Photo by Nick Hillier on Unsplash

Part 7: RunInstances:0006?

What do lineItem/Operation suffixes mean?

My name is Christopher Harris, and I am a maintainer on the FinOps FOCUS project. I’ve built cost management products at Datadog and CloudHealth (Broadcom) over the past 8 years, and I’m excited to share some of what I’ve learned with you.

Every CUR row contains an illegible product/sku value pointing to an exact description of what is being charged. At first glance, you might think this value translates into something simple like m5.2xlarge (EC2) or Request (Lambda), but product SKU IDs are much more specific than this.

For example, SKU ID, UDBJ9JJR4E62V9U8, contains the following attributes via AWS’ offering files:

{
    "servicecode": "AmazonEC2",
    "location": "US East (Ohio)",
    "locationType": "AWS Region",
    "instanceType": "m5.2xlarge",
    "currentGeneration": "Yes",
    "instanceFamily": "General purpose",
    "vcpu": "8",
    "physicalProcessor": "Intel Xeon Platinum 8175",
    "clockSpeed": "3.1 GHz",
    "memory": "32 GiB",
    "storage": "EBS only",
    "networkPerformance": "Up to 10 Gigabit",
    "processorArchitecture": "64-bit",
    "tenancy": "Shared",
    "operatingSystem": "Linux",
    "licenseModel": "No License required",
    "usagetype": "USE2-BoxUsage:m5.2xlarge",
    "operation": "RunInstances:0100",
    "availabilityzone": "NA",
    "capacitystatus": "Used",
    "classicnetworkingsupport": "false",
    "dedicatedEbsThroughput": "Up to 2120 Mbps",
    "ecu": "37",
    "enhancedNetworkingSupported": "Yes",
    "gpuMemory": "NA",
    "intelAvxAvailable": "Yes",
    "intelAvx2Available": "Yes",
    "intelTurboAvailable": "Yes",
    "marketoption": "OnDemand",
    "normalizationSizeFactor": "16",
    "preInstalledSw": "SQL Ent",
    "processorFeatures": "Intel AVX; Intel AVX2; Intel AVX512; Intel Turbo",
    "regionCode": "us-east-2",
    "servicename": "Amazon Elastic Compute Cloud",
    "vpcnetworkingsupport": "true"
}

This entry doesn’t just describe an m5.2xlarge … it describes an AmazonEC2 m5.2xlarge, in us-east-2, with a Linux/Unix operating system, with shared tenancy, etc.

Some of these attributes are more primary than others.

Primary SKU Columns

The 3 primary attributes that compositely and uniquely identify the characteristics of each product SKU are servicecode, usagetype, and operation, and they map respectively to product/sku, lineItem/ProductCode, lineItem/UsageType, and lineItem/Operation within the CUR.

In some cases, you’ll see a lineItem/Operation value with a numbered/lettered suffix, like in the above example where the operation value is RunInstances:0100.

Let’s dive into what “:0100” and other similar suffixes mean.

lineItem/Operation values across AWS Services

As of the timing of this article (July 2024), 14 AWS services contain a lineItem/Operation value with a value like <operation>:####.

In alphabetical order, these services are AWSAppStream, AWSCloudSearch, AWSOutposts, AmazonDocDB, AmazonEC2, AmazonElasticache, AmazonGuardDuty, AmazonLightsail, AmazonMQ, AmazonNeptune, AmazonRDS, AmazonRedshift, AmazonTimestream

Of these 14 services, only 5 services contain lineItem/Operation values that:

1. Include 2+ values with suffixes (ex: RunInstances:0001, RunInstances:0002, etc.)
2. Do not leverage these values from other services. In the case of AmazonGuardDuty and AWSOutposts, the former monitors other AWS services, and the latter runs EC2 instances on on-premise, private clouds.

These 5 services are AmazonEC2, AmazonRDS, AmazonElasticache, AmazonAppstream, and AWSCloudSearch.

Let’s dive into each service specifically.

EC2: RunInstances

EC2 contains 1 operation type with numbered suffixes, RunInstance:*. This value maps to product/productFamily values, Compute Instance, or Compute Instance (Bare Metal) within the CUR.

