AWS Cost Anomaly Detection


Improve Planning and Cost Control with AWS Budgets

The course is part of this learning path

Start course

This course will explain how AWS Budgets can help you manage AWS spend and improve financial planning. 

Learning Objectives

  • What the tool is and the benefit it provides
  • How to set up a Budget and configure Budgets actions 
  • How to send a Budget report 
  • And lastly, how to configure and use AWS Cost Anomaly Detection

Intended Audience

This course has been created for financial operations professionals interested in controlling AWS costs and for engineering team members who want more visibility into the cost of their environments.


To get the most out of this course, you should have an understanding of the AWS Billing console and AWS Cost Explorer. Additionally, I briefly discuss establishing permissions through IAM and AWS Organizations and use examples referencing Amazon EC2.


Everyone has a story about an AWS bill -  and usually, it takes hearing just one of these stories for you to become obsessive about tracking your AWS spend. And while AWS budgets help with this paranoia, it’s not a perfect science. 

There may be times when you exceed your budget, but it’s because of business growth. You’re using more and racking up additional costs to better serve your customers - which is a good thing. Or there may be times where you’ve set a budget and you have a spike that’s not normal for your business but it remains under the threshold, so you don’t get alerted…which isn’t a good thing. 

This leads us to two fundamental truths: 

  1. Every business hates surprise spikes in cost and, 
  2. Every business contextualizes these spikes in costs and determines if they are “good” or “bad” based on their own unique spending patterns 

Analyzing these cost spikes used to be a very manual process but now there are tools that can help us automate it, and one of those is called AWS Cost Anomaly Detection. 

This service helps you gain an understanding of what is normal or not normal in terms of spending for your AWS accounts. And any time you have a random spike in spending that is deemed “not normal”, you can not only be alerted of that spike, but you can also investigate why it happened.

Like AWS Budgets, the first step in using Cost Anomaly Detection is to create an alert - which is called a cost monitor in this service. You can choose to evaluate your costs based on AWS service, or by linked accounts, cost allocation tags, or cost categories. 

This choice is dependent on how you track your costs in your cloud environment. Lets use an example - say you’re in an organization that segments cost by project. You can do this in many different ways in AWS.  For example, you may use AWS accounts to segment costs for each project or you may use tags, and tag resources based on a particular project or you may even create your own custom resource groupings using cost categories. Or perhaps you’re more interested in segmenting spend by AWS service, to monitor each service spend individually for your projects instead. So depending on how you filter your spend, you’ll choose the corresponding monitor to match. 

When you create a cost monitor, you have to specify a threshold which will determine when the service sends you a notification. This threshold is defined as the difference between actual spend and your normal spend pattern. For example, let’s say you set your threshold at $25.  And your normal spend is $50. When your daily spend reaches $75, which is $25 past your normal $50 spend, then you’ll be alerted of the anomaly. 

Keep in mind this threshold only defines when to alert you and does not determine what an anomaly looks like for your account. And actually, you don’t have to define that anywhere - the service will define what an anomaly looks like based on your own spending patterns by using machine learning. 

From there, you can choose to get notified as soon as the anomaly is detected, or in a daily or weekly summary. Instead of receiving a notification anytime an anomaly is detected, these daily or weekly summaries will consolidate all anomalies that occurred within that day or that week.

Once the anomaly reaches the threshold that you set, you can choose to get notified through email, SNS, or the AWS Chatbot service. 

However, occasionally, there may also be times where there is an anomaly in your account but it doesn’t reach the threshold you set to be notified. This is where the detection history section of the Cost Anomaly Detection dashboard comes in handy. You can view your entire history of anomalies.

In detection history, you can inspect each anomaly in further detail. When inspecting an anomaly, you can take several actions, for example: 

  • You can view the anomaly in cost explorer to filter out details on a more granular level. 
  • You can view the root cause analysis, which the service identifies as the “best guess” to what may have caused the spike. 
  • And you can also submit assessments of the anomaly to better train the model to better learn your unique patterns of spending. 

In summary, Cost Anomaly Detection helps detect one time cost spikes and continuous cost increases. This service is technically considered a free service, so consider using this in conjunction with AWS budgets. This combination of services will provide you more visibility into your spending patterns and any strange cost spikes, enabling you to better plan for the future. 

About the Author

Alana Layton is an experienced technical trainer, technical content developer, and cloud engineer living out of Seattle, Washington. Her career has included teaching about AWS all over the world, creating AWS content that is fun, and working in consulting. She currently holds six AWS certifications. Outside of Cloud Academy, you can find her testing her knowledge in bar trivia, reading, or training for a marathon.