How to set up AWS budget alerts

#cloud #finops #devops #aws

Set up one monthly budget in AWS Budgets with two alerts: one when actual spend reaches 80% of the amount, and one when the forecast for the end of the month goes over 100%. Budgets and their e-mail alerts are free, and the whole thing takes about fifteen minutes.

The second safety net, Cost Anomaly Detection, is already running on many accounts. When it finds an anomaly, it sends a daily summary to the address the AWS account was opened with. Both can be up to a day late, and an e-mail on its own switches nothing off.

A monthly budget, step by step

In the console, open Billing and Cost Management, then Budgets, then Create budget. Choose Customize (advanced) so you can set the thresholds yourself:

Type Cost budget, period Monthly, Recurring budget, method Fixed. If AWS credits pay your bill, turn off credits in the budget options, because they are included by default and the budget then sees spend near zero.
Amount: the average of your last three invoices plus 20%.
First threshold (Add an alert threshold): 80, % of budgeted amount, Actual.
Second threshold: 100, % of budgeted amount, Forecasted.
Under Email recipients, enter the address the alerts should go to.

When spend speeds up mid-month, the forecast alert arrives long before the 80% one.

The chart for this part is in the original post.
The forecast needs about five weeks of data. On a new account the forecast alert stays silent until then, so add a third threshold at 100% of actual spend.

For a test account that should stay within the Free Tier, use the Zero spend budget template instead. It e-mails you as soon as you spend anything beyond the free limits.

Who should get the e-mail

AWS Budgets now sends a verification e-mail to every new address. The link is valid for 12 hours, and to confirm the address you have to be signed in to the AWS account that added it. An unconfirmed address gets no alerts.

That means a business owner who doesn't sign in to the console can't confirm their own address. For this case AWS suggests a distribution list whose membership you manage outside AWS. Create an address such as billing-alerts@yourcompany.com, put yourself and your developer on it, and have the developer confirm it once in the console.

Addresses added before verification was introduced show the status Expiring in the recipient list and keep working for a grace period. The documentation doesn't say how long that lasts, so choose Send Notification for each of them and confirm them now.

Cost Anomaly Detection

A budget looks at the month's total. Cost Anomaly Detection looks for unusual jumps in individual services. On many accounts AWS set it up automatically at no cost: a monitor for AWS services and a daily e-mail summary. AWS then only reports anomalies above $100 that are also more than 40% above expected spend.

If your bill is a few hundred dollars a month, $100 is a high bar. In Billing and Cost Management, open Cost Anomaly Detection, then the Alert subscriptions tab, lower the amount in the Threshold field to a level that would hurt, and add the same group address. If the Cost monitors tab is empty, create a monitor of the AWS services type.

Cost Anomaly Detection can take up to 24 hours to spot an anomaly, and it ignores an AWS service you've just started using for its first 10 days.

The same budget in Terraform

If you keep your infrastructure in Terraform, put the budget in code. An example for the aws_budgets_budget resource in AWS provider 6.x:

resource "aws_budgets_budget" "monthly" {
  name         = "monthly"
  budget_type  = "COST"
  time_unit    = "MONTHLY"
  limit_amount = "500"
  limit_unit   = "USD"

  notification {
    notification_type          = "FORECASTED"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    comparison_operator        = "GREATER_THAN"
    subscriber_email_addresses = ["billing-alerts@yourcompany.com"]
  }
}

The 80% alert is a second notification block with ACTUAL and 80, and if you use AWS credits, add cost_types { include_credit = false }. The address still has to be confirmed in the console.

What the alerts won't do

AWS Budgets data is refreshed up to three times a day, usually 8–12 hours apart, so an instance started in the evening may only show up in an alert the next day.

An alert doesn't stop anything either. That is what budget actions are for: once a threshold is crossed they restrict permissions on the account or stop chosen EC2 and RDS instances, either automatically or after you approve. An automatic action on a production database can easily turn an expensive month into an outage, so in a small company I'd only use actions with manual approval.

You don't need the older CloudWatch billing alarm in a new setup: a budget does the same job and adds a forecast.

What a small team should set up

If a forgotten instance or a Lambda stuck in a loop pushes spend over a threshold, you'll usually see it in an e-mail within a day or two, not on the invoice. When the first alert arrives, open Cost Explorer, group costs by service and set the date range to month-to-date. You'll see which service grew.

What an alert won't tell you is whether your current bill is too high, because you set the budget at the level you are used to. If costs have been creeping up for months, an AWS cost audit is worth doing.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

DEV Community