AWS cost anomaly detection that names the service behind the spike

What it detects

Each service is measured against its own recent history — not one threshold over the whole bill — so a single service tripling registers even when total spend barely moves.

Per-service baselines

On the Anomalies tab, every service, per connected integration, is compared with its own baseline: the trailing 30 days against the average of up to three prior 30-day windows, plus last week against the four before it and last month against the three before it.

Spikes that clear a floor

A service is flagged when it rises past both a percentage and a dollar floor — on the default setting, 30% and $75 in the 30-day and monthly views, 40% and $40 in the weekly view — or when it is statistically unusual and still clears the floor. Small-dollar wobble stays quiet.

Severity in dollars

Each anomaly is graded Minor, Moderate, High, or Critical by dollar impact and distance from normal, not by percentage alone — any jump over $1,000 is Critical. Drops get their own label.

First-time spend

A service you have never paid for has no baseline to break, so new spend is flagged on its own once it clears a minimum ($100 in the 30-day view on the default setting) and counted on a New Services card.

Sensitivity

Low, Balanced, or High: scale every threshold to flag fewer anomalies or flag them earlier.

What an anomaly looks like

Each flagged service carries its baseline, the size of the jump, a severity, and — one click in — the resources and accounts behind it.

How alerts work

Anomalies live on the Anomalies tab; alert rules push them to the channels your team already watches, on a schedule against the latest cost data.

Rule types

Anomaly Scan rules run their own per-service check: the last day, week, or month against the average of the four windows of the same length before it. Trend Spike watches the total for a scope you pick, such as one service; Spend Threshold, a fixed dollar line; Commitment Expiry, upcoming expirations.

Schedule

You pick the schedule: daily at 08:00 UTC, weekly on Mondays (the default), or monthly on the 1st, each on cost data through the previous midnight. AWS billing data takes two to three days to settle, so even a rule that checks daily over a one-day analysis period flags a spike next-day at best, and usually after several days — not the weeks it takes the invoice to arrive.

Channels

Slack and Microsoft Teams through an incoming webhook per channel, and email to one or more addresses. Send different rules to different channels.

From an anomaly

The Bell on a spike opens a Trend Spike rule pre-filled with the service and a threshold suggested from the jump you just saw.

Plans

Anomaly details, alert rules, notification channels, and AI Explain are on every paid plan: Starter $99/month up to $50K of monthly spend, Growth $199/month up to $200K. 14-day trial, no credit card.

What it unlocks

Detection is the start. These turn a flagged line into an answer.

• Drill into the cause

  Expand any anomaly to see the resources and usage types whose cost rose, by account, with the change in percent and dollars — under a cost trend chart for the service.

  Investigating anomalies (docs) →

• AI Explain

  Ask AI why a service was flagged. It reads the top resources, the baseline, and the size of the jump, and writes up an AI Anomaly Analysis of the likely cause.

• AI and Snowflake spend too

  The same detection runs per model on OpenAI and Anthropic, on Snowflake, Azure, and Google Cloud — and Amazon Bedrock is watched as a service on your AWS bill.

  Bedrock cost tracking →

• Dismiss without losing it

  Dismiss an anomaly as an expected change, resolved, or too small to matter. It leaves the active list, restores in one click, and comes back on its own if the spend keeps climbing.

Common questions

How does CloudQuell detect AWS cost anomalies?

On the Anomalies tab it compares each service with its own baseline in your daily cost data — the trailing 30 days against up to three prior 30-day windows, plus weekly and monthly views; Anomaly Scan alert rules run a similar check against the four prior windows. A service is flagged when it rises past both a percentage and a dollar floor (30% and $75 in the 30-day view on the default setting), or when it is statistically unusual and still clears the floor. First-time spend with no history is flagged on its own.

How is this different from AWS Cost Anomaly Detection?

AWS's built-in detection is free and worth turning on. It watches AWS spend only, needs 10 days of history before it can flag a newly used service, and alerts by email or an Amazon SNS topic. CloudQuell flags first-time spend as soon as it clears the floor, runs the same detection on your OpenAI, Anthropic, Snowflake, Azure, and Google Cloud spend, and posts straight to Slack, Teams, or email. Neither is real-time: both wait on AWS billing data, which trails usage.

How fast will I hear about a spike?

It depends on the rule. Weekly rules, the default, run on Mondays; a rule set to check daily runs at 08:00 UTC on cost data through the previous midnight. AWS billing data takes two to three days to settle, so even a daily check over a one-day analysis period flags a spike next-day at best, and usually after several days — not when the invoice arrives after month-end.

Does it cover AI and Snowflake spend?

Yes. Detection runs per model on OpenAI and Anthropic, on Snowflake, and per service on Azure and Google Cloud. Amazon Bedrock is part of your AWS bill, so it is watched as the Bedrock service line; its per-model breakdown lives in the AI Spend view.

Which plans include anomaly detection?

Anomaly details, alert rules, Slack, Teams, and email channels, and AI Explain are on every paid plan — Starter $99/month for up to $50K of monthly cloud spend, Growth $199/month up to $200K — flat, never a percentage of your bill. Both start with a 14-day trial and no credit card. The Free plan, for spend under $10K/month, shows a 30-day anomaly count on the Overview.