--- name: aws-cost-anomaly-alert description: "Every morning: new AWS cost anomalies with the service, account, region and dollars above expected, and a question about who owns each one. Use when the user asks for this, or when it runs on a schedule." --- # AWS cost anomaly alert Every morning: new AWS cost anomalies with the service, account, region and dollars above expected, and a question about who owns each one. AWS Cost Anomaly Detection is good at spotting spend that does not fit the pattern, and its email alerts go to whoever set it up two years ago. The anomaly then sits in the console with a root cause like "Amazon EC2, us-east-1, account 4471..." and no name attached. The agent reads the anomalies detected since yesterday, translates each root cause into a service, account name and usage type, puts the dollar impact next to the expected spend, and asks you who should look. If you say it was planned, it can record that feedback so the model learns. ## Two ways to get the data Use the API or MCP route when you have an MCP server, a CLI or an API token for the app. Otherwise, if you can drive a browser the user is signed in to (Claude in Chrome, a Playwright or Chrome DevTools MCP server), use the browser route. Say which one you used. ## Route A: API or MCP server ### What you need - AWS credentials (an IAM role or profile) allowed `ce:GetAnomalyMonitors`, `ce:GetAnomalies` and `ce:GetCostAndUsage`, plus `ce:ProvideAnomalyFeedback` if you want feedback recorded. - Or the AWS Billing and Cost Management MCP server (`awslabs.billing-cost-management-mcp-server`), which has a `get_anomalies` tool. If something is missing, say what and stop; do not invent numbers. ### Steps 1. **Check that a monitor exists** (AWS): Run `aws ce get-anomaly-monitors`. With no monitor there are no anomalies to read: stop and say how to create one (Billing and Cost Management > Cost Anomaly Detection), usually an AWS services monitor for the whole account. 2. **Read new anomalies** (AWS): `aws ce get-anomalies --date-interval StartDate=,EndDate= --total-impact NumericOperator=GREATER_THAN,StartValue=50`. The interval matches each anomaly's `AnomalyEndDate`, so ongoing anomalies show up again; skip any with `Feedback` already set to `PLANNED_ACTIVITY`. 3. **Explain each one**: From `RootCauses` take `Service`, `LinkedAccountName`, `Region` and `UsageType`; from `Impact` take `TotalImpact`, `TotalActualSpend`, `TotalExpectedSpend` and `TotalImpactPercentage`; add `AnomalyStartDate`. Write it as one sentence: what got more expensive, where, since when, by how much. 4. **Suggest an owner** (AWS): If you use a cost allocation tag such as `team`, run `aws ce get-cost-and-usage` for the anomaly days, filtered to that service and account and grouped by `Type=TAG,Key=team`. Otherwise use the account name. 5. **Ask**: Post the anomalies and ask who owns each, or whether it was planned. Only after a yes, record it with `aws ce provide-anomaly-feedback --anomaly-id --feedback PLANNED_ACTIVITY` (or `YES` / `NO`). ## Route B: the browser ### What you need - Signed in to the AWS console with IAM access to Billing and Cost Management (Cost Explorer and `ce:GetAnomalies`), usually in the management account; the person completes MFA first. If something is missing, say what and stop; do not invent numbers. ### Steps Start at https://console.aws.amazon.com/costmanagement/home#/anomaly-detection. The user is signed in already; never type passwords or codes, and ask if a sign-in page appears. 1. **Open Cost Anomaly Detection**: The URL opens the **Billing and Cost Management** console on the **Cost Anomaly Detection** page, signed in to the management or payer account. Check the **Cost monitors** tab first: with no monitor there is nothing to read, and the page offers **Create monitor** (an AWS services monitor covers the whole account). 2. **Read the Detection history**: Open the **Detection history** tab, set the date range to the last 2 days and sort by **Total cost impact**. Keep anomalies above `$50` whose assessment is not already **Planned activity**; an anomaly whose last detected date keeps moving is ongoing rather than new. 3. **Explain each anomaly**: Click an anomaly to open its details: the **Root causes** table gives service, linked account, region and usage type, and the summary gives actual spend, expected spend, the dollar impact and percent, and the start date. Write each as one sentence. 4. **Suggest an owner**: Use the **View in Cost Explorer** link on the anomaly, then group by **Tag** `team` (or your cost allocation tag) for the anomaly days to see which team the spend belongs to; otherwise use the account name. 5. **Ask**: List the anomalies and ask who owns each or whether it was planned. Only after a yes, open the anomaly and use **Submit assessment** to mark it as planned activity. Note: The console is the authoritative view and shows the same anomalies as the API, with a one-day lag behind Cost Explorer data. Anomaly history in the console covers the last 90 days. Member accounts only see their own anomalies unless the management account has enabled access. ## The report - **New anomalies** since yesterday, with the total dollar impact. - For each: service, account, region, usage type, actual against expected spend, start date. - **Suggested owner** from your cost allocation tags or account names. - The question: who owns each one, or was it planned. ## Post it to Briefkin When `BRIEFKIN_TOKEN` is set, or `~/.config/briefkin/env` exists (the installer from https://briefkin.dev/docs writes it), also send the result to the user's Briefkin board as one card. Keep the `item_key` the same on every run so the card updates in place, use a new `event_id` per run, and put today's real numbers in place of the example ones. If the request fails, say so once and carry on. ```bash [ -n "${BRIEFKIN_TOKEN:-}" ] || . ~/.config/briefkin/env curl -sS -X POST "${BRIEFKIN_URL:-https://briefkin.dev}/v1/events" \ -H "authorization: Bearer $BRIEFKIN_TOKEN" \ -H "content-type: application/json" \ -d @- <<'JSON' { "v": 1, "event_id": "aws-cost-anomaly-alert/", "item_key": "aws-cost-anomaly-alert", "project": "Acme AWS", "source": "AWS cost anomaly alert skill", "kind": "action", "title": "2 cost anomalies, $412 above expected", "summary": "Since yesterday AWS flagged **2** anomalies worth **$412.40** above expected spend. EC2 in acme-prod is the larger one.", "action": { "request": "Who owns these? If the EC2 jump is the planned load test, I can mark it as planned activity.", "options": [ "EC2 was planned, mark it", "Platform team owns both", "I will check S3 myself", "Leave them open" ] }, "widget": { "type": "Table", "props": { "columns": [ "Service", "Account", "Usage type", "Actual", "Expected", "Impact" ], "align": [ "left", "left", "left", "right", "right", "right" ], "rows": [ [ "Amazon EC2", "acme-prod", "BoxUsage:c7g.4xlarge (us-east-1)", "$598.40", "$310.00", "+$288.40" ], [ "Amazon S3", "acme-data", "DataTransfer-Out-Bytes (eu-west-1)", "$165.20", "$41.20", "+$124.00" ] ] } } } JSON ``` Widgets come from the Briefkin catalog (https://briefkin.dev/v1/catalog). Without a token, just give the user the report. ## Run it on a schedule Suggested: Every day at 9:00 (`0 9 * * *`). From cron, with the agent signed in on that machine: ```bash 0 9 * * * claude -p "Run the aws-cost-anomaly-alert skill" # Codex: codex exec, Gemini CLI: gemini -p, Copilot CLI: copilot -p, OpenCode: opencode run ``` Or use the agent's own scheduler (Claude Code routines, Codex automations, Claude or ChatGPT scheduled tasks): https://briefkin.dev/skills/aws-cost-anomaly-alert#schedule Source: https://briefkin.dev/skills/aws-cost-anomaly-alert