AWS Cost Management: How to Set Budget and Anomaly Detection Thresholds for Accounts

By: Fredrik Tunvall and Shlomo Dubrowin

Introduction

Managing AWS costs effectively becomes more challenging as your cloud environment grows. This guide provides a practical approach to setting cost monitoring thresholds for AWS accounts. Before we dive in, it's important to understand two scenarios this approach supports:

1. Managing multiple payer accounts: If you're responsible for several payer accounts (e.g., across different business units or regions), you'll need to set appropriate thresholds for each. Remember that a payer account's costs represent the total spend across all its member accounts.
2. Managing member accounts: If you are responsible for multiple member accounts within a payer account, you will need to set thresholds appropriate to each account's specific usage patterns. AWS launched in Aug 2025, cross-account cost visibility in AWS Budgets through billing views, making it easier to manage budgets across multiple accounts without requiring management account access.

This guide will help you develop a structured approach to setting thresholds that works for both scenarios. Throughout this guide, we'll use the term "accounts" to refer to either payer or member accounts, as the process is similar for both.

The Value of Combining AWS Cost Anomaly Detection and AWS Budgets

Before diving into the specifics of setting thresholds, it's important to understand the complementary roles of Cost Anomaly Detection (CAD) and AWS Budgets in your cost monitoring strategy. CAD uses machine learning to identify unusual spikes in your daily AWS spend. It's great for catching unexpected, short-term cost increases that might otherwise go unnoticed. AWS Budgets, on the other hand, allows you to set predefined spend limits and receive alerts when you're approaching or exceeding these limits. Budgets can be set for daily, weekly, monthly, quarterly, or annual time periods, providing a longer-term view of your spending trends. Using both tools together provides a comprehensive approach to cost monitoring:

• CAD helps you catch sudden, unexpected spikes in spending.
• Budgets help you track your overall spending against planned limits over time.

Default Thresholds vs. Customized Approach

If you're just getting started with cost monitoring or have a relatively simple AWS environment, you might want to begin with default thresholds:

For AWS Budgets:

• Set alerts at 80%, 90%, and 100% of actual spend, and 100% of forecasted spend for your monthly budget
• While budgets are available for various time periods, monthly budgets are most common and will be our focus in this guide.

For Cost Anomaly Detection:

• Use the default settings of $100 AND 40% change.

These default settings can be a good starting point. However, if you have a complex environment with diverse account types and spending patterns, you'll benefit from a more customized approach. The rest of this guide will walk you through setting tailored thresholds based on your specific account spending patterns.

Step 1: Gather Spending Data

Start by collecting spending data for each account:

1. For each account, decide whether to use average or median daily spend:

• For accounts with steady spend patterns, use the average daily spend.
• For accounts with variable (spiky) spend, use the median daily spend to account for outliers.

1. For average, use AWS Cost Explorer to view daily spend for the last 6 months. This can be found in the middle above the graph.

If you have multiple member accounts, you can download the table data to calculate the average or median based on the individual daily numbers.

1. Once the data is collected, create a table. Here's an example of what that data might look like:

Account ID	Description	Daily Spend
A123	Production-Main	$15,000.00
B234	Data-Analytics	$12,000.00
C345	ML-Platform	$8,000.00
D456	Production-Backup	$7,500.00
E567	Enterprise-Apps	$5,000.00
F678	Development-Main	$3,500.00
G789	Testing-Platform	$2,800.00
H890	Staging-Main	$2,000.00
I901	QA-Environment	$1,800.00
J012	Integration-Test	$1,500.00
K123	Development-Team1	$1,200.00
L234	Development-Team2	$900.00
M345	Development-Team3	$800.00
N456	Sandbox-Main	$600.00
O567	POC-Environment	$400.00
P678	Training-Platform	$300.00
Q789	DR-Environment	$200.00
R890	Demo-Environment	$150.00
S901	Test-Lab	$100.00
T012	Research-Project	$50.00

Step 2: Categorize Accounts into Tiers

Next, group your accounts into tiers based on their daily spend. This allows you to set appropriate thresholds for accounts with similar spending patterns. Here's how:

1. Order all accounts by their daily spend, from highest to lowest.
2. Calculate percentiles and assign tiers. Below are examples, you can adjust based on your organizational structure and spend as appropriate:

• Tier 1 (High Spend): Top 20% of accounts
• Tier 2 (Medium Spend): Next 30% of accounts
• Tier 3 (Low Spend): Bottom 50% of accounts

Using our example data, here's how the accounts would be categorized:

Account ID	Description	Daily Spend	Percentile	Tier	Account ID	Description
A123	Production-Main	$15,000.00	95	1	A123	Production-Main
B234	Data-Analytics	$12,000.00	90	1	B234	Data-Analytics
C345	ML-Platform	$8,000.00	85	1	C345	ML-Platform
D456	Production-Backup	$7,500.00	80	1	D456	Production-Backup
E567	Enterprise-Apps	$5,000.00	75	2	E567	Enterprise-Apps
F678	Development-Main	$3,500.00	70	2	F678	Development-Main
G789	Testing-Platform	$2,800.00	65	2	G789	Testing-Platform
H890	Staging-Main	$2,000.00	60	2	H890	Staging-Main
I901	QA-Environment	$1,800.00	55	2	I901	QA-Environment
J012	Integration-Test	$1,500.00	50	2	J012	Integration-Test
K123	Development-Team1	$1,200.00	45	3	K123	Development-Team1
L234	Development-Team2	$900.00	40	3	L234	Development-Team2
M345	Development-Team3	$800.00	35	3	M345	Development-Team3
N456	Sandbox-Main	$600.00	30	3	N456	Sandbox-Main
O567	POC-Environment	$400.00	25	3	O567	POC-Environment
P678	Training-Platform	$300.00	20	3	P678	Training-Platform
Q789	DR-Environment	$200.00	15	3	Q789	DR-Environment
R890	Demo-Environment	$150.00	10	3	R890	Demo-Environment
S901	Test-Lab	$100.00	5	3	S901	Test-Lab
T012	Research-Project	$50.00	1	3	T012	Research-Project

