Originally published on kuryzhev.cloud

The scenario

A shared finance mailbox gets an email titled "Cost anomaly detected," and nobody knows whose problem it is. This is the usual failure with default AWS cost anomaly alerts: detection works, but the message goes to a person who cannot act on it. By the time someone finds the owning team, the spend may have run for another day.

The goal here is narrower than "more alerts." Each anomaly should reach the team that owns the spend, with enough context to start investigating immediately. That context includes the service, account, usage type, dollar impact, and a link to the details. AWS Cost Anomaly Detection already does the statistical work.…