FAQs

Cost Anomaly Detection helps you detect and alert on any abnormal or sudden spend increases in your Amazon Web Services account. This is possible by using machine learning to understand your spend patterns and trigger alert as they seem abnormal.

Learn more about Cost Anomaly Detection from the product page , and the user guide . To learn more about programmatic capabilities, read the Amazon Cost Explorer API documentation .

Cost Anomaly Detection allows you to segment your spend by different dimensions (Amazon Web Services services, Member Accounts , Cost Allocation Tags, and Cost Categories ). This segmentation allows Anomaly Detection to detect more granular anomalies and customize alerting preferences.

Cost Anomaly Detection allows you to create up to 101 monitors. You can attach up to the maximum of all 101 monitors to an alert subscription.

For each alert subscription, you can have up to 10 email recipients or 1 SNS topic. 

The alerting threshold is used to determine when an alert is sent for an anomaly. It does not impact the anomaly detection algorithms in any way. If an anomaly’s total cost impact meets or exceeds the alerting threshold on a subscription, an alert will be sent for the anomaly to the customer. If an anomaly’s total cost impact is below the alerting threshold, it will still be available on the console, but no alert will be sent.

A member account monitor can track up to 10 different member accounts. A member account monitor tracks spending aggregated across all of the designated member accounts. For example, if a member account monitor tracks Account A and Account B, if Account A’s usage spikes but Account B’s usage dips the same amount, there will be no anomaly detected because it is a net neutral change.

A member account monitor in a management account will monitor the spend of all services in aggregate for the member account. A services monitor in a member account will monitor all services for the member account individually. For example, if there is a spike in S3 spending, but a dip in EC2 spending of the same amount (net neutral change), the member account monitor in the management account will not detect this because it is monitoring the account spend in aggregate across all services. However, the services monitor in the member account would detect the S3 spike since it is monitoring each service spend individually. 

Anomalies only appear in the account that created the monitor which detected the anomaly. It is possible the same usage spike can cause an anomaly in two different monitors in two different accounts, and that would result in two anomalies, with one anomaly showing in each account.

A root cause is our best estimate to the largest contributing factor to an anomaly’s total cost impact. The root cause does not explain the total anomaly impact, but only the impact from the largest contributing factor.

We are not always able to identify a single large contributing factor for each anomaly. In the event that there is no clear root cause for the anomaly, we recommend you use the Cost Explorer service in order to view all of the contributing factors.

For the anomalies detected, we report up to two root causes, and these are our best estimate to the largest contributing factors to the anomaly. Since we use machine learning models to select a maximum of two possible root causes, in cases where there are multiple small contributors adding up to the total impact, the root cause explains only a small portion of the total impact.

Amazon Cost Anomaly Detection runs approximately three times a day after your billing data is rocessed.

Anomaly detection relies on the data from Cost Explorer which has a latency of up to 24 hours. Therefore, it can take up to 24 hours to detect an anomaly after the anomalous usage happens.

If you have created a new monitor, it can take 24 hours to start detecting new anomalies.

Any monitor requires at least 10 days of historical usage data for anomalies to be detected. For example, for a services monitor, anomalies for the spending on a new service will not be detected until there is 10 days of spend data.