To avoid cost surprises in Amazon's cloud, you can leverage AWS Cost Anomaly Detection. This step-by-step guide explains how to configure AWS Cost Anomaly Detection.

AWS Cost Anomaly Detection is a monitoring feature that utilizes advanced machine learning techniques that identify anomalous and suspicious spend behaviors as early as possible so you can avoid costly surprises.

Based on the selected spend segments, Cost Anomaly Detection automatically determines patterns each day by adjusting for organic growth and seasonal trends. It triggers an alert when spend seems abnormal.

Create a cost monitor ^

To follow this guide, please ensure that Cost Explorer is enabled.

Navigate to the AWS Cost Explorer Console.

Click Cost Anomaly Detection.

Cost Anomaly Detection console

Cost Anomaly Detection console

Click Get started, and you will be redirected to the Overview page.

Cost Anomaly overview

Cost Anomaly overview

Navigate to the Cost monitors section and click Create monitor.

Cost monitors section

Cost monitors section

Here, you must choose one of the following monitor types:

  • AWS Services: This monitor evaluates each of the services you use individually, allowing smaller anomalies to be detected. Anomaly thresholds are automatically adjusted based on your historical service spend patterns. I will select this option in this guide.
  • Linked Account: This monitor evaluates the total spend for an individual linked account. This monitor can be helpful if your organization defines teams (or products, services, and environments) by linked account.
  • Cost Category: This monitor evaluates the total spend for an individual cost category value. This monitor can be helpful if your organization defines teams (or products, services, and environments) by using cost categories.
  • Cost Allocation Tag: This monitor evaluates the total spend for an individual tag key–value pair. This monitor can be helpful if your organization defines teams (or products, services, and environments) by using cost allocation tags.

Then, provide a descriptive name that uniquely identifies this monitor.

Specify a monitor type and a name

Specify a monitor type and a name

Once specified, click Next.

On the next screen, you can configure alert subscriptions, which notify you or the designated teams when a cost monitor detects an anomaly. Depending on the alert frequency, you can notify designated individuals by email or Amazon SNS.

You can create a new subscription or choose an existing one.

To create a new subscription, specify the following:

  • Subscription name: A descriptive name that uniquely identifies this subscription.
  • Threshold: The spend amount for which you would like to receive alerts.
  • Alerting frequency: Specify when you want to receive anomaly alerts. Choose individual, daily, or weekly summaries.
  • Alert recipients: Specify the email addresses of the recipients you want to notify with this alert. Use a comma to separate email addresses. You can have up to 10 email recipients.

To add another subscription with different configurations, click Add alert subscription and specify the desired configuration for the new one.

Once done, click Create monitor.

Configure alert subscriptions

Configure alert subscriptions


  • AWS updates cost anomaly information up to three times per day. After billing data is processed, updates typically occur 8–12 hours after the previous update. You might experience a slight delay in receiving alerts. As a result, you might accumulate additional costs over the notified amount by the time you receive the alert.
  • The threshold you set for the alert subscription is purely for alert notifications. It is separate from the anomaly detection threshold. Since anomaly detection is based on machine learning, you don't need to set a threshold. For example, if you set a $10 threshold, the recipient will only receive notifications of events greater than $10. However, everything detected above or below the threshold is available in the Detection History section.

Create and edit alert subscriptions ^

To view, create, or edit the alert subscriptions, navigate to the Alert subscriptions section.

View alert subscriptions

View alert subscriptions

If you want to edit a subscription, select it, and click Edit. Then you can change any of the configurations specified for that alert subscription, including the cost monitor it is attached to.

Edit alert subscription

Edit alert subscription

To create a new alert subscription, just click Create a subscription and follow the same process of Configuring alert subscriptions discussed earlier; this time, you can choose whether to associate it with cost monitors.

Note: You can associate the alert subscription with more than one cost monitor.

View the cost anomalies ^

To view the cost anomalies, navigate to the Detection history section.

View the cost anomalies

View the cost anomalies

You can view the root cause analysis for the anomaly by clicking its detection date. This opens a new page in which the potential root cause analysis is identified for the potential services, linked account, region, and usage type for the anomaly.

Note: High severity means a large spike compared to historical spend, and low severity means a small spike.

Conclusion ^

In this article, we've gone through how to set up cost monitors and alert subscriptions to detect abnormal spend in your AWS accounts. If you have any further questions, please mention them in the comments.

Subscribe to 4sysops newsletter!

DISCLAIMER: This article represents my own viewpoints, not those of my employer, Amazon Web Services.


Leave a reply

Please enclose code in pre tags

Your email address will not be published. Required fields are marked *


© 4sysops 2006 - 2022


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account