Everyone has a story about an AWS bill -  and usually, it takes hearing just one of these stories for you to become obsessive about tracking your AWS spend. And while AWS budgets help with this paranoia, it’s not a perfect science. 

There may be times when you exceed your budget, but it’s because of business growth. You’re using more and racking up additional costs to better serve your customers - which is a good thing. Or there may be times where you’ve set a budget and you have a spike that’s not normal for your business but it remains under the threshold, so you don’t get alerted…which isn’t a good thing. 

This leads us to two fundamental truths: 

1. Every business hates surprise spikes in cost and, 
2. Every business contextualizes these spikes in costs and determines if they are “good” or “bad” based on their own unique spending patterns 

Analyzing these cost spikes used to be a very manual process but now there are tools that can help us automate it, and one of those is called AWS Cost Anomaly Detection. 

This service helps you gain an understanding of what is normal or not normal in terms of spending for your AWS accounts. And any time you have a random spike in spending that is deemed “not normal”, you can not only be alerted of that spike, but you can also investigate why it happened.

Like AWS Budgets, the first step in using Cost Anomaly Detection is to create an alert - which is called a cost monitor in this service. You can choose to evaluate your costs based on AWS service, or by linked accounts, cost allocation tags, or cost categories. 

This choice is dependent on how you track your costs in your cloud environment. Lets use an example - say you’re in an organization that segments cost by project. You can do this in many different ways in AWS.  For example, you may use AWS accounts to segment costs for each project or you may use tags, and tag resources based on a particular project or you may even create your own custom resource groupings using cost categories. Or perhaps you’re more interested in segmenting spend by AWS service, to monitor each service spend individually for your projects instead. So depending on how you filter your spend, you’ll choose the corresponding monitor to match. 

When you create a cost monitor, you have to specify a threshold which will determine when the service sends you a notification. This threshold is defined as the difference between actual spend and your normal spend pattern. For example, let’s say you set your threshold at $25.  And your normal spend is $50. When your daily spend reaches $75, which is $25 past your normal $50 spend, then you’ll be alerted of the anomaly. 

Keep in mind this threshold only defines when to alert you and does not determine what an anomaly looks like for your account. And actually, you don’t have to define that anywhere - the service will define what an anomaly looks like based on your own spending patterns by using machine learning. 

From there, you can choose to get notified as soon as the anomaly is detected, or in a daily or weekly summary. Instead of receiving a notification anytime an anomaly is detected, these daily or weekly summaries will consolidate all anomalies that occurred within that day or that week.

Once the anomaly reaches the threshold that you set, you can choose to get notified through email, SNS, or the AWS Chatbot service. 

However, occasionally, there may also be times where there is an anomaly in your account but it doesn’t reach the threshold you set to be notified. This is where the detection history section of the Cost Anomaly Detection dashboard comes in handy. You can view your entire history of anomalies.

In detection history, you can inspect each anomaly in further detail. When inspecting an anomaly, you can take several actions, for example: 

• You can view the anomaly in cost explorer to filter out details on a more granular level. 
• You can view the root cause analysis, which the service identifies as the “best guess” to what may have caused the spike. 
• And you can also submit assessments of the anomaly to better train the model to better learn your unique patterns of spending. 

In summary, Cost Anomaly Detection helps detect one time cost spikes and continuous cost increases. This service is technically considered a free service, so consider using this in conjunction with AWS budgets. This combination of services will provide you more visibility into your spending patterns and any strange cost spikes, enabling you to better plan for the future.