How to Set Up AWS Budget Alerts from the AWS CLI

An AWS Budgets alert is a notification, not a brake. It tells you that spend has crossed, or is forecast to cross, a line you set. This guide builds a monthly cost budget for one account with two alerts (80% of actual spend and 100% of forecasted spend) using aws budgets create-budget, then routes one of them through Amazon SNS.

What you need first

• AWS CLI v2 configured for the account that owns the spend. For an organization-wide budget, run it in the management account.
• IAM actions budgets:ModifyBudget and budgets:ViewBudget. AWS’s own example policy for the console also grants aws-portal:ViewBilling, aws-portal:ModifyBilling, CloudWatch and SNS access.
• IAM users and roles only see billing data after the root user has activated IAM access to the Billing and Cost Management console. That is a one-time switch per account.
• Your 12-digit account ID: aws sts get-caller-identity --query Account --output text.

1. Write the budget definition

Save this as budget.json. TimeUnit accepts DAILY, MONTHLY, QUARTERLY, ANNUALLY or CUSTOM; a recurring monthly budget keeps alerting every month without a new end date.

{
  "BudgetName": "acct-monthly-cost",
  "BudgetLimit": { "Amount": "5000", "Unit": "USD" },
  "BudgetType": "COST",
  "TimeUnit": "MONTHLY"
}

2. Define the alerts

Save this as notifications.json. NotificationType is ACTUAL (money already accrued) or FORECASTED (where AWS expects the period to end). Thresholds are percentages of the limit.

[
  {
    "Notification": { "NotificationType": "ACTUAL", "ComparisonOperator": "GREATER_THAN",
                      "Threshold": 80, "ThresholdType": "PERCENTAGE" },
    "Subscribers": [ { "SubscriptionType": "EMAIL", "Address": "finops@example.com" } ]
  },
  {
    "Notification": { "NotificationType": "FORECASTED", "ComparisonOperator": "GREATER_THAN",
                      "Threshold": 100, "ThresholdType": "PERCENTAGE" },
    "Subscribers": [ { "SubscriptionType": "SNS",
                       "Address": "arn:aws:sns:us-east-1:111122223333:budget-alerts" } ]
  }
]

A budget can carry up to five notifications, and each notification one SNS subscriber plus up to 10 email addresses.

3. Create it

aws budgets create-budget \
  --account-id 111122223333 \
  --budget file://budget.json \
  --notifications-with-subscribers file://notifications.json

4. Let Budgets publish to SNS

If you used an SNS subscriber, the topic’s access policy must allow the budgets.amazonaws.com service principal to call SNS:Publish, scoped with aws:SourceAccount and an aws:SourceArn of arn:aws:budgets::ACCOUNT_ID:*. Without that statement the email alert arrives and the SNS one silently does not. Subscribe a chat integration or incident tool to the topic from there.

5. Check that it is live

aws budgets describe-budget --account-id 111122223333 --budget-name acct-monthly-cost
aws budgets describe-notifications-for-budget --account-id 111122223333 --budget-name acct-monthly-cost

The first returns CalculatedSpend with ActualSpend and ForecastedSpend. AWS refreshes budget data up to three times a day, typically 8 to 12 hours apart, so an alert is never same-minute.

Things that catch people out

• Budgets never stop resources on their own. Budget actions can apply an IAM or SCP policy, but AWS warns that stopping an EC2 instance inside an Auto Scaling group just causes the group to replace it.
• The limit is in the budget’s currency and, by default, includes credits, refunds, tax and support. Set CostTypes in budget.json if finance measures something narrower.
• To undo, aws budgets delete-budget --account-id ... --budget-name ... removes the budget and its notifications together.

For thresholds per team rather than per account, see per-team budgets in Azure and the broader cloud budgets guide.

Where ZopNight fits

ZopNight budgets sit alongside the native ones rather than replacing them. A budget can target a cloud account, a single resource, a resource group or a connected AI provider, carries its own alert threshold, and shows green, yellow or red status on the Budgets page. Budget warning and budget exceeded are subscribable notification events, delivered to Slack, Google Chat, Teams or a webhook.