Overview

AWS Cost Anomaly Detection is an AWS Cost Explorer feature that uses machine learning to continuously monitor your cost and usage to detect unusual spends. Using AWS Cost Anomaly Detection includes the following benefits:

• Receive alerts individually in aggregated reports. You can receive alerts in an email or an Amazon SNS topic.
• Evaluate your spend patterns using machine learning methods to minimize false positive alerts. For example, you can evaluate weekly or monthly seasonality and organic growth.
• Analyze and determine the root cause of the anomaly, such as account, service, Region, or usage type that is driving the cost increase.
• Configure how you need to evaluate your costs. You can choose whether you want to analyze all of your AWS services independently, or by member accounts, cost allocation tags, or cost categories.

AWS Cost Anomaly Detection runs approximately three times a day after your billing data is processed. You might experience a slight delay in receiving alerts. As a result, you might accumulate additional costs over the notified amount by the time you receive the alert.

How it works

1. Cost Anomaly Detection can be setup via console/CFN/CDK (cfn resource), and the region has to be us-east-1. Two main components need to be configured: 
   cost monitors – 4 types: AWS services/ Linked account/ Cost category/ Cost allocation tag 
   alert subscriptions – 3 alerting frequencies: individual alerts (sns)/ daily summary (email)/ weekly summary (email)
2. AWS Cost Anomaly Detection sends you a notification when the difference between your actual spend and normal spend pattern has exceeded the threshold. It currently only does it when the actually spending is higher than normal. And there is an existing feature request for AWS to include the less than scenario.
3. Besides email and sns, the detection history can be viewed in the console too (last 30/60/90 days).
4. Cost Anomaly Detection only provides limited information about the cause, you still need to dig into the details. The notification looks something like – “rootCauses”: [ { “service”: “AnomalousServiceName”, “region”: “AnomalousRegionName”, “linkedAccount”: “AnomalousLinkedAccount”, “usageType”: “AnomalousUsageType” } ],
5. About Assessment field – for each detected anomaly, you can submit an assessment to help improve AWS anomaly detection systems. The possible values are Not submitted, Not an issue, or Accurate anomaly.

Price

AWS Cost Anomaly Detection is a free service. 

Limit

The maximum number of monitors you can create for an AWS service monitor type	1 monitor per account
The maximum number of monitors you can create for other monitor types (member account, cost category, cost allocation tag)	100 total monitors per management account
Unsupported services	AWS MarketplaceAWS SupportWorkSpacesCost ExplorerBudgetsAWS ShieldAmazon Route 53AWS Certificate ManagerUpfront and recurring reserved fee and Savings Plan fees

Summary

Most AWS users should already have the AWS budget alert in place, Cost Anomaly Detection is definiteIy a good addition to it. As it offers you the granular visibility into the abnormal cost of the services instead of the total cost. I would highly recommend you to use it. And in my next post I will talk about a real case that how we reduce the AWS cost by using Cost Anomaly Detection.

In case you are curious, this is how the notification looks like: