Most teams discover a cost spike when the invoice arrives — three or four weeks after whatever caused it started running. AWS Cost Anomaly Detection is a free tool that can shrink that discovery window to hours, but most accounts either haven't configured it or have it set up too loosely to catch anything before the bill is already large.
Why Teams Skip This
Cost Anomaly Detection isn't a FinOps platform — it's a native AWS service with monitors and subscriptions, and it doesn't show up prominently unless someone specifically goes looking for it in Cost Management. Teams that haven't been burned by a surprise bill often don't know it exists; teams that have been burned usually set it up reactively, sometimes with thresholds too high to matter.
Setting Up Monitors That Actually Work
A monitor watches a defined scope — the whole account, a specific service, or a linked account in an Organization — and learns your normal spend pattern to flag deviations. We typically configure multiple monitors rather than one broad account-level monitor, because a broad monitor averages away spikes in any single service.
import boto3
ce = boto3.client("ce")
# Per-service monitor catches a spike in one service even if total spend looks normal
response = ce.create_anomaly_monitor(
AnomalyMonitor={
"MonitorName": "per-service-cost-monitor",
"MonitorType": "DIMENSIONAL",
"MonitorDimension": "SERVICE",
}
)
monitor_arn = response["MonitorArn"]
# Subscription with a dollar-impact threshold, not just percentage
ce.create_anomaly_subscription(
AnomalySubscription={
"SubscriptionName": "high-impact-anomaly-alerts",
"MonitorArnList": [monitor_arn],
"Subscribers": [
{"Address": "arn:aws:sns:us-east-1:<account>:cost-anomaly-alerts", "Type": "SNS"}
],
"Threshold": 100, # dollar-impact threshold, not percentage
"Frequency": "DAILY",
}
)
The threshold choice matters more than it looks. A percentage-based threshold can miss a real dollar spike in a service with naturally high variance, and can over-alert on a low-spend service where a 200% jump is still only a few dollars. We generally recommend a dollar-impact threshold tuned to what actually warrants a page — often somewhere between $50 and $500 depending on account size — rather than the default percentage setting.
Routing Alerts Somewhere People Will See Them
SNS alone doesn't get read fast enough. We typically chain the SNS topic into a Lambda that posts a formatted message to Slack, including the service, the dollar and percentage deviation, and a direct link to Cost Explorer filtered to the anomalous dimension — so the on-call engineer can see the "what changed" in one click instead of starting a cost investigation from scratch.
What This Catches in Practice
The most common findings from a fresh anomaly detection setup: a forgotten load test left running, a misconfigured Lambda with a recursive invocation loop, an S3 lifecycle rule that stopped applying after a bucket policy change, and CloudWatch Logs retention set to "never expire" on a high-volume log group. None of these are exotic — they're the kind of thing that's cheap to catch in hours and expensive to catch in a monthly invoice review.
Frequently Asked Questions
Is AWS Cost Anomaly Detection actually free?
Yes, there's no additional charge for the anomaly detection service itself beyond your normal AWS spend — it's part of AWS Cost Management at no extra cost.
How long does it take before monitors start producing useful alerts?
The service needs roughly 10 days of historical spend data to establish a baseline before it can reliably flag anomalies, so don't expect meaningful signal in the first week after setup.
Can this replace a dedicated FinOps platform?
Not entirely — Cost Anomaly Detection is a monitoring layer, not a full cost allocation, forecasting, or optimization platform. It's a strong, free complement to whatever cost management tooling you already use, not a replacement for tagging and allocation work.
Does this work across a multi-account AWS Organization?
Yes, when set up from the Organization's management account or a delegated administrator account, monitors can span linked accounts, which is where anomaly detection catches the most in practice — a single member account's spike can otherwise get lost in consolidated billing totals.
See what an AWS cost audit finds in your account → rutagon.com/contact or call 907-841-8407.