Cost Explorer, Anomaly Detection and Budgets

By the end of this lesson you will be able to

• Use Cost Explorer like an investigator: granularity, group by, filters, the 13-month history (38 with multi-year data), the 18-month forecast and its range, hourly and resource-level data, and the API in us-east-1.
• Read Savings Plans and Reserved Instance recommendations, utilization and coverage, and size an hourly commitment from the hourly shape of your usage, including the newer Database Savings Plans.
• Explain how Cost Anomaly Detection works (monitors, machine learning baseline, thresholds, alert frequency, root cause, about three runs a day) and when AWS Budgets catches what it misses.
• Rightsize with Compute Optimizer, know its data requirements and its memory blind spot, and use Cost Optimization Hub to rank savings across accounts.
• Allocate cost with activated tags, AWS-generated tags, backfill and cost categories, and pick Data Exports (CUR 2.0, FOCUS) when SQL on line items is needed.
• Answer the exam's “which cost tool?” questions by keyword, and say why each near-miss loses.

#One bill, many questions

A company's AWS bill is one number at the end of the month. The questions behind it are many: where did the money go? where is it going? is something wrong right now? are we paying too much for what we run? who should pay for what? AWS has a separate tool for each question, and the exam tests exactly that: it describes a need in a sentence and offers four tools that all sound related.

You met the first versions of these tools in lesson 1.4: Budgets (alerts on actual and forecasted spend, budget actions), Cost Explorer (charts and a forecast, no alerts), Cost Anomaly Detection (machine learning on spend), CloudWatch billing alarms (us-east-1), the Cost and Usage Report and cost allocation tags. In lesson 4.4 you learned how Reserved Instances and Savings Plans are billed. This lesson does not repeat that. It goes to the depth an architect needs: how to investigate, how to size a commitment, how the anomaly model behaves, how to rightsize, and how to split a bill.

All of these live in the Billing and Cost Management console, and they are all fed by the same billing data, which AWS refreshes at least once a day and usually several times. None of them watches your resources in real time.

#Cost Explorer: from total to culprit

Cost Explorer is a free console tool for visualising, understanding and managing costs and usage over time. You turn it on once (it then cannot be turned off); the current month's data appears within about a day and the history a few days later. In an organization, the management account sees every member account (consolidated billing, lesson 20.1); a member account sees its own costs unless the management account restricts it.

#Granularity, group by and filters

Three controls do almost all the work:

• Granularity: monthly or daily by default. Hourly is an opt-in (below).
• Group by one dimension at a time: service, linked account, Region, Availability Zone, instance type, usage type, API operation, purchase option (On-Demand, Spot, Savings Plans…), charge type, cost allocation tag, cost category and more. Group by splits each bar into coloured parts.
• Filters to include or exclude values of any of those dimensions, combined freely: “EC2, in ap-south-1, last month”.

An investigation is a sequence of these: group by service, see which one jumped; filter to it and group by Region; filter to the Region and group by usage type. The usage type names the exact thing billed, such as APS3-BoxUsage:g5.2xlarge (APS3 is Mumbai's prefix, BoxUsage is instance hours, g5.2xlarge the type). You can save any view as a report and download it as a CSV file. AWS also provides ready-made reports: monthly cost by service, by linked account, daily costs, and the RI and Savings Plans utilization and coverage reports.

Two cost views matter for precise answers: unblended cost is what each line was charged; amortized cost spreads upfront payments for RIs and Savings Plans over the term, so a month with a big upfront purchase does not look like a disaster.

#How far back, how far ahead

The forecast horizon was 12 months until November 2025, when AWS extended it to 18 months and began training the forecasts on up to 36 months of history to catch seasonal patterns. Many study notes and older practice questions still say 12; both numbers describe the same feature.

#Recommendations and reports

Cost Explorer (and the Billing and Cost Management console around it) also recommends:

• Savings Plans and Reserved Instances purchases from your recent usage (next section).
• Rightsizing for EC2: idle instances to stop and over-sized ones to shrink, within or across instance families. Behind the scenes these use the same engine as Compute Optimizer, which covers far more resource types.

#The Cost Explorer API

Everything in the console is also in the Cost Explorer API (aws ce …): get-cost-and-usage, get-cost-forecast, get-savings-plans-purchase-recommendation, the anomaly operations and more. Two details are exam-worthy:

• The console is free; each API request costs 0.01 USD (each page of a paginated answer counts). A dashboard that calls it every minute costs about 430 USD a month.
• The API has one endpoint, in us-east-1 (ce.us-east-1.amazonaws.com), whatever Region your resources are in, just like the billing metrics in CloudWatch.

