Unattributed spend and invoice reconciliation

WHAT NEVER MATCHES
  networking and data-transfer charges
  taxes and fees
  AWS rows carrying no resource id at all
  services ZopNight does not discover
  AWS history older than 14 days, where only
    service-level granularity exists

FOR BILLING-ENABLED ORGS, Summary and Trends add a
PER-DATE RESIDUAL on top of the resource-level totals:

    max(0, billed - captured)

It appears as its own field and is INCLUDED in the
headline total, so the headline RECONCILES WITH THE
INVOICE instead of silently under-reporting.

ADDED (org totals)
  Summary, Trends, per-provider summary, and the
  internal admin dashboard's cost surfaces

NOT ADDED (showback views)
  Breakdown, Snapshots, Teams, Tags, K8s

BECAUSE: SHOWBACK IS NOT THE INVOICE.

Unattributed spend has no resource to attribute, so
folding it into a team or tag view would mean inventing
an owner for spend that has none.

ALSO NOT ADDED: RBAC-SCOPED VIEWS.

A team-scoped user's view skips the residual entirely,
because the spend has no resource to scope by. Adding it
would show a scoped user spend that is not theirs and
that they cannot drill into.

COLLISION MERGING
  Unmatched records collapsing onto the same sentinel id
  are MERGED (summed) BEFORE UPSERT. Without that, the
  unique key would keep only the last colliding row and
  the residual would under-count.

NEGATIVE LINE ITEMS
  Credits and refunds are stored and overlaid AS-IS,
  negative. They are not filtered out.

  An FX conversion failure, NOT a negative sign, is the
  only thing that leaves a cost column null.

OPT-IN. AWS accounts whose credentials carry the export
bucket and name have per-resource billing read from the
customer's own Data Exports (CUR 2.0) gzip-CSV in S3,
INSTEAD OF Cost Explorer.

WHAT IT BUYS
  1. It LIFTS THE 14-DAY RESOURCE-LEVEL LIMIT. Backfill
     stays at resource granularity for the export's
     whole history, rather than collapsing to
     service-level beyond 14 days.
  2. It ingests EVERY invoice line-item type: taxes,
     fees, credits, refunds, reservation and
     savings-plan rows.

Unmatched rows still flow to the svc: sentinel as usual.

FAILURE BEHAVIOUR
  S3 access denials surface as `no_permission` in
  billing sync status.
  Other export errors FAIL THE SYNC EXPLICITLY rather
  than silently degrading to the 14-day API.

The BigQuery export's cost column is PRE-CREDIT.

The daily per-resource and service-level queries fold
the (negative) credit amounts into each row with
NUMERIC-exact math, so committed-use, sustained-use and
promotional discounts are reflected the way the invoice
bills them.

Credit-only rows (zero cost, nonzero credits) are NOT
dropped.

THE CHALLENGE
  "Your Teams report totals $412,000. Your Summary says
   $448,700. Which one do we take to the board?"

BOTH. FOR DIFFERENT QUESTIONS.

  Summary                          $448,700
    resource-attributed            $412,000
    unattributed residual           $36,700
      data transfer                 $19,400
      taxes and fees                 $8,100
      NoResourceId rows              $6,200
      undiscovered services          $3,000

  AWS invoice for the month        $448,700   EXACT

  Teams report                     $412,000
    Every dollar attributed to an owning team.
    The $36,700 is ABSENT BY DESIGN: it has no resource,
    so it has no team.

THE ANSWER GIVEN
  "Summary for the board, because it reconciles with the
   invoice. Teams for the chargeback conversation,
   because every dollar in it has an owner. The $36,700
   gap is data transfer, taxes and untagged services,
   and inventing an owner for it would make the
   chargeback dishonest."

  That answer was accepted and the two-number reporting
  became standard.

THE SECOND FINDING
  $19,400 of data transfer in one month was itself worth
  investigating. It had been invisible while the team
  looked only at the Teams report, because it never had
  a resource to appear against.

  Unattributed spend is not just an accounting residual.
  It is frequently where the un-owned waste lives.

THE CUR 2.0 DECISION
  They wanted per-resource history for the previous
  year. On Cost Explorer, anything older than 14 days
  has only service-level granularity, so it could not be
  reconstructed.

  They enabled the CUR 2.0 export. Backfill then carried
  resource granularity across the whole export history,
  and taxes, fees, credits and savings-plan rows came in
  as line items instead of being absent.

  One caution they were given: if S3 access is later
  revoked, the sync FAILS EXPLICITLY as no_permission
  rather than quietly falling back to the 14-day API. An
  error is the intended outcome, not a silent downgrade.

1. Compare, for last month:
   Summary total              $______
   Teams report total         $______
   Difference                 $______
   That difference is your unattributed residual.

2. Break the residual down. What is in it?
   data transfer              $______
   taxes and fees             $______
   no-resource-id rows        $______
   undiscovered services      $______

3. Is the largest component something you could act on?
   ______________________________________________
   (Data transfer usually is.)

4. Compare Summary against the actual invoice:
   Summary                    $______
   invoice                    $______
   Do they reconcile?                          Y / N
   If not, check whether billing sync is complete for
   every account.

5. On AWS: are you using Cost Explorer or a CUR 2.0
   export?  ____________________
   If Cost Explorer, note that per-resource history
   older than 14 days is not reconstructable.