AWS Cost Anomaly Detection — Optimizing Cloud Economics
Tags: devops, aws
Published: 2023-11-17 18:36:12

In the dynamic world of cloud services, managing budgets and assessing cost performance is a crucial task. AWS introduced Anomaly Detection, a feature that allows users to segment spending effectively. It provides a detailed understanding of spending patterns through a comprehensive analysis, enabling more informed and strategic decision-making in cost management.

## What is Anomaly?

Anomaly refers to something that deviates from what is standard, normal, or expected. In the context of AWS Cost Anomaly Detection, it involves identifying and flagging unusual or unexpected patterns in spending behaviour within cloud services.

AWS Cost Anomaly Detection uses a multi-layered state machine learning model that learns your unique spend patterns to adjust spend thresholds — this means you do not need to worry about determining appropriate thresholds (e.g. 10% increase in daily spend) and maintaining them as your usage changes over time. These machine learning layers allow Anomaly Detection to detect various types of anomalies, such as a one-time cost spike or gradual, consistent cost increases. Anomaly Detection is customizable to segment your spending data and provides tailored alerting preferences so that you are informed as soon as an anomaly is detected.

## Architecture

![](https://cdn-images-1.medium.com/max/3164/0*SOUUjGdMuqtnyKg7.png)

## Use cases

**Reduce surprise bills**

* Stay informed of spending anomalies through automated detection alerts, via email or Amazon SNS topics, at the frequency of your choice. With Amazon SNS topics, you can send alerts to your Slack channel or Amazon Chime chat room to support collaboration and timely resolution of alerts.

**Set alert subscription**

* Once you have created your cost monitor, you can choose your alerting preference by setting up a dollar threshold (e.g. only alert on anomalies with impact greater than $1,000). You don’t need to define an anomaly (e.g. percent or dollar increase) as Anomaly Detection does this automatically for you and adjusts over time. ).

**Receive alerts**

* Once cost monitors and alert subscriptions are created, you’re all set! Anomaly Detection will begin to work within 24 hours and you will be notified if any anomaly meets your alert threshold. You can visit your Anomaly Detection dashboard to monitor the activities, including anomalies detected that are below your alert threshold.

## **Benefits**

* ***Anomaly Detection:*** AWS Cost Anomaly Detection spots irregularities in your AWS spending. This includes detecting significant spending spikes, unusual usage patterns, or deviations from historical norms.

* ***Alerts and Notifications:*** The service provides customizable alerts and notifications. When an anomaly is detected, it can send notifications via email, SMS, or other channels, ensuring that you’re promptly informed about spending irregularities.

* ***Customization Options:*** AWS Cost Anomaly Detection can be customized to detect anomalies specific to the organization’s needs. You can set custom threshold values, define which AWS accounts or resources to monitor, and configure alerting preferences to match your operational requirements.

## Let’s take a deeper look at Cost Anomaly Detection

Anomaly Detection comes integrated with **AWS Cost Explorer** so you can graphically visualize the anomaly and perform further analysis, as needed. You’ll notice that the filters and dates are automatically configured based on the anomaly details.

Anomaly Detection is powered by a complex machine learning model yet it is simple and easy to use in AWS Console. It takes two steps with a few clicks to **enable Anomaly Detection**.

Log in to your AWS Console and navigate to AWS Cost Management Dashboard, and you will find “**Cost Anomaly Detection**” on your left pane.

![](https://cdn-images-1.medium.com/max/2000/0*83dYWZHr6__lxxVy.png)

You can check the detection history and summary of cost anomaly detection

![](https://cdn-images-1.medium.com/max/4414/0*o8d07rH0v4Z2oZ87.png)

To view the cost monitors, navigate to it. AWS automatically creates a default Service Monitor. To create a new cost monitor, click on ‘**Create monitor**’.

![](https://cdn-images-1.medium.com/max/4410/0*GhQAk9SrPSS7bNMH.png)

## Create a monitor

Create a monitor by selecting monitor types, linked accounts, and specifying a unique name during the setup. These are the supported monitor types by AWS.

**Key Monitor Types:**

 1. **AWS Services Monitor:**

* Ideal for users not need internal organization segmentation.

* Automatically adapts to new AWS services without manual configuration.

**2. Linked/Member Account Monitor:**

* Evaluates total spending for individual or grouped linked accounts.

* Useful for organizations segmenting spend by teams, products, services, or environments.

**3. Cost Categories Monitor:**

* Tailored for users leveraging Cost Categories for organizational structure.

* Allows monitoring spending for specific Cost Category values.

**4. Cost Allocation Tag Monitor:**

* Segments spent based on Cost Allocation Tags.

* Supports one tag key with multiple tag values for flexible evaluation.
>  Note: Only 1 AWS services monitor type can be created for an account. Remove any existing monitors to create a new AWS Service monitor.

![](https://cdn-images-1.medium.com/max/2576/0*pQy6nYq8EM3tbt9_.png)

## Alert Subscriptions

As you create your monitors, you will be able to configure your alerting preference. Note that you do not have to define an anomaly (e.g. 10% increase in daily spend) — we leverage machine learning to automatically determine and continuously adjust thresholds as your spending patterns change over time. What you need to define is your alerting preferences so that you only receive alerts that are important to you based on the estimated cost impact. Anomalies that do not meet these thresholds are captured and available to you in the Anomaly Detection dashboard.

Additionally, you can determine the alerting frequency. Individual alerts allow you to be notified as soon as an anomaly is detected.
>  (note: this is not alerted immediately after the usage occurs) — this means that if multiple anomalies are detected throughout the day, you might receive multiple alerts. Another option is to receive Daily or Weekly summary reports, which consolidate the alerts into a single notification, either daily or weekly.

Lastly, Anomaly Detection supports SNS and email notifications.

You’ll notice that you can configure these preferences within each individual Monitor you have created. This will allow you to notify the appropriate stakeholders within your organization.

* Example: let’s say your organization has two linked/member accounts -1234 and -4321. You can create a monitor that evaluates account -1234 and configure notifications to alert ***Subbu*** and ***Bucky***. You can also create a separate monitor that evaluates account -4321 and configure notifications to alert ***Subbu*** and ***Sravan***. In this example, ***Bucky*** and ***Sravan*** are only notified if there is an anomaly in the account that they are associated with, but ***Subbu*** gets notified of any anomaly across both accounts.

## Configure alerting preferences

Configure the Alert Subscriptions, Create a new Subscription with the Subscription name. select the Alerting frequency as **Daily** and specify the **Alert recipients** to receive the notifications. Specify the Threshold which you need to get the alert whenever the amount is above the expected spend.

![](https://cdn-images-1.medium.com/max/2564/0*mCfjO_hVMh14Mv7a.png)

View the list of **Cost monitors**, select the created one, and click on it.

![](https://cdn-images-1.medium.com/max/4656/0*2fZQpWQyZ7Zpp8sr.png)

In the monitor dashboard, you can check the count of detected anomalies and view the detection history.

![](https://cdn-images-1.medium.com/max/4712/0*OwTkM1IJMtjTGTzq.png)

Click on **Alert Subscriptions **to view the added subscriptions.

![](https://cdn-images-1.medium.com/max/4720/0*4BfF5grFTTkKjdWQ.png)

We can review subscribers and attach cost monitors to the **DevOpsVoyager** Alert Subscription for streamlined management. This ensures timely notifications for spending anomalies.

![](https://cdn-images-1.medium.com/max/4760/0*g-0CZmjbXdRXAa_Q.png)

## Conclusion

AWS Cost Anomaly Detection provides you with an easy-of-use, ML-driven capability to detect unusual spending across your AWS accounts. You can configure Anomaly Detection to better reflect your organization’s business needs and/or how you manage your cost and usage. Anomaly Detection provides flexible alerting capability so that the correct stakeholders are notified of each anomaly that is detected, using their own alerting preferences. With the introduction of Anomaly Detection, [AWS Cost Management](https://aws.amazon.com/aws-cost-management/) is providing you yet another way to more effectively control your cost and usage while minimizing unintended spend.

[https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/](https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/)

Thanks for reading! I hope you found this helpful and informative.

I’m always happy to connect with tech enthusiasts and answer any questions you may have. Don’t forget to follow me for more updates on cloud computing, tech and more.😄😄

Follow me on LinkedIn to see interesting posts like this : ) [**Linkedin](https://www.linkedin.com/in/subbaramireddy/)**