#Savings Plans: from recommendation to purchase

From lesson 4.4: a Savings Plan is a commitment to spend a fixed amount of US dollars per hour (at Savings Plan rates) for 1 or 3 years. Every hour, AWS applies the discounted rates to eligible usage, highest discount first, until that hour's commitment is used up; usage above it is billed On-Demand; commitment not used in that hour is lost. Payment: No, Partial or All Upfront.

#How the recommendation is made

On the Savings Plans → Recommendations page (or get-savings-plans-purchase-recommendation), you choose:

• the plan type (Compute, EC2 Instance, SageMaker AI, Database);
• the term (1 or 3 years) and payment option;
• the lookback period: the last 7, 30 or 60 days of usage the calculation is based on;
• the scope: the whole organization (from the management account) or one account.

AWS then simulates your recent usage hour by hour and recommends the hourly commitment that maximises your net saving, with the estimated monthly On-Demand spend, the spend with the plan and the saving. The Purchase Analyzer lets you test a different commitment before buying. Pick the lookback with care: a 7-day window right after a big sale week will recommend too much.

Recommendations are refreshed from billing data at least once a day, and they account for plans you already own: after you buy one, the next recommendation shrinks. A plan cannot be cancelled or resold; only a plan with a commitment of 100 USD an hour or less, bought in the last 7 days and in the same calendar month, can be returned (up to 10 returns a year per management account).

#Utilization and coverage

Two reports tell you whether the commitment fits:

• Utilization: how much of the commitment you used. Below 100% means you paid for nothing in some hours. (A Budgets Savings Plans utilization budget can alert on it, lesson 1.4.)
• Coverage: how much of your eligible spend the plan covered. Low coverage with 100% utilization means you could commit more.

#Sizing to the hourly shape

Because the plan is settled hour by hour, the right commitment depends on the hourly shape of your usage, not the monthly total. Commit to the floor that runs all the time; let the peaks run On-Demand or, if they can be interrupted, on Spot. Daily views hide nightly batches; the hourly view (Cost Explorer's opt-in, or Data Exports) shows them. In an organization, the plan's discount is shared with every account in the consolidated bill unless you turn sharing off for the buying account.

Try the calculator: choose a usage pattern (office hours Sunday to Thursday is the Bangladesh work week) and move the commitment. Watch the waste appear the moment you commit above the floor.

#Cost Anomaly Detection: “this is not like you”

Lesson 1.4 introduced it: Cost Anomaly Detection uses machine learning to learn your normal spend and alerts when spend breaks the pattern. You do not define a threshold for what is unusual; the model decides, taking weekly and monthly seasonality and natural growth into account. It is free. Here is how it really works.

#Monitors: what to watch

A cost monitor defines which spend is evaluated. There are four dimensions:

A monitor is either AWS managed (tracks all values of the dimension independently, up to 5,000, and picks up new accounts, tags or categories automatically) or customer managed (you choose up to 10 accounts or tag values, or one cost category value, and they are evaluated together). Monitors for linked accounts, tags and cost categories are created in the management account. When you enable Cost Explorer, AWS creates a default AWS-services monitor with a daily summary for you.

#Alert subscriptions: who hears, and when

Each monitor has one or more alert subscriptions:

• Frequency: individual alerts, sent as soon as an anomaly is detected, through an SNS topic (and from there to email, chat through Amazon Q Developer in chat applications, Lambda, a ticketing system); or a daily summary or weekly summary by email. Anomalies also arrive as EventBridge events.
• Threshold: an absolute dollar impact (for example 100 USD) and/or a percentage impact over the expected spend (for example 40%), combined with AND or OR. The threshold only filters alerts; every anomaly the model detects still appears on the Detected anomalies page.

Each anomaly comes with its cost impact (actual minus expected spend), the impact percentage, a severity, and the root cause ranked by dollar impact across four dimensions: service, account, Region and usage type. You can mark an anomaly “accurate” or “not an issue” to train the model.

#How fast is “immediately”?

Not immediately. Cost Anomaly Detection runs about three times a day, after billing data is processed, on net unblended cost. Because the underlying data can lag up to 24 hours, an anomaly can take up to a day to be detected; a new monitor needs 24 hours to start; and for a service you have just started using, the model needs about 10 days of history first. It also does not watch most AWS Marketplace charges (use Budgets for those).

