General AWS Cost Anomaly Detection FAQs

Q: What is AWS Cost Anomaly Detection and how does it work?

Cost Anomaly Detection helps you detect and alert on any abnormal or sudden spend increases in your AWS account. This is possible by using machine learning to understand your spend patterns and trigger alert as they seem abnormal.

Learn more about Cost Anomaly Detection from the product page and the user guide. To learn more about programmatic capabilities, read the AWS Cost Explorer API documentation.

Q: How can I customize monitors to evaluate for anomalies?

Cost Anomaly Detection allows you to segment your spend by different dimensions (AWS Services, Linked Accounts, Cost Allocation Tags, and Cost Categories). This segmentation allows Cost Anomaly Detection to detect more granular anomalies and customize alerting preferences.

Q: How many monitors can be attached to each alert subscription?

Cost Anomaly Detection allows you to create up to 101 monitors. You can attach up to the maximum of all 101 monitors to an alert subscription.

Q: How many recipients can be attached to each alert subscription?

For each alert subscription, you can have up to 10 email recipients or 1 SNS topic.

Q: How does the alerting threshold work?

The alerting threshold is used to determine when an alert is sent for an anomaly. It does not impact the anomaly detection algorithms in any way. If an anomaly’s total cost impact meets or exceeds the alerting threshold on a subscription, an alert will be sent for the anomaly to the customer. If an anomaly’s total cost impact is below the alerting threshold, it will still be available on the console, but no alert will be sent.

Q: How does a linked account monitor work?

A linked account monitor can track up to 10 different linked accounts. A linked account monitor tracks spending aggregated across all of the designated linked accounts. For example, if a linked account monitor tracks Account A and Account B, if Account A’s usage spikes but Account B’s usage dips the same amount, there will be no anomaly detected because it is a net neutral change.

Q: What is the difference between a linked account monitor in a payer account, and a services monitor in a linked account?

A linked account monitor in a payer account will monitor the spend of all services in aggregate for the linked account. A services monitor in a linked account will monitor all services for the linked account individually. For example, if there is a spike in S3 spending, but a dip in EC2 spending of the same amount (net neutral change), the linked account monitor in the payer account will not detect this because it is monitoring the account spend in aggregate across all services. However, the services monitor in the linked account would detect the S3 spike since it is monitoring each service spend individually. 

Q: If I create a monitor in a linked account and in a payer account, will I have the same anomaly show up twice?

Anomalies only appear in the account that created the monitor which detected the anomaly. It is possible the same usage spike can cause an anomaly in two different monitors in two different accounts, and that would result in two anomalies, with one anomaly showing in each account.

Q: What is a root cause?

A root cause is our best estimate to the largest contributing factor to an anomaly’s total cost impact. The root cause does not explain the total anomaly impact, but only the impact from the largest contributing factor.

Q: Why do I have an empty or incomplete root cause?

We are not always able to identify a single large contributing factor for each anomaly. In the event that there is no clear root cause for the anomaly, we recommend you use the Cost Explorer service in order to view all of the contributing factors.

Q: Why is the root cause impact very small compared to the total cost impact of the anomaly?

For the anomalies detected, we report up to two root causes, and these are our best estimate to the largest contributing factors to the anomaly. Since we use machine learning models to select a maximum of two possible root causes, in cases where there are multiple small contributors adding up to the total impact, the root cause explains only a small portion of the total impact.

Q: How often does Cost Anomaly Detection run?

AWS Cost Anomaly Detection runs approximately three times a day after your billing data is processed.

Q: What is the delay between anomalous usage and when the anomaly gets detected?

Anomaly detection relies on the data from Cost Explorer which has a latency of up to 24 hours. Therefore it can take up to 24 hours to detect an anomaly after the anomalous usage happens.

Q: What is the delay between creating a monitor and when it can first detect an anomaly?

If you have created a new monitor, it can take 24 hours to start detecting new anomalies.

Q: How much historical data is required for a monitor to detect anomalies?

Any monitor requires at least 10 days of historical usage data for anomalies to be detected. For example, for a services monitor, anomalies for the spending on a new service will not be detected until there is 10 days of spend data. 

Ready to get started?

Get started today

Receive cost anomaly alerts and root cause analysis through machine learning.

Check it out »

Learn how it works

Discover how AWS Cost Anomaly Detection can help you detect unusual spend.

Explore the user guide »

Dive deeper

Get started with AWS Cost Anomaly Detection with our how-to tutorials.

Get Started »