Cost Anomaly Detection with no attached spend or usage

Question

I recently set up a replication policy for an s3 bucket to mirror to another teams AWS account. It consists of 6 very small json files and is updated 1-3 times per week. I recently (13th Nov.) received a cost anomaly notification with the top root cause being amazon simple storage service and the usage type "USE1-USW2-AWS-Out-Bytes" which I assume is the cross region transfer I have set up. When investigating the anomaly, the actual spend says approx 2k USD, with a 700 USD cost impact. Theres no way we could've accumulated such high cost with the amount of data we are sending. What confuses me most is Cloudwatch doesn't reflect any high usage or cost if I break it down by day for this month (and nowhere near 700usd spike in the week of the anomaly detection). I've also checked all eventbridges and lambda functions to ensure there is no loops.

Has anyone faced a situation like this before? What can I expect to see on the invoice at the end of the month, is it common to see the usage or amount spent not update. Is it possible that the anomaly is an error from AWS's side and is false?

Any help or advice will be greatly appreciated. Thanks,

Has anyone faced a situation like this before? What can I expect to see on the invoice at the end of the month, is it common to see the usage or amount spent not update.
Is it possible that the anomaly is an error from AWS's side and is false?

Any help or advice will be greatly appreciated. 
Thanks,

ftunvall · Accepted Answer

Hi there,

I'm the Product Manager for AWS Cost Anomaly Detection. While it's difficult to diagnose without seeing the data directly, I can provide some guidance on how to investigate this situation.

First, I recommend checking the actual cost in Cost Explorer for the specific day(s) in question. You can do this by clicking the "View in Cost Explorer" button in the anomaly details page (note: the top button shows the entire anomaly, while the buttons next to each root cause are filtered to show just that specific cause). This is important because:

1. Billing data is sometimes updated after Cost Anomaly Detection takes its snapshot
2. Cost Anomaly Detection runs approximately three times a day using the data available at that point in time
3. Occasionally there can be errors in the underlying data that Cost Anomaly Detection uses to detect anomalies

If the Cost Explorer data doesn't match what you're seeing in CloudWatch or doesn't align with your expected usage patterns, I'd recommend opening a support ticket so we can do a deeper investigation into what might be causing this discrepancy.

Let me know if you need any clarification or have additional questions!

re:Post Agent · Answer

AWS Cost Anomaly Detection uses machine learning to identify unusual spending patterns in your AWS account. The service runs approximately three times a day to monitor for anomalies in your net unblended cost data, but there can be a delay of up to 24 hours in detecting anomalies since it uses data from Cost Explorer.

Regarding your specific situation with the S3 replication policy, the anomaly alert showing a $2,000 spend with a $700 cost impact for cross-region data transfer ("USE1-USW2-AWS-Out-Bytes") seems unusually high for just replicating a few small JSON files. This could potentially be:

1. A false positive - AWS Cost Anomaly Detection might occasionally flag unusual patterns that aren't actually problematic
2. A delay in cost data reconciliation - Cost Explorer data can lag by