Security & identity
AWS Security Hub
- Timebilled
- Bytesbilled
- Callsbilled
In one line
Charged per monitored resource per month. Threat Analytics meters separately on events and log volume.
What gets missed
Resource units are weighted very unevenly. One EC2 instance is a whole unit while it takes roughly a dozen Lambda functions or over a hundred IAM identities to reach the same unit.
Find it on your bill
Filter Cost Explorer or your Cost and Usage Report by these usage types. A usage type with no region prefix means us-east-1.
MonitoredEC2MonitoredFunctionEventsAnalyzedLogsAnalyzedBytes
Bills the same way
These services turn exactly the same meters, so what you learn here transfers.