Level 200: Cost Anomaly Detection


  • Bilal Shuja, Technical Account Manager.
  • Jerry Chen, Solutions Architect, AWS Well-Architected.


  • Jang Whan Han, Solutions Architect, AWS Well-Architected.
  • Ben Mergen, Sr Cost Lead SA WA.


If you wish to provide feedback on this lab, there is an error, or you want to make a suggestion, please email: costoptimization@amazon.com

Well-Architected Best Practices

This lab helps you to exercise the following Well-Architected Best Practices:


With AWS Cost Anomaly Detection, reduce cost surprises and enhance control without slowing innovation. This hands-on lab will guide you through the steps to configure AWS Cost Anomaly Detection in your AWS account. AWS Cost Anomaly Detection is an AWS Cost Management feature that leverages advanced Machine Learning technologies to identify unusual spends by continuously monitoring your cost and usage. Based on selected spend segments, Cost Anomaly Detection automatically determines daily patterns by adjusting for organic growth and seasonal trends. It triggers an alert when spend seems abnormal based on your resource usage pattern. This lab will walk you through the steps to analyze these alerts and investigate the root cause.


  • Setting up anomaly detection by creating monitors and an alert subscription.
  • Analyzing unusual spends detected by Cost Anomaly Detection and investigating the root cause.


Cost Anomaly Detection requires at least 10 days of historical service usage data before anomalies can be detected for that service. Therefore, make sure to use an account that has active resources for the past 10 days. Also, If you create a new monitor, it can take 24 hours to begin detecting new anomalies.

As an alternative, an existing AWS account can be used to run this workshop.

It is strongly advised not to use a production account for this lab but to use a test or sandbox account to understand the functionalities and capabilities of the service. And then replicate the relevant configurations to the production accounts.

  • AWS Cost Anomaly Detection is a feature within Cost Explorer. To access AWS Cost Anomaly Detection, Cost Explorer must be enabled. For instructions on how to enable Cost Explorer using the console, see Enabling Cost Explorer. Customers enabling Cost Explorer on or after March 27, 2023, will automatically have a default configuration of AWS Cost Anomaly Detection that monitors the spend by AWS service, and emails a daily summary report when a cost anomaly above a certain threshold is detected. For more details, refer to New Cost Explorer users now get Cost Anomaly Detection by default.

For a multi-account AWS environment, Cost Anomaly Detection needs to be set up in the management account to analyze cost across the entire AWS Organizations and alert on anomalies for each linked account.

These permissions will allow the IAM user or the role to view your AWS account spend.


AWS Cost Anomaly Detection service is free to use. The only applicable charges are SNS topic subscriptions which will be charged at the SNS rates. Customers that opt for email alerts have no associated costs.