FAQs

Q: What is Amazon Cost Anomaly Detection and how does it work?

Cost Anomaly Detection helps you detect and alert on any abnormal or sudden spend increases in your Amazon Web Services account. This is possible by using machine learning to understand your spend patterns and trigger alert as they seem abnormal.

Learn more about Cost Anomaly Detection from the product page, and the user guide. To learn more about programmatic capabilities, read the Amazon Cost Explorer API documentation.

Q: How can I customize monitors to evaluate for anomalies?

Cost Anomaly Detection allows you to segment your spend by different dimensions (Amazon Web Services services, Member Accounts , Cost Allocation Tags, and Cost Categories). This segmentation allows Anomaly Detection to detect more granular anomalies and customize alerting preferences.

Q: How many monitors can be attached to each alert subscription?

Cost Anomaly Detection allows you to create up to 101 monitors. You can attach up to the maximum of all 101 monitors to an alert subscription.

Q: How many recipients can be attached to each alert subscription?

For each alert subscription, you can have up to 10 email recipients or 1 SNS topic.  

Q: How does the alerting threshold work?

The alerting threshold is used to determine when an alert is sent for an anomaly. It does not impact the anomaly detection algorithms in any way. If an anomaly’s total cost impact meets or exceeds the alerting threshold on a subscription, an alert will be sent for the anomaly to the customer. If an anomaly’s total cost impact is below the alerting threshold, it will still be available on the console, but no alert will be sent.

Q: How does a member account monitor work?

A member account monitor can track up to 10 different member accounts. A member account monitor tracks spending aggregated across all of the designated member accounts. For example, if a member account monitor tracks Account A and Account B, if Account A’s usage spikes but Account B’s usage dips the same amount, there will be no anomaly detected because it is a net neutral change.

Q: What is the difference between a member account monitor in a management account, and a services monitor in a member account?

A member account monitor in a management account will monitor the spend of all services in aggregate for the member account. A services monitor in a member account will monitor all services for the member account individually. For example, if there is a spike in S3 spending, but a dip in EC2 spending of the same amount (net neutral change), the member account monitor in the management account will not detect this because it is monitoring the account spend in aggregate across all services. However, the services monitor in the member account would detect the S3 spike since it is monitoring each service spend individually.  

Q: If I create a monitor in a member account and in a management account, will I have the same anomaly show up twice? 

Anomalies only appear in the account that created the monitor which detected the anomaly. It is possible the same usage spike can cause an anomaly in two different monitors in two different accounts, and that would result in two anomalies, with one anomaly showing in each account. 

Q: What is a root cause?

A root cause is our best estimate to the largest contributing factor to an anomaly’s total cost impact. The root cause does not explain the total anomaly impact, but only the impact from the largest contributing factor. 

Q: Why do I have an empty or incomplete root cause?

We are not always able to identify a single large contributing factor for each anomaly. In the event that there is no clear root cause for the anomaly, we recommend you use the Cost Explorer service in order to view all of the contributing factors. 

Q: Why is the root cause impact very small compared to the total cost impact of the anomaly?

For the anomalies detected, we report up to two root causes, and these are our best estimate to the largest contributing factors to the anomaly. Since we use machine learning models to select a maximum of two possible root causes, in cases where there are multiple small contributors adding up to the total impact, the root cause explains only a small portion of the total impact.

Q: How often does Cost Anomaly Detection run?

Amazon Cost Anomaly Detection runs approximately three times a day after your billing data is rocessed.

Q: What is the delay between anomalous usage and when the anomaly gets detected?

Anomaly detection relies on the data from Cost Explorer which has a latency of up to 24 hours. Therefore, it can take up to 24 hours to detect an anomaly after the anomalous usage happens.

Q: What is the delay between creating a monitor and when it can first detect an anomaly?

If you have created a new monitor, it can take 24 hours to start detecting new anomalies. 

Q: How much historical data is required for a monitor to detect anomalies?

Any monitor requires at least 10 days of historical usage data for anomalies to be detected. For example, for a services monitor, anomalies for the spending on a new service will not be detected until there is 10 days of spend data.