While we're focusing on daily spend for CAD thresholds, we can also use these tiers to set percentage thresholds for monthly budgets. This allows for consistency across your monitoring tools while accounting for the different spending patterns in each tier.

Step 3: Calculate Thresholds for Each Tier

Now that we have our tiers, we can calculate appropriate thresholds for each. We'll set both a dollar amount and a percentage for Cost Anomaly Detection (CAD). For each tier, we recommend setting dollar thresholds at approximately 25-30% of the lowest daily spend in that tier as a start:

Tier 1 (High Spend):

• Lowest daily spend in tier: $7,500
• Initial dollar threshold: $7,500 * 25% = $1,875 (rounded to $2,000 for simplicity)
• Percentage threshold: 20% above baseline

Tier 2 (Medium Spend):

• Lowest daily spend in tier: $1,500
• Initial dollar threshold: $1,500 * 30% = $450 (rounded to $500 for simplicity)
• Percentage threshold: 30% above baseline

Tier 3 (Low Spend):

• Lowest daily spend in tier: $50
• Initial dollar threshold: For accounts spending less than $50/day, we recommend using $100 as small dollar amount increases (like a developer running additional tests or a new Lambda function) can create noise without indicating a real problem
• Percentage threshold: 40% above baseline

This gets us to the following thresholds:

Tier	Dollar Threshold	Percentage Threshold
1	2000	20
2	500	30
3	100	40

Remember, these thresholds are starting points. We set them based on the lowest spend in each group to ensure we catch significant changes for all accounts in the tier. If you find you're receiving too many alerts, you can gradually increase the dollar thresholds over time until you reach a balance between catching meaningful anomalies and avoiding excessive alerts.

Step 4: Set CAD and Budget Thresholds

Now we can set both Cost Anomaly Detection thresholds and Budget thresholds for each account based on its tier.

For CAD:

Remember, both the dollar and percentage thresholds must be exceeded to trigger an alert.

For Budgets:

We'll set percentage-based alerts for monthly budgets, using tighter thresholds for higher-spending tiers.

Here are the final CAD and Budget settings for our example accounts:

Account ID	Description	Tier	CAD Dollar Threshold	CAD Percentage Threshold	Budget Alert 1 (Actual)	Budget Alert 2 (Actual)	Budget Alert 3 (Actual)	Budget Alert 4 (Forecast)
A123	Production-Main	1	2000	20	70	85	100	100
B234	Data-Analytics	1	2000	20	70	85	100	100
C345	ML-Platform	1	2000	20	70	85	100	100
D456	Production-Backup	1	2000	20	70	85	100	100
E567	Enterprise-Apps	2	500	30	75	90	100	100
F678	Development-Main	2	500	30	75	90	100	100
G789	Testing-Platform	2	500	30	75	90	100	100
H890	Staging-Main	2	500	30	75	90	100	100
I901	QA-Environment	2	500	30	75	90	100	100
J012	Integration-Test	2	500	30	75	90	100	100
K123	Development-Team1	3	100	40	80	95	100	100
L234	Development-Team2	3	100	40	80	95	100	100
M345	Development-Team3	3	100	40	80	95	100	100
N456	Sandbox-Main	3	100	40	80	95	100	100
O567	POC-Environment	3	100	40	80	95	100	100
P678	Training-Platform	3	100	40	80	95	100	100
Q789	DR-Environment	3	100	40	80	95	100	100
R890	Demo-Environment	3	100	40	80	95	100	100
S901	Test-Lab	3	100	40	80	95	100	100
T012	Research-Project	3	100	40	80	95	100	100

Implementation Tips

1. Regular Reviews: Conduct bi-annual assessments of your thresholds. Spending patterns may change over time.
2. Start Conservative: Begin with wider thresholds and narrow them based on experience. It's better to miss a few anomalies initially than to be overwhelmed with alerts.
3. Account for Growth: If you expect significant growth in an account, consider placing it in a higher tier or adjusting its thresholds accordingly.
4. Monitor Alert Frequency: If you're receiving too many or too few alerts for an account, adjust its thresholds or consider moving it to a different tier.
5. Combine with Budgets: Use AWS Budgets alongside CAD for comprehensive cost monitoring. Set budget alerts at 80%, 90%, and 100% of your monthly budget.

Conclusion

Setting appropriate cost monitoring thresholds is crucial for effective AWS cost management. By categorizing your accounts into tiers and setting tailored thresholds, you can catch significant cost anomalies without being overwhelmed by alerts. Remember, this process is iterative. As your AWS usage evolves, so should your monitoring strategy. Regularly review and adjust your thresholds to ensure they remain effective for your organization's needs.

Fredrik Tunvall is Product Manager for AWS Budgets and Cost Anomaly Detection Shlomo Dubrowin is a Sr Technical Account Manager (TAM) supporting Strategic Customers.