#Anomaly Detection or Budgets?

Run both. The animation shows all three cases: a spike inside the budget, slow growth, and a weekly rhythm that a fixed rule would mistake for an anomaly.

#Compute Optimizer and Cost Optimization Hub

Savings Plans lower the price of what you run. Rightsizing lowers how much you run. AWS Compute Optimizer analyses the configuration and CloudWatch utilization metrics of your resources and recommends better sizes, finding each resource under-provisioned, over-provisioned or optimized, and flagging idle ones. It is opt-in, works across Regions and, from the management account, across the organization. It recommends only; it never changes a resource.

What it covers (2026): EC2 instances, EC2 Auto Scaling groups, EBS volumes, Lambda functions (memory size), ECS services on Fargate (task CPU and memory), RDS and Aurora databases (MySQL, PostgreSQL, Aurora), commercial software licences (SQL Server on EC2), and idle or rightsizing findings for NAT gateways, DynamoDB, ElastiCache, MemoryDB, DocumentDB, WorkSpaces and SageMaker endpoints. The exam usually names the first five.

What it needs:

• 14 days of metrics by default; an EC2 instance needs at least 30 hours of data in that window; a Lambda function at least 50 invocations in 14 days (and memory up to 1,792 MB); ECS on Fargate 24 hours and no step scaling or CPU-and-memory target tracking.
• Memory: EC2 does not report memory to CloudWatch by itself, because memory lives inside the operating system. Install the CloudWatch agent (Systems Manager can push it to the fleet, lesson 25.3) so recommendations account for memory; otherwise a memory-hungry server may be told to shrink.
• Enhanced infrastructure metrics, a paid preference, extend the lookback to 93 days, so monthly and quarterly peaks are seen. You can also set CPU and memory headroom and preferred instance families (for example Graviton), and ingest memory metrics from Datadog or Dynatrace.
• Cost Explorer enabled, so savings can be priced.

Cost Optimization Hub (2023, free) sits on top: it collects rightsizing and idle findings from Compute Optimizer plus Savings Plans and reservation recommendations across all accounts and Regions, prices them with your own discounts, de-duplicates overlapping savings (rightsizing first makes the needed Savings Plan smaller), and ranks them, with a cost-efficiency metric to track progress. It is the answer to “one prioritised view of savings across the organization”.

AWS Trusted Advisor also has cost checks (idle load balancers, unattached Elastic IPs, low-utilization instances…). It belongs to the Well-Architected picture in lesson 26.1; for rightsizing questions with utilization metrics, the answer is Compute Optimizer.

#Splitting and exporting the bill

#Cost allocation tags, in depth

Recap from 1.4: tag resources (dept=cse), activate the tag key in Billing and Cost Management → Cost allocation tags, then group and filter by it. The details an architect needs:

• User-defined tags are yours; AWS-generated tags are added by AWS, such as aws:createdBy (who created the resource) and aws:cloudformation:stack-name. Both must be activated to appear in billing. The awsApplication tag, which AWS adds to the resources of an application you register in myApplications, is activated automatically.
• In an organization, only the management account activates tags, for everyone.
• A new tag key can take up to 24 hours to appear on the page, and up to 24 hours more to activate.
• Activation is not retroactive by itself: costs before activation show No tag key. Since March 2024 the management account can request a backfill of up to 12 months (one request per 24 hours), which works only for months in which the resources already carried the tag.
• Some costs can never carry your tag: support fees, much of data transfer, shared networking. Cost categories group costs by rules (accounts, tags, services) into business dimensions, and split charge rules spread shared costs across them by a ratio, evenly or by usage.
• Enforce tagging up front: tag policies in Organizations standardise keys and values, an SCP can deny ec2:RunInstances without aws:RequestTag/dept (lesson 20.1), and IaC can apply default tags.

#Data Exports: CUR 2.0 and FOCUS

When a question needs every line item (per resource, per hour), SQL, or loading cost data into a data warehouse, the answer is AWS Data Exports, which replaced the old Cost and Usage Report setup:

• CUR 2.0: the recommended detailed export, with a fixed schema and the columns you choose (including tags and resource IDs), delivered to an S3 bucket as Parquet or CSV, refreshed at least daily. Query it with Athena (lesson 17.1) or load it into Redshift.
• FOCUS (1.0 and 1.2 with AWS columns): the same data in the open FinOps cost format, so the same queries work across clouds.
• Cost optimization recommendations (from Cost Optimization Hub) and carbon emissions as exports too.
• A cost and usage dashboard: one click deploys a QuickSight dashboard on the export (lesson 17.5).
• The legacy CUR still exists for old pipelines.

