One or more computer-readable storage media storing instructions that are executable by one or more processors of a computing device to perform operations comprising: obtaining first data indicating a first amount of usage of a computing resource by computing devices of a cloud computing architecture over a first period of time; determining reference data based at least partly on the first data, comprising analyzing the first data to determine at least a distribution of values of the usage of the computing resource over the first period of time; obtaining second data indicating a second amount of usage of the computing resource by the computing devices over a second period of time subsequent to the first period of time; determining that the second amount of usage of the computing resource indicates an increase in usage of the computing resource by the computing devices over the second period of time; determining a value of a computing resource usage metric based at least partly on an amount of the increase in the usage of the computing resource over the second period of time and based at least partly on the reference data; and determining that a computing resource leak is occurring based at least partly on the value of the computing resource usage metric being above a threshold value and a duration of the second period of time being longer than a threshold period of time, wherein the second period of time includes a begin time, an intermediate time, and an end time, and wherein the operations further comprise:determining the begin time is a candidate start time for a leak of the computing resource; and modifying the candidate start time to a subsequent time based on one of: a decrease of usage of computing resources by the computing devices, or an increase of usage of the computing resources by the computing devices over a period of time being less than a threshold amount. obtaining first data indicating a first amount of usage of a computing resource by computing devices of a cloud computing architecture over a first period of time; determining reference data based at least partly on the first data, comprising analyzing the first data to determine at least a distribution of values of the usage of the computing resource over the first period of time; obtaining second data indicating a second amount of usage of the computing resource by the computing devices over a second period of time subsequent to the first period of time; determining that the second amount of usage of the computing resource indicates an increase in usage of the computing resource by the computing devices over the second period of time; determining a value of a computing resource usage metric based at least partly on an amount of the increase in the usage of the computing resource over the second period of time and based at least partly on the reference data; and determining that a computing resource leak is occurring based at least partly on the value of the computing resource usage metric being above a threshold value and a duration of the second period of time being longer than a threshold period of time, wherein the second period of time includes a begin time, an intermediate time, and an end time, and wherein the operations further comprise:determining the begin time is a candidate start time for a leak of the computing resource; and modifying the candidate start time to a subsequent time based on one of: a decrease of usage of computing resources by the computing devices, or an increase of usage of the computing resources by the computing devices over a period of time being less than a threshold amount.