Cost anomaly alerter
A small system that reads yesterday’s cloud spend, compares each service against what it normally does, and reports the ones that moved with the specific resource named. It cannot stop anything, and the design is honest about why that is the right choice. Seven posts on the same system — one diagram at a time — with a cost breakdown and an engineering reference at the end.
- 01
A cost anomaly alerter on AWS for a few dollars a month
The whole system on one page — a daily fetch, a per-service comparison and an attribution step — plus the deliberate decision not to give it the ability to stop anything.
- 02
How cost data arrives
The unavoidable billing delay, the two granularities available, the services where resource-level attribution simply does not exist, and the faster proxy signals worth adding alongside.
- 03
How a cost anomaly is judged
The two shapes a cost anomaly takes, why absolute money gates every relative comparison, how a new service with no history is handled, and the fall that matters.
- 04
How a cost spike gets attributed
Getting from a service name to a resource to a change, the four causes that account for most spikes, and how to be useful when attribution is genuinely impossible.
- 05
Why the alerter cannot act
The argument against automatic remediation, the one narrow exception worth considering, what the message contains instead, and the monthly numbers.
- 06
What the cost anomaly alerter costs
About $2 a month. One Bedrock read per daily run is the only line that grows; the queue, the table, the mail and the storage are rounding errors. Plus the three ways the bill could surprise you.
- 07
Engineering reference: the cost anomaly alerter architecture
Same system, drawn purely for engineers. Service names, region, Lambda inventory, IAM scopes, the schemas and the exact model id.
Frequently asked questions
- What is a cost anomaly alerter?
- A small serverless system that reads daily cloud spend by service and resource, compares each line against its own recent pattern, and reports movement with the resource named. It reports; it never stops or deletes anything.
- Why not just use a budget alert?
- A budget alert fires when a monthly total crosses a line, which is usually around the 24th and always too late. This compares daily, per service, so a runaway is visible on day one when it has cost a fortieth of what it will.
- Can it stop a runaway resource?
- No, deliberately. A system with permission to delete or stop resources in response to a metric is a system that can take your production environment down because of a misattributed cost line. It tells a person, quickly.
- Why is the data a day late?
- Because cloud billing data is. There is a faster signal for a few services, and for everything else a day is the floor. The design assumes it rather than pretending otherwise.
- What does it cost to run?
- Under a dollar a month, which is a pleasing property for a cost monitor. See part six.