This article is more than 1 year old

No one likes a heart-stopping AWS bill shock so now there's a machine learning tool to help detect cost anomalies

Unexpected item in bagging area?

AWS has introduced Cost Anomaly Detection, a new feature now in beta driven by machine learning that pledges to notify admins of "unexpected or unusual spend".

Bill shock is a problem suffered, on occasion, by small and big AWS customers alike. At the small end, there are cases like that of Chris Short, using AWS for his Content Delivery Network (CDN) to scale his website at a cost of around $23.00 per month. One morning he woke up to a bill of $2,657.68, thanks to sharing a 13.7GB file that proved unexpectedly popular. At the other end, the average organisation is over budget for cloud spend by an average of 23 per cent, as we reported here.

While puzzling out what specific cloud services will cost can be a challenge, the big cloud providers are pretty good at showing you where your money has gone with them individually. AWS has a Cost Management service which includes reports, budgets and recommendations, to which the company is now adding Cost Anomaly Detection.

Creating a Cost Monitor for AWS Anomaly Detection

Creating a Cost Monitor for AWS Anomaly Detection

This is configured by adding a Cost Monitor to an AWS account. There are four types of monitor. The generic AWS Services monitor is fully automated. The Linked Account monitor is specific to other AWS accounts linked to an organisation. A Cost Category monitor evaluates spend for a specific category as labelled by the administrator. Finally, a similar Cost Allocation Tag monitor evaluates spend for services with a specific cost tag.

Money falling from the sky

Why cloud costs get out of control: Too much lift and shift, and pricing that is 'screwy and broken'


Once the type of Cost Monitor is selected, admins set an alert threshold, which is the minimum size of an anomaly that will be notified, the frequency of alerts from as they arise to daily or weekly, and a Simple Notification Service (SNS) through which the alerts are sent. Daily or weekly summaries are sent by email to up to 10 recipients, but admins who opt for individual summaries must go through SNS. This is inexpensive and the first 1,000 emails, or 100 SMS messages, per month are free. Each AWS account can create one AWS Service monitor and up to 101 additional cost monitors.

How good is the anomaly detection? That is the key question and one only customers will be able to answer. The detection engine runs around three times a day and after billing data is processed, which means there is some (potentially expensive) delay. It is driven by a machine learning model, indicating scope for both under and over-reporting, but the service is expected to improve as the model is refined.

People may wonder whether it is really in the interests of AWS to provide a service that helps customers spend less money. It is true that, like every company, the cloud providers are always trying to persuade their users to adopt new services or add premium features. That said, none of the experts we have spoken to think that there is deliberate confusion marketing – where pricing is deliberately complex so that customers spend more than they intend – or that providers like having their users waste money. The counter argument holds more sway, that the providers want satisfied customers. The current high demand for cloud services makes this position an easy one to hold.

Anomaly detection is not the complete answer to overpaying. After all, if an organisation paid more than it needed to last month, it is not an anomaly if it does so again. ®

More about


Send us news

Other stories you might like