This is the step that decides whether the message gets acted on this morning or added to a list. A service name is a place to start looking. A resource name with a usage figure next to it is frequently the whole diagnosis.
Key takeaways
Three levels: service, resource, and the usage number that explains it.
Four causes account for most spikes: volume, retention, a new resource, and recursion.
Tags turn a resource name into an owner, which is who should be told.
Where attribution is impossible, list the candidates by size rather than guessing.
Correlate against deploys and infrastructure changes, and state it as correlation.
Service to resource to cause
Fig 1. How a service-level movement becomes a specific diagnosis. The usage metric in step three is what makes the message a bug report rather than an observation.
Database
App integration
Management
Analytics
People
The four usual causes
Cause
Looks like
Typical fix
Volume
Usage metric up sharply, unit cost unchanged
Find what is calling it; often a retry loop or a recursion
Retention
Storage growing steadily; a ramp, not a step
A lifecycle rule or a log retention setting that was never set
New resource
A resource that did not exist last week
Usually deliberate; the question is whether it was expected to cost this
Recursion
A function or queue triggering itself
Almost always a trigger scoped too broadly; the most expensive of the four
Recursion deserves its own row because it is the one that produces genuinely alarming numbers in hours rather than days. The signature is unmistakable once you know it: invocations and writes both far outside normal, on a resource whose trigger points at somewhere the resource itself writes.
The system does not claim that diagnosis — it does not know the trigger configuration — but it can state both facts side by side, and anybody who has seen one before recognises it immediately from that.
Tags, and untagged resources
A resource name tells an engineer what to look at. A tag tells the system who to tell, which matters because the person who pays the bill and the person who can fix the resource are usually different people.
Fig 2. Why tags matter for a cost alerter specifically: they are the difference between telling somebody and telling the right somebody.
App integration
Management
Analytics
People
Reporting untagged spend as a monthly percentage is a small addition with a large effect. A business where sixty per cent of spend is untagged cannot route any cost finding to anybody, and watching that number fall is a more useful project than any individual anomaly.
When attribution is impossible
Data transfer, support charges, and a handful of services report at a level that makes resource attribution genuinely unavailable. The useful output there is a ranked list of candidates with the reason: “data transfer up £18; no resource attribution available for this line. The three largest egress sources by volume yesterday were these buckets.”
That is honest about the uncertainty and still points somebody at three things to check rather than at the whole account, which is most of the value attribution provides.