#Two more tools, one line each

• AWS Pricing Calculator: estimate the cost of something you have not built yet. The public version at calculator.aws needs no account; the version inside the Billing console (generally available since mid-2025) can apply your own discounts and Savings Plans and model changes to your whole bill.
• AWS Billing Conductor: create pro forma bills with your own rates for groups of accounts, for resellers and internal chargeback, without changing what AWS actually charges you.

#Which cost tool for which question?

This extends the table from 1.4.

#What goes wrong

• “Cost Explorer will warn us.” It never alerts. Pair it with a budget and an anomaly monitor.
• The forecast is missing or wild: new accounts have too little history; forecasts also cannot know about a migration next month. Budgets' forecasted alerts need about five weeks of history (lesson 1.4).
• The bill spiked yesterday and nothing fired: billing data lags hours; Anomaly Detection runs about three times a day. Real-time protection comes from limits and guardrails (SCPs denying unused Regions, IAM), not from cost tools.
• An anomaly was detected but nobody heard: below the subscription's threshold, or the subscription is a weekly summary. Use individual alerts through SNS for urgent monitors and an OR threshold with a percentage.
• No anomalies on a brand-new service: the model needs about 10 days of history for it. Cover the gap with a budget.
• Over-committed Savings Plan: utilization below 100% every night. It cannot be cancelled; let it run, buy nothing more, and size the next one to the floor. A plan bought by mistake can be returned within 7 days only if it is 100 USD an hour or less and in the same calendar month.
• EC2 Instance Savings Plan stopped saving after a migration: the workload changed family (to Graviton) or Region. A Compute Savings Plan would have followed.
• Rightsizing broke an application: memory was not measured. Install the CloudWatch agent before acting, and test.
• Rightsizing missed the month-end peak: the 14-day window did not include it. Enhanced infrastructure metrics (93 days) or a CPU headroom preference.
• Tags show “No tag key”: the key was never activated, was activated in a member account instead of the management account, or the costs predate activation (request a backfill). Shared costs never carry a tag: use cost categories with split charges.
• Cost Explorer API bill: a dashboard polling every minute. Cache the answers, or use Data Exports for bulk data.
• API call fails from another Region's endpoint: the Cost Explorer API lives in us-east-1.

#Cost tools in system design

• Make cost visible from day one: in a landing zone, activate the standard tag keys and a cost category per business unit from the management account, set a Data Exports CUR 2.0 export to an S3 bucket in a dedicated billing account, and give each team a budget.
• Layer the alarms: Budgets (forecasted and actual) for plans, Anomaly Detection (AWS managed monitors per account or per team tag) for surprises, SNS to a chat channel and to a Lambda function or EventBridge rule that opens a ticket. Budget actions for hard stops in sandbox accounts.
• Optimise in order: first remove waste (idle resources, Instance Scheduler for dev/test, storage lifecycle), then rightsize (Compute Optimizer), then commit (Savings Plans on what is left, sized to the hourly floor), then architect (Spot for interruptible work, Graviton, serverless). Commit last, or you commit to waste.
• Measure unit cost: cost per order, per active user or per transaction, from tags or the export joined with business data, is the KPI that shows whether growth is healthy. A bill that doubles with traffic that triples is good news.
• FinOps reviews: a monthly look at Cost Optimization Hub, Savings Plans utilization and coverage, and the anomaly history, with owners for each finding. The Cost Optimization pillar of the Well-Architected Framework (lesson 26.1) frames this.

#Try it yourself

These commands use the AWS CLI v2. Cost Explorer API calls cost 0.01 USD each and always go to us-east-1; budgets, anomaly monitors and Compute Optimizer are free (enhanced metrics are not). Account IDs and ARNs are made up.

