Is AWS Cost Anomaly Detection free?

Yes. AWS Cost Anomaly Detection is a free feature of AWS Cost Management. It uses machine learning to model your normal spend per monitored dimension and alerts you when actual cost deviates significantly. You only pay for the underlying AWS usage, not for the monitoring.

How quickly does it detect a cost spike?

Usually within about 24 hours of the spike, because AWS billing data itself has a processing delay. It is not real-time, but it is far faster than discovering a spike on next month's invoice. For hard ceilings you want sooner, pair it with AWS Budgets alerts.

Can it monitor every account in an Organization?

Yes. From the management (payer) account you can create monitors that cover member accounts — for example a 'linked account' monitor that watches each account separately, or a service monitor across the Organization. This gives central visibility while still attributing each anomaly to the account that caused it.

AWS · Cost governance · Updated June 2026

AWS Cost Anomaly Detection: Catch Spend Spikes Early

By the CloudFinOpsKit team — building the AWS tool's trends & anomaly band. 8 min read.

A cost spike caught on day 2 costs you two days. The same spike found on next month's invoice costs you thirty. AWS Cost Anomaly Detection is a free, machine-learning feature of AWS Cost Management that closes that gap — it learns your normal spend pattern per service/account and alerts you when reality diverges. It's one of the highest-leverage things you can switch on, and most teams haven't.

Set up a monitor (5 minutes)

In the console: Billing and Cost Management → Cost Anomaly Detection. Create a monitor — the thing being watched. The most useful types:

AWS services — monitors every service separately (recommended default; catches a spike in one service even if the total looks normal).
Linked account — one signal per member account, ideal in an Organization.
Cost category / cost allocation tag — watch a team, product or environment you've tagged.

Then attach an alert subscription: who gets told, how often (individual alerts, or a daily/weekly summary), and the threshold that triggers it. From the CLI:

# 1) a monitor that watches each AWS service
aws ce create-anomaly-monitor --anomaly-monitor \
  '{"MonitorName":"svc-monitor","MonitorType":"DIMENSIONAL","MonitorDimension":"SERVICE"}'

# 2) alert me when an anomaly's impact is over $100
aws ce create-anomaly-subscription --anomaly-subscription \
  '{"SubscriptionName":"cost-alerts","Frequency":"DAILY",
    "MonitorArnList":["<monitor-arn>"],
    "Subscribers":[{"Type":"EMAIL","Address":"finops@example.com"}],
    "ThresholdExpression":{"Dimensions":{"Key":"ANOMALY_TOTAL_IMPACT_ABSOLUTE",
      "Values":["100"],"MatchOptions":["GREATER_THAN_OR_EQUAL"]}}}'

# review what it has found
aws ce get-anomalies --date-interval StartDate=2026-06-01,EndDate=2026-06-30

Pick a threshold you can explain

The fastest way to make anomaly alerts useless is to make them noisy. Set a threshold that maps to "worth a human looking" — an absolute dollar impact (e.g. ≥ $100) and/or a percentage deviation (e.g. ≥ 40%). Use a daily summary for most teams and reserve individual immediate alerts for large monitors. The goal is one credible alert you act on, not ten you mute.

Read the root-cause hints

Each detected anomaly comes with AWS's best guess at the driver — the service, linked account, Region and usage type involved, plus the expected vs. actual spend and total impact. That usually points you straight at the cause without spelunking through Cost Explorer.

The usual suspects behind a spike

Data transfer / egress — a new cross-Region or internet path, a chatty NAT gateway, a CDN misconfiguration.
A forgotten environment — a load test or dev stack left running, a big instance launched "just to try".
Storage & requests — an S3 request surge, a runaway logging pipeline, snapshot sprawl.
A runaway job — an unbounded batch run or an AI/Bedrock workload looping on expensive tokens.
A commitment expiry — an RI or Savings Plan lapsed and usage fell back to on-demand. (Easy to miss; it looks like a "spike" but it's a coverage gap.)

It's reactive — pair it with two proactive habits

Anomaly detection tells you after something jumps. Wrap it with:

AWS Budgets for hard ceilings and forecasted-overspend alerts — your guardrail with a number on it.
A monthly cost review for the slow creep anomaly detection won't flag — a 5% month-on-month rise never trips an alert but compounds into a big number over a year.

Get the anomaly view in your assessment too. The CloudFinOpsKit AWS Tool includes a Trends & Forecast band: run it monthly and it tracks your spend and savings over time, flags any month that moved more than 20% versus the prior month, and forecasts next month — and its governance module checks whether you actually have budgets and anomaly alerting configured. Read-only, alongside 75+ Well-Architected cost checks.

Go deeper than the native service (with math you can audit)

AWS Cost Anomaly Detection is a solid free baseline, but it's a black box: you can't see why it flagged (or didn't flag) a day, it needs ~10 days to learn, and it's weakest on gradual creep — a workload ramping 3% a day rarely trips it. The CloudFinOpsKit AWS Tool now ships a dedicated Cost Anomaly Watch module built on deterministic robust statistics, so every flag can be recomputed by hand.

Each run pulls ~3 months of daily cost per service from Cost Explorer (usage record types only, so an RI fee or a credit never fakes a spike; the trailing two unfinalized days are excluded) and runs eight detectors: same-weekday spike detection (median + MAD, modified z-score ≥ 3.5), 7-vs-21-day step changes, Theil–Sen slow creep, new spend sources (the compromised-key detector), vanished spend, and three Bedrock-specific detectors — token spikes, output-token bloat, and blended $/1K-token rate shifts that catch a quiet switch to a pricier model.

Every anomaly comes with expected vs actual figures, projected monthly impact, the top usage types on the anomaly day, and a plausible-cause hint. Schedule it daily with a Teams or Slack webhook and High-severity anomalies message your channel automatically — thresholds you control, on both AWS and Azure with one consistent methodology. Keep the native monitor enabled too; they complement each other.

FAQ

Does it cost anything?

No — Cost Anomaly Detection is free; you only pay for the AWS usage it watches.

How fast are alerts?

Typically within ~24 hours, limited by AWS billing-data latency. For instant ceilings, add AWS Budgets.

Where do alerts go?

Email or an Amazon SNS topic (so you can fan out to Slack, PagerDuty, a Lambda, etc.).