For on-demand instances, each operation value encapsulates various value combinations of the following CUR columns: product/operatingSystem, product/preInstalledSw, product/marketoption

Template: 
lineItem/Operation   -> product/operatingSystem - product/preInstalledSw - product/marketOption

RunInstances:0002    -> Windows - NA - OnDemand
RunInstances:0004    -> Linux - SQL Standard - OnDemand
RunInstances:0006    -> Windows - SQL Standard - OnDemand
RunInstances:000g    -> SUSE - NA - OnDemand
RunInstances:0010    -> RHEL - NA - OnDemand
RunInstances:0010:CB -> RHEL - NA - CapacityBlock
RunInstances:0014    -> RHEL - SQL Standard - OnDemand
RunInstances:0100    -> Linux - SQL Enterprise - OnDemand
RunInstances:0102    -> Windows - SQL Enterprise - OnDemand
RunInstances:0110    -> RHEL - SQL Enterprise - OnDemand
RunInstances:0200    -> Linux - SQL Web - OnDemand
RunInstances:0202    -> Windows - SQL Web - OnDemand
RunInstances:0210    -> RHEL - SQL Web - OnDemand
RunInstances:0800    -> Windows - NA - OnDemand
RunInstances:0g00    -> Ubuntu Pro - NA - OnDemand
RunInstances:0g00:CB -> Ubuntu Pro - NA - CapacityBlock
RunInstances:1010    -> Red Hat Enterprise Linux with HA - NA - OnDemand
RunInstances:1010:CB -> Red Hat Enterprise Linux with HA - NA - CapacityBlock
RunInstances:1014    -> Red Hat Enterprise Linux with HA - SQL Std - OnDemand
RunInstances:1110    -> Red Hat Enterprise Linux with HA - SQL Ent - OnDemand

EC2: RunInstances — Spot

For Spot Instances, all compute lineItem/Operation values have an “:SV” prefix with a designated zone number to denote that the instance is a Spot VM. Additionally, depending on the operating system used, values can take 1 of 2 forms:

Option 1: Linux/Unix
RunInstances:SV####

Option 2: Other OS'
Windows -> RunInstances:0002:SV####
SUSE    -> RunInstances:000g:SV#### 
RHEL    -> RunInstances:0014:SV060
...

The numbered suffix represents the numerical VPC zone (not Availability Zone!) where the Spot VM is running within the region.

I’ve not found any CUR columns or documentation that explains these numerical IDs, other than lineItem/LineItemDescription values like, m5.2xlarge Linux/UNIX Spot Instance-hour in US East (N. Virginia) in VPC Zone #62. Any additional clarifications as comments are appreciated!

A sampling of Spot Instance lineItem/Operation values with corresponding lineItem/LineItemDescription values can be seen below.

Template:
Operating System -> lineItem/Operation      -> lineItem/LineItemDescription

Linux/Unix       -> RunInstances:SV:0002    -> t3.large Linux/UNIX Spot Instance-hour in US East (N. Virginia) in VPC Zone #62
Windows          -> RunInstances:0002:SV012 -> c5.2xlarge Windows Spot Instance-hour in US West (Oregon) in VPC Zone #12
RHEL             -> RunInstances:0010:SV060 -> r6.4xlarge Red Hat Enterprise Linux Spot Instance-hour in Europe (Ireland) in VPC Zone #60
...

RDS: CreateDBInstance, CreateDBProxy

RDS contains 2 operation types with number suffixes, CreateDBInstance:[0–9]+ and CreateDBProxy:[0–9]+ for the product families categorizations of Database Instance or RDSProxy.

