Finding the Needle in the Haystack
AWS Budgets catches absolute spending — "You have spent more than $10 this month." But it has a blind spot: it checks on a schedule (every 8–24 hours) and compares against a fixed threshold. A runaway process that spends $50 in two hours might not trigger a $10 monthly budget until the next billing cycle check.
Cost Anomaly Detection uses machine learning to catch patterns rather than absolute values. It builds a baseline of your normal spending behavior — by service, by region, by linked account — and alerts you when it detects a statistically significant deviation.
A Concrete Scenario
- Your account normally spends $0.10/day on S3 storage (a few small files).
- A bug in your application causes it to write a new 1 GB log file every minute.
- After two hours, you have consumed 120 GB of storage and incurred $2.76 in charges.
- Your monthly budget threshold of $10 has not been breached yet.
- Cost Anomaly Detection fires an alert: "S3 spend is 2,760% above your normal Tuesday baseline."
You catch the bug after $2.76 in damage instead of after $10 — or after $200 if the bug ran all weekend.
Setting Up Anomaly Detection
Cost Anomaly Detection is configured through monitors and alert subscriptions:
- Monitor: Defines what to watch. Options include all AWS services, a specific service (e.g., EC2 only), a linked account, or a cost allocation tag.
- Alert Subscription: Defines when to notify and how (email or SNS). You set a minimum dollar threshold to avoid noise (e.g., "Only alert me if the anomaly is more than $1").
For a learning account, create one monitor covering all AWS services with a $1 minimum anomaly threshold. This gives you broad coverage without alert fatigue.
Budgets vs. Anomaly Detection: When to Use Each
| Scenario | Best Tool |
|---|---|
| "Alert me if I spend more than $5 this month" | AWS Budgets (Cost Budget) |
| "Alert me if I use more than 700 EC2 hours" | AWS Budgets (Usage Budget) |
| "Alert me if my spending pattern looks wrong" | Cost Anomaly Detection |
| "Stop my instances automatically if I overspend" | AWS Budgets Actions |
Use both. They are complementary, not redundant.
A common interview question for cloud or FinOps roles: "How would you prevent runaway cloud costs in a development account?" A weak answer mentions only billing alerts. A strong answer layers the defenses: Free Tier awareness, a Zero Spend Budget with automated IAM policy attachment, Cost Anomaly Detection for pattern-based alerts, and Service Control Policies at the organization level to hard-cap what services can be launched. This demonstrates you understand that cost governance is a system, not a single setting.