# 1. Last three months by service (the console's "group by Service")
aws ce get-cost-and-usage --region us-east-1 \
  --time-period Start=2026-08-01,End=2026-11-01 --granularity MONTHLY \
  --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE \
  --query 'ResultsByTime[].Groups[?to_number(Metrics.UnblendedCost.Amount)>`100`].[Keys[0],Metrics.UnblendedCost.Amount]' --output text
# Amazon Elastic Compute Cloud - Compute   650.12
# Amazon Relational Database Service       340.07
# Amazon Elastic Compute Cloud - Compute   1871.40
# Amazon Relational Database Service       339.88

# 2. Drill down: EC2 only, by Region, then by usage type
aws ce get-cost-and-usage --region us-east-1 \
  --time-period Start=2026-10-01,End=2026-11-01 --granularity MONTHLY --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Elastic Compute Cloud - Compute"]}}' \
  --group-by Type=DIMENSION,Key=REGION
# ... ap-southeast-1 650.31   ap-south-1 1221.09
aws ce get-cost-and-usage --region us-east-1 \
  --time-period Start=2026-10-01,End=2026-11-01 --granularity DAILY --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"REGION","Values":["ap-south-1"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE
# ... APS3-BoxUsage:g5.2xlarge   46.97 (every day from 2026-10-06)

# 3. Forecast the next three months, with an 80% prediction interval
aws ce get-cost-forecast --region us-east-1 \
  --time-period Start=2026-11-01,End=2027-02-01 --granularity MONTHLY \
  --metric UNBLENDED_COST --prediction-interval-level 80
# { "Total": { "Amount": "3712.4", "Unit": "USD" },
#   "ForecastResultsByTime": [ { "MeanValue": "1230.1", "PredictionIntervalLowerBound": "1151.0", "PredictionIntervalUpperBound": "1309.2" }, ... ] }

# 4. What Compute Savings Plan should we buy? (1 year, no upfront, last 30 days)
aws ce get-savings-plans-purchase-recommendation --region us-east-1 \
  --savings-plans-type COMPUTE_SP --term-in-years ONE_YEAR \
  --payment-option NO_UPFRONT --lookback-period-in-days THIRTY_DAYS \
  --query 'SavingsPlansPurchaseRecommendation.SavingsPlansPurchaseRecommendationSummary.[HourlyCommitmentToPurchase,EstimatedSavingsPercentage,EstimatedMonthlySavingsAmount]'
# [ "4.102", "23.41", "873.55" ]

# 5. How well do our plans fit? Coverage and utilization for last month
aws ce get-savings-plans-coverage --region us-east-1 \
  --time-period Start=2026-10-01,End=2026-11-01 --granularity MONTHLY \
  --query 'SavingsPlansCoverages[].Coverage.CoveragePercentage'
# [ "71.8" ]
aws ce get-savings-plans-utilization --region us-east-1 \
  --time-period Start=2026-10-01,End=2026-11-01 \
  --query 'Total.Utilization.UtilizationPercentage'
# "100"

# 6. EC2 rightsizing from Cost Explorer (Compute Optimizer gives more detail, step 9)
aws ce get-rightsizing-recommendation --region us-east-1 --service AmazonEC2 \
  --configuration RecommendationTarget=CROSS_INSTANCE_FAMILY,BenefitsConsidered=true \
  --query 'RightsizingRecommendations[].[CurrentInstance.ResourceId,RightsizingType]' --output text
# i-0aa11bb22cc33dd44   TERMINATE
# i-0ee55ff66aa77bb88   MODIFY

# 7. An AWS managed anomaly monitor for every linked account, and an SNS alert subscription
aws ce create-anomaly-monitor --region us-east-1 --anomaly-monitor '{
  "MonitorName": "per-account", "MonitorType": "DIMENSIONAL", "MonitorDimension": "LINKED_ACCOUNT" }'
# { "MonitorArn": "arn:aws:ce::111122223333:anomalymonitor/0a1b2c3d-EXAMPLE" }
aws ce create-anomaly-subscription --region us-east-1 --anomaly-subscription '{
  "SubscriptionName": "security-team", "Frequency": "IMMEDIATE",
  "MonitorArnList": ["arn:aws:ce::111122223333:anomalymonitor/0a1b2c3d-EXAMPLE"],
  "Subscribers": [{ "Type": "SNS", "Address": "arn:aws:sns:us-east-1:111122223333:cost-alerts" }],
  "ThresholdExpression": { "Or": [
    { "Dimensions": { "Key": "ANOMALY_TOTAL_IMPACT_ABSOLUTE", "MatchOptions": ["GREATER_THAN_OR_EQUAL"], "Values": ["100"] } },
    { "Dimensions": { "Key": "ANOMALY_TOTAL_IMPACT_PERCENTAGE", "MatchOptions": ["GREATER_THAN_OR_EQUAL"], "Values": ["40"] } } ] } }'

