How can I monitor daily EstimatedCharges and trigger a CloudWatch alarm based on my usage threshold?

Short description

The EstimatedCharges metric is published at approximately six-hour intervals. The results reset every month. The MetricMath RATE expression is calculated by dividing the difference between the latest data point value and the previous data point value by the time difference in seconds between the two values. You can use this expression to calculate the EstimatedCharges value for each day.

Resolution

Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent version of the AWS CLI.

Test the RATE expression and verify the output

Before creating a CloudWatch alarm, call the GetMetricData API to test the RATE expression:

$ cat metric_data_queries.json
{
    "MetricDataQueries": [
        {
            "Id": "m1",
            "MetricStat": {
                "Metric": {
                    "Namespace": "AWS/Billing",
                    "MetricName": "EstimatedCharges",
                    "Dimensions": [
                        {
                            "Name": "Currency",
                            "Value": "USD"
                        }
                    ]
                },
                "Period": 86400,
                "Stat": "Maximum"
            }
        },
    {
            "Id": "e1",
            "Expression": "IF(RATE(m1)>0,RATE(m1)*86400,0)",
            "Label": "DailyEstimatedCharges",
        "Period": 86400
        }
    ],
    "StartTime": "2020-06-01T00:00:00Z",
    "EndTime": "2020-06-05T00:00:00Z",
    "ScanBy": "TimestampAscending"
}


$ aws cloudwatch get-metric-data --cli-input-json file://metric_data_queries.json
{
    "MetricDataResults": [
        {
            "Id": "m1",
            "Label": "EstimatedCharges",
            "Timestamps": [
                "2020-06-01T00:00:00Z",
                "2020-06-02T00:00:00Z",
                "2020-06-03T00:00:00Z",
                "2020-06-04T00:00:00Z"
            ],
            "Values": [
                0.0,
                22.65,
                34.74,
                46.91
            ],
            "StatusCode": "Complete"
        },
        {
            "Id": "e1",
            "Label": "DailyEstimatedCharges",
            "Timestamps": [
                "2020-06-02T00:00:00Z",
                "2020-06-03T00:00:00Z",
                "2020-06-04T00:00:00Z"
            ],
            "Values": [
                22.65,
                12.090000000000003,
                12.169999999999995
            ],
            "StatusCode": "Complete"
        }
    ],
    "Messages": []
}

Output table:

In the output table, confirm that DailyEstimatedCharges is correctly calculated as the difference between the latest data point and the previous data point. You use this expression to create your CloudWatch alarm.

Create a CloudWatch alarm using the AWS Management Console

1.    Follow the steps in Creating a CloudWatch alarm based on a metric math expression.

2.    Paste the following code in the Source tab of the CloudWatch Metrics page. This code creates a metric math expression [ IF(RATE(m1)>0,RATE(m1)*86400,0) ] using EstimatedCharges as the base metric with the label "m1".

{
    "metrics": [
        [ { "expression": "IF(RATE(m1)>0,RATE(m1)*86400,0)", "label": "Expression1", "id": "e1", "period": 86400, "stat": "Maximum" } ],
        [ "AWS/Billing", "EstimatedCharges", "Currency", "USD", { "id": "m1" } ]
    ],    
    "view": "timeSeries",
    "stacked": false,
    "region": "us-east-1",
    "stat": "Maximum",
    "period": 86400
}

3.    Create a CloudWatch alarm for the MetricMath expression. To do this, select Graphed metrics. In the Actions column for the DailyEstimatedCharges metric, choose the Alarm icon.

4.    In the CloudWatch Alarm Creation Wizard: Confirm the details of the metric configuration. Add an appropriate threshold value to receive notifications when the threshold is breached (for example, 50 USD). Configure your alarm actions. Add an alarm name and description.

Create a CloudWatch alarm using the AWS CLI

1.    Create an alarm configuration as a JSON file:

$ cat alarm_config.json
{
    "AlarmName": "DailyEstimatedCharges",
    "AlarmDescription": "This alarm would be triggered if the daily estimated charges exceeds 50$",
    "ActionsEnabled": true,
    "AlarmActions": [
        "arn:aws:sns:<REGION>:<ACCOUNT_ID>:<SNS_TOPIC_NAME>"
    ],
    "EvaluationPeriods": 1,
    "DatapointsToAlarm": 1,
    "Threshold": 50,
    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
    "TreatMissingData": "breaching",
    "Metrics": [{
        "Id": "m1",
        "MetricStat": {
            "Metric": {
                "Namespace": "AWS/Billing",
                "MetricName": "EstimatedCharges",
                "Dimensions": [{
                    "Name": "Currency",
                    "Value": "USD"
                }]
            },
            "Period": 86400,
            "Stat": "Maximum"
        },
        "ReturnData": false
    },
    {
        "Id": "e1",
        "Expression": "IF(RATE(m1)>0,RATE(m1)*86400,0)",
        "Label": "DailyEstimatedCharges",
        "ReturnData": true
    }]
}

Note: Be sure to update the REGION, ACCOUNT_ID, and SNS_TOPIC_NAME with your corresponding values.

2.    Call the PutMetricAlarm API:

aws cloudwatch put-metric-alarm --cli-input-json file://alarm_config.json

(Optional) Find the previous day's top ten contributors to the Maximum DailyEstimatedCharges value

Use the following query:

$ cat top_contributors_query.json
{
    "MetricDataQueries": [{
        "Id": "e1",
        "Expression": "SORT(RATE(SEARCH('{AWS/Billing,Currency,ServiceName} AWS/Billing ServiceName', 'Maximum', 86400))*86400, MAX, DESC, 10)",
        "Label": "DailyEstimatedCharges",
        "Period": 86400
    }],
    "ScanBy": "TimestampAscending"
}


$ aws cloudwatch get-metric-data --cli-input-json file://top_contributors_query.json --start-time `date -v -2d '+%Y-%m-%dT%H:%M:%SZ'` --end-time `date '+%Y-%m-%dT%H:%M:%SZ'` --region us-east-1

Note: The supported DateTime format for StartTime and EndTime is '2020-01-01T00:00:00Z'.

Important: The preceding command incurs charges based on the number of metrics retrieved by each GetMetricData API call. For more information, see Amazon CloudWatch pricing.