How to Set Up AWS Cost Anomaly Detection Alerts

AWS Cost Anomaly Detection uses machine learning models over your Cost Explorer data to flag unusual spend. You configure two things: a monitor (what to watch) and a subscription (who hears about it, how often, above what impact). This guide sets both up with aws ce.

Prerequisites

• AWS CLI v2, run from the management account if you want to watch linked accounts.
• IAM permission to call the Cost Explorer anomaly APIs used below: CreateAnomalyMonitor, CreateAnomalySubscription, GetAnomalyMonitors, GetAnomalySubscriptions and GetAnomalies (plus ce:ProvideAnomalyFeedback if you will mark false positives).
• For immediate alerts, an SNS topic. Daily and weekly summaries go to email; IMMEDIATE frequency is delivered through SNS only.

1. Choose a monitor type

• DIMENSIONAL is an AWS managed monitor. With MonitorDimension set to SERVICE, it tracks up to the top 5,000 values by cost and evaluates each service independently, including services you start using later.
• CUSTOM monitors a specific set you choose (linked accounts, a cost allocation tag, or a cost category) in aggregate.

Start with one dimensional service monitor; add custom monitors for teams once tags or cost categories are in place.

aws ce create-anomaly-monitor --anomaly-monitor '{
  "MonitorName": "all-services",
  "MonitorType": "DIMENSIONAL",
  "MonitorDimension": "SERVICE"
}'

The command returns a MonitorArn. Keep it.

2. Create the subscription

Thresholds are expressed with ThresholdExpression (the older Threshold number is deprecated). The two keys are ANOMALY_TOTAL_IMPACT_ABSOLUTE (dollars) and ANOMALY_TOTAL_IMPACT_PERCENTAGE, and the match option must be GREATER_THAN_OR_EQUAL. This one alerts only when an anomaly is both at least 200 dollars and at least 25% above expected:

aws ce create-anomaly-subscription --anomaly-subscription '{
  "SubscriptionName": "all-services-immediate",
  "MonitorArnList": ["arn:aws:ce::111122223333:anomalymonitor/EXAMPLE"],
  "Subscribers": [{ "Type": "SNS", "Address": "arn:aws:sns:us-east-1:111122223333:cost-anomalies" }],
  "Frequency": "IMMEDIATE",
  "ThresholdExpression": { "And": [
    { "Dimensions": { "Key": "ANOMALY_TOTAL_IMPACT_ABSOLUTE", "MatchOptions": ["GREATER_THAN_OR_EQUAL"], "Values": ["200"] } },
    { "Dimensions": { "Key": "ANOMALY_TOTAL_IMPACT_PERCENTAGE", "MatchOptions": ["GREATER_THAN_OR_EQUAL"], "Values": ["25"] } }
  ]}
}'

Use "Frequency": "DAILY" with "Type": "EMAIL" subscribers for a digest instead.

3. Know the timing before you trust it

• Detection runs roughly three times a day on net unblended cost, after billing data is processed.
• Cost Explorer data can lag up to 24 hours, so an anomaly can take up to 24 hours to show after the usage.
• A new monitor needs up to 24 hours before it starts detecting.
• A service you have just started using needs 10 days of history before anomalies can be detected for it.

4. Verify

aws ce get-anomaly-monitors
aws ce get-anomaly-subscriptions
aws ce get-anomalies --date-interval StartDate=2026-09-01,EndDate=2026-09-24

get-anomalies returns anomalies with their root causes and total impact; AWS keeps them for up to 90 days. Mark false positives with aws ce provide-anomaly-feedback so the model learns from them.

For the same job on Azure and Google Cloud, see cost anomaly detection on Azure and GCP; the cost anomaly detection guide covers how to tune thresholds.

Adding ZopNight alerts

ZopNight runs its own detector across all three clouds and routes it through Channels. Subscriptions are per dimension and severity (warning, critical or emergency), can be narrowed to an org, cloud account or resource group scope, are deduplicated per date and entity, and re-notify only when an anomaly escalates to a higher severity. Evaluation runs whether or not any channel is subscribed, so adding a channel later changes delivery, not what was detected.