# 8. Anomalies found last week, with their root cause
aws ce get-anomalies --region us-east-1 --date-interval StartDate=2026-10-25,EndDate=2026-11-01 \
  --query 'Anomalies[].[AnomalyStartDate,Impact.TotalImpact,RootCauses[0].Service,RootCauses[0].Region]' --output text
# 2026-10-12   352.0   Amazon Elastic Compute Cloud - Compute   us-west-2

# 9. Compute Optimizer: opt in once, then read EC2 findings
aws compute-optimizer update-enrollment-status --status Active --include-member-accounts
aws compute-optimizer get-ec2-instance-recommendations --region ap-southeast-1 \
  --query 'instanceRecommendations[].[instanceArn,finding,currentInstanceType,recommendationOptions[0].instanceType]' --output text
# arn:aws:ec2:ap-southeast-1:111122223333:instance/i-0ee55ff66aa77bb88  Overprovisioned  r6i.xlarge  r6i.large

# 10. A monthly cost budget with a forecasted alert (details in lesson 1.4)
aws budgets create-budget --account-id 111122223333 \
  --budget '{"BudgetName":"monthly-2000","BudgetLimit":{"Amount":"2000","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \
  --notifications-with-subscribers '[{"Notification":{"NotificationType":"FORECASTED","ComparisonOperator":"GREATER_THAN","Threshold":100,"ThresholdType":"PERCENTAGE"},"Subscribers":[{"SubscriptionType":"EMAIL","Address":"finance@example.com"}]}]'

# 11. Activate cost allocation tags (from the management account) and backfill
aws ce update-cost-allocation-tags-status --region us-east-1 \
  --cost-allocation-tags-status TagKey=dept,Status=Active TagKey=aws:createdBy,Status=Active
aws ce start-cost-allocation-tag-backfill --region us-east-1 --backfill-from 2026-05-01T00:00:00Z
aws ce list-cost-allocation-tags --region us-east-1 --status Active --query 'CostAllocationTags[].[TagKey,Type]' --output text
# dept            UserDefined
# aws:createdBy   AWSGenerated

Delete the monitor and subscription with delete-anomaly-monitor and delete-anomaly-subscription, and the budget with aws budgets delete-budget if you only tried them out.

#Summary

Key takeaways

• Cost Explorer = look back and look ahead: monthly/daily (hourly and resource level opt-in, last 14 days), group by and filter on service, account, Region, usage type, tag; 13 months of history (38 with multi-year data), 18-month forecast with a range (12 until November 2025); RI/Savings Plans recommendations, utilization and coverage; EC2 rightsizing. Never alerts. API: 0.01 USD per request, endpoint in us-east-1.
• Savings Plans: $/hour for 1 or 3 years, settled hour by hour (unused is lost, excess is On-Demand). Compute (EC2 anywhere + Fargate + Lambda), EC2 Instance (one family, one Region, biggest discount), SageMaker AI, Database (Dec 2025, 1 year). Cost Explorer recommends (lookback 7/30/60 days); you buy in Billing and Cost Management. Commit to the hourly floor. Convertible RIs can change family; no RI changes Region or covers Fargate/Lambda.
• Cost Anomaly Detection: machine learning baseline, no threshold for “unusual”; monitors by service, account, cost category or tag (AWS managed or customer managed); alerts individually via SNS or daily/weekly email summaries, filtered by $ and/or % impact; root cause by service, account, Region, usage type; runs about three times a day, up to 24 hours behind. Catches spikes inside the budget; misses slow drift.
• Budgets catches slow drift with forecasted alerts and can act; it misses spikes inside the line. Run both.
• Compute Optimizer: rightsizing and idle findings from 14 days of CloudWatch metrics (93 with paid enhanced metrics) for EC2, ASGs, EBS, Lambda, ECS on Fargate, RDS/Aurora and more; memory needs the CloudWatch agent. Cost Optimization Hub ranks and de-duplicates savings across accounts.
• Cost allocation tags must be activated (management account, up to 24 + 24 hours), not retroactive except by backfill (up to 12 months); AWS-generated tags like aws:createdBy; cost categories and split charges for shared costs.
• Data Exports: CUR 2.0 or FOCUS line items to S3, Athena or QuickSight. Pricing Calculator for what does not exist yet; Billing Conductor for pro forma rates.

Self-check: cost tools30 questions