Cost Anomaly Investigation
Find what changed in the bill, when, and what to check next. Do not turn a spike into a rightsizing or commitment plan.
For idle waste, rightsizing, and Savings Plans, use finops-review. For metric or log spikes that are not money, use anomaly-detection.
Workflow
- Confirm the signal: account/project, currency, payer vs linked, charge type (usage, tax, credit, amortized commitment). Invoice, Cost Explorer, CUR, or an AWS Cost Anomaly Detection line — say which.
- Pin the window: first hour or day the delta appears; timezone; hourly vs daily. Never treat month-to-date vs a full prior month as the same window without saying so.
- Slice movers: service, usage type, account/OU, region, tag, operation. Name the top two or three only.
- Classify: usage up | price or discount change | billing artifact | unknown. Credits/EDP expiry can look like a spike with flat usage.
- Rank hypotheses against a change calendar: deploy, autoscaling, batch or GPU job, log ingest, NAT/egress, new marketplace SKU, support plan, forgotten resource.
- Next two or three checks that would disconfirm (CUR filter, create events, utilization, job IDs). Do not declare root cause from one service total.
- Containment is stop-the-bleed only (pause a runaway job, scale down a forgotten fleet). Structural savings go to
finops-review.
Output format
## Cost anomaly: <account / window>
**Real?** likely | unclear | billing artifact
**Window:** first seen … through … (granularity, tz)
**Delta:** <quoted from input only; else relative / unknown>
**Top movers:** service / usage type / account / region
**Class:** usage | price-or-discount | artifact | unknown
### Hypotheses
1. …
### Next checks
1. …
### Containment (stop-the-bleed)
…
### Out of scope here
`finops-review` for rightsizing / commitments
`anomaly-detection` if the spike is not money
Rules
- Never invent dollar amounts, bill percentages, or "you will save $X". Missing export → stay relative and ask for Cost Explorer or CUR.
- Do not recommend deleting backups, dropping Multi-AZ, or turning off encryption to offset a spike.
- Separate unblended usage from amortized RI/SP, tax, credits, refunds.
- Do not name a root cause from a single service total or one Cost Anomaly Detection row.
- Cheaper-bill, rightsizing, and commitment questions →
finops-review. - Non-money metric or log anomalies →
anomaly-detection. - Incomplete "today" Cost Explorer data is not a close.
Edge cases
- Credits / discount ended: check charge type before hunting resources.
- MTD vs last calendar month: refuse until both windows have the same number of complete days.
- GPU / AI: job start, idle endpoints, spot-to-on-demand fallback, token APIs — utilization before instance shopping.
- Transfer hiding under EC2/NAT: split usage types; do not stop at the service rollup.
- Shared or untagged account: ownership is unknown; do not blame the first tagged app.
- "Make the bill cheaper" mid-investigation: finish window + hypotheses, then point to
finops-review.