Exam-style
A finance team working in the management account of a 40-account organisation gets an alert when monthly spend passes 80% of its AUD$60,000 limit. They keep being caught out by one team's spend tripling mid-month while the organisation total stays under the limit, and new member accounts are opened most months. What should they add?
Reveal the answer
C. An AWS managed Cost Anomaly Detection monitor on the linked account dimension, created in the management account, with individual alerts to an SNS topic
Cost Anomaly Detection models each monitored value’s normal spend and alerts on deviation from it. That is how one member account tripling mid-month gets caught while the organisation total is still under the limit. Take the AWS managed monitor on the linked account dimension rather than one customer managed monitor per account. It evaluates every member account independently, up to 5,000 values, and covers new accounts as they are opened. A customer managed monitor aggregates spend across the ten accounts you name by hand, which blunts a single account’s spike. Linked account, cost allocation tag and cost category monitors can only be created in the management account, and individual alerts require an SNS topic. The threshold answers all need a number set per account in advance and reset as the business grows, whether it sits in an extra budget, a budget action, or a billing-metric alarm. A weekly Cost Explorer review finds the spike days after it started.
Q. Cost Anomaly Detection or AWS Budgets to catch overspend across an organisation?
A. A budget tracks a number you set: cost, usage, RI or Savings Plans, scoped by account, service, tag or cost category, on actual or forecast spend. Budget actions go further, applying a deny IAM policy or an SCP, or stopping named EC2 and RDS instances. Cost Anomaly Detection has no threshold to set. It models each monitored value’s normal spend, alerts on deviation, and ranks root causes by service, account, Region and usage type. It notifies; it cannot act.
Why? A static threshold cannot see one member account tripling while the organisation total stays under the limit. At organisation scale, use one AWS managed monitor on the linked account dimension, created in the management account. It tracks each member account independently and covers new accounts as they are opened. Neither tool is fast. Budgets refresh up to three times a day. Anomaly detection also runs about three times a day, over Cost Explorer data that lags usage by up to 24 hours. A new monitor needs ten days of history first.