The cost of finding out late
A misconfigured autoscaling group, an unbounded data transfer or a test cluster someone forgot to tear down can each add hundreds or thousands of dollars a day. Monthly invoice reviews catch them weeks too late. What you need is a daily check that asks one question: is today’s spend unusual compared with normal?
How CloudMonitor scores each day
For every day of spend, CloudMonitor computes a z-score against the trailing 28 days: how many standard deviations today sits above the average. A day is flagged when it is more than 2.0 standard deviations above normal and at least $1 above the baseline. Two guards keep the signal clean:
- a variance floor — the larger of the real deviation, 10% of the mean or $0.25 — so very steady accounts don’t flag tiny wobbles;
- flagged days are excluded from later baselines, so a big spike doesn’t inflate “normal” and hide the next one.
Next to the statistical anomalies you also get the five largest day-over-day increases, which is often the fastest way to spot a runaway resource that is growing rather than jumping.
How fresh is the data?
AWS refreshes billing data only a few times a day, and every Cost Explorer API request is billed. CloudMonitor therefore pulls cost twice a day, which in practice means an anomaly is flagged within about 12 hours of the provider reporting the spend. For a deeper look at the method and its trade-offs, read our guide to AWS cost anomaly detection.
What to do with a flag
Open the cost breakdown by service for the flagged day, find the line that moved, then check the inventory for what changed. To be told before the month is lost, pair anomaly detection with budgets and a month-end forecast.