:Compute,Tax,30.0,,300.0,30.0,,AmazonLambda,CT,250.0,,456789123012,eco-startups,1.0,2025-09-01T00:00:00.000Z,2025-08-01T00:00:00.000Z,APN4-Lambda:Compute,,,,0.0,,,,,,,"{""product_name"":""AmazonLambda""}",,,,,,,,,,,,,,,,,,,,,,0.0,0.0,,0.0,,,0.0,0.0,0.0,0.0,0.0,0.0,0.0,"","",0.0,,,,"","","",0.0,0.0,0.0,0.0,0.0,{},0.0,,,0.0,0.0,0.0,,,,0.0,,,0.0,0.0,,0.0,0.0
+Promotion,AWS,2025-09-10T00:00:00.000Z,2025-08-10T00:00:00.000Z,,"Amazon Web Services, Inc.",123987654321,cloud-innovators,"{""bulk_discount"":""15%""}","{""early_bird_discount"":""10%""}",,0.0,pqr123stu456vwx789yz,2025-08-10T00:00:00Z/2025-09-10T00:00:00Z,,150.0,,USD,"Amazon Web Services, Inc.",Tax for product code RDS usage type APN5-RDS:Database,Tax,20.0,,130.0,20.0,,AmazonRDS,CT,100.0,,654987321456,cloud-tech,1.0,2025-09-10T00:00:00.000Z,2025-08-10T00:00:00.000Z,APN5-RDS:Database,,,,0.0,,,,,,,"{""product_name"":""AmazonRDS""}",,,,,,,,,,,,,,,,,,,,,,0.0,0.0,,0.0,,,0.0,0.0,0.0,0.0,0.0,0.0,0.0,"","",0.0,,,,"","","",0.0,0.0,0.0,0.0,0.0,{},0.0,,,0.0,0.0,0.0,,,,0.0,,,0.0,0.0,,0.0,0.0
+Subscription,AWS,2025-10-01T00:00:00.000Z,2025-09-01T00:00:00.000Z,,"Amazon Web Services, Inc.",564738291027,innovative-solutions,"{""loyalty_discount"":""8%""}","{""seasonal_rate_discount"":""10%""}",,0.0,xyz345uvw678opq901rst234klm789,2025-09-01T00:00:00Z/2025-10-01T00:00:00Z,,250.0,,USD,"Amazon Web Services, Inc.",Tax for product code CloudFront usage type APN6-CF:CDN,Tax,15.0,,235.0,15.0,,AmazonCloudFront,CT,180.0,,789123456012,tech-hub,1.0,2025-10-01T00:00:00.000Z,2025-09-01T00:00:00.000Z,APN6-CF:CDN,,,,0.0,,,,,,,"{""product_name"":""AmazonCloudFront""}",,,,,,,,,,,,,,,,,,,,,,0.0,0.0,,0.0,,,0.0,0.0,0.0,0.0,0.0,0.0,0.0,"","",0.0,,,,"","","",0.0,0.0,0.0,0.0,0.0,{},0.0,,,0.0,0.0,0.0,,,,0.0,,,0.0,0.0,,0.0,0.0
+Bill,BillingEntity,2025-08-01T00:00:00.000Z,2025-07-01T00:00:00.000Z,,"Amazon Web Services, Inc.",123456789012,tech-innovators,"{""cloud_discount"":""10%""}","{""enterprise_rate"":""15%""}",,0.0,abcdef12345ghjklmnpq789xyz,2025-07-01T00:00:00Z/2025-08-01T00:00:00Z,,120.0,,USD,"Amazon Web Services, Inc.",Tax for product code EC2 usage type APN2-EC2:Compute,Tax,12.0,,120.0,12.0,,AmazonEC2,CT,100.0,,450345623178,tech-solutions,1.0,2025-08-01T00:00:00.000Z,2025-07-01T00:00:00.000Z,APN2-EC2:Compute,,,,0.0,,,,,,,"{""product_name"":""AmazonEC2""}",,,,,,,,,,,,,,,us-east-1,,,,,,,0.0,0.0,,0.0,,,0.0,0.0,0.0,0.0,0.0,0.0,0.0,,,0.0,,,,,,,0.0,0.0,0.0,0.0,0.0,"{""Environment"":""Production"",""Owner"":""alice.wang"",""Project"":""NeuralNet-ML"",""Department"":""AI Research"",""CostCenter"":""AI-421""}",0.0,,,0.0,0.0,0.0,,,,0.0,,,0.0,0.0,,0.0,0.0
+Bill,BillingEntity,2025-08-01T00:00:00.000Z,2025-07-01T00:00:00.000Z,,"Amazon Web Services, Inc.",123456789012,tech-innovators,,"{""enterprise_rate"":""15%""}",,0.0,abcdef12345ghjklmnpq789xyz,2025-07-01T00:00:00Z/2025-08-01T00:00:00Z,,120.0,,USD,"Amazon Web Services, Inc.",Tax for product code EC2 usage type APN2-EC2:Compute,Tax,12.0,,120.0,12.0,,AmazonEC2,CT,100.0,,450345623178,tech-solutions,1.0,2025-08-01T00:00:00.000Z,2025-07-01T00:00:00.000Z,APN2-EC2:Compute,,,,0.0,,,,,,,"{""product_name"":""AmazonEC2""}",,,,,,,,,,,,,,,us-east-1,,,,,,,0.0,0.0,,0.0,,,0.0,0.0,0.0,0.0,0.0,0.0,0.0,,,0.0,,,,,,,0.0,0.0,0.0,0.0,0.0,"{""Environment"":""Production"",""Owner"":""alice.wang"",""Project"":""NeuralNet-ML"",""Department"":""AI Research"",""CostCenter"":""AI-421""}",0.0,,,0.0,0.0,0.0,,,,0.0,,,0.0,0.0,,0.0,0.0