Each operation value maps to various value combinations of the following CUR columns: product/databaseEngine, product/databaseEdition, product/licenseModel

Template: 
lineItem/Operation    -> product/databaseEngine - product/databaseEdition - product/licenseModel

CreateDBInstance:0002 -> MySQL - - No license required
CreateDBInstance:0004 -> Oracle - Standard - Bring your own license
CreateDBInstance:0005 -> Oracle - Enterprise - Bring your own license
CreateDBInstance:0010 -> SQL Server - Express - License included
CreateDBInstance:0011 -> SQL Server - Web - License included
CreateDBInstance:0012 -> SQL Server - Standard - License included
CreateDBInstance:0014 -> PostgreSQL - - No license required
CreateDBInstance:0015 -> SQL Server - Enterprise - License included
CreateDBInstance:0016 -> Aurora MySQL - - No license required
CreateDBInstance:0018 -> MariaDB - - No license required
CreateDBInstance:0019 -> Oracle - Standard Two - Bring your own license
CreateDBInstance:0020 -> Oracle - Standard Two - License included
CreateDBInstance:0021 -> Aurora - PostgreSQL - - No license required
CreateDBInstance:0028 -> Db2 - Standard - Bring your own license
CreateDBInstance:0029 -> Db2 - Advanced - Bring your own license
CreateDBInstance:0034 -> Db2 - Standard - Marketplace
CreateDBInstance:0035 -> Db2 - Advanced - Marketplace
CreateDBInstance:0210 -> MySQL (on-premise for Outpost) - - No license required
CreateDBInstance:0220 -> PostgreSQL (on-premise for Outpost) - - No license required
CreateDBInstance:0230 -> SQL Server (on-premise for Outpost) - - Enterprise License included
CreateDBInstance:0231 -> SQL Server (on-premise for Outpost) - - Standard License included
CreateDBInstance:0232 -> SQL Server (on-premise for Outpost) - - Web License included
CreateDBInstance:0401 -> SQL Server - Web - NA
CreateDBInstance:0402 -> SQL Server - Standard - NA
CreateDBInstance:0403 -> SQL Server - Enterprise - NA
CreateDBInstance:0405 -> SQL Server - Standard - NA
CreateDBInstance:0406 -> SQL Server - Enterprise - NA
CreateDBInstance:0407 -> SQL Server - Developer - NA
CreateDBInstance:0410 -> Oracle - Enterprise - Bring your own license
CreateDBInstance:0411 -> Oracle - Standard Two - Bring your own license

--

Template: 
lineItem/Operation -> product/databaseEngine - product/licenseModel

CreateDBProxy:0002 -> MySQL - No license required
CreateDBProxy:0010 -> SQL Server -
CreateDBProxy:0011 -> SQL Server -
CreateDBProxy:0012 -> SQL Server -
CreateDBProxy:0014 -> PostgreSQL - No license required
CreateDBProxy:0015 -> SQL Server -
CreateDBProxy:0016 -> Aurora MySQL - No license required
CreateDBProxy:0018 -> MariaDB - No license required
CreateDBProxy:0021 -> Aurora PostgreSQL - No license required

ElastiCache: CreateCacheCluster

ElastiCache contains 1 operation type with a number suffix, CreateCacheCluster:* for the product families categorizations of Cache Instance.

Each operation value maps to either product/cacheEngine values, Memcached, or Redis within the CUR:

Template: 
lineItem/Operation      -> product/cacheEngine

CreateCacheCluster:0001 -> Memcached
CreateCacheCluster:0002 -> Redis

AppStream: Streaming

AppStream contains 1 operation type with a number suffix, Streaming:*.

Each operation value maps to various value combinations of the following CUR columns: product/productFamily, product/instanceFunction

Template: 
lineItem/Operation -> product/productFamily (product/instanceFunction)

Streaming:001      -> Streaming Instance (Fleet, ImageBuilder, ElasticFleet, AppBlockBuilder)
Streaming:002      -> None (MultiSessionFleet)

CloudSearch: CSDomain

CloudSearch contains 1 operation type with a number suffix, CSDomain:*.

Each operation value maps to product/cloudSearchVersion values, 2011, or 2013 within the CUR.

Template: 
lineItem/Operation -> product/cloudSearchVersion

CSDomain:001       -> 2011
CSDomain:002       -> 2013

Hopefully, this article clarifies why some lineItem/Operation have suffixes and their significance. Please feel free to comment with any questions or for additional clarification.

Check out my other stories about Understanding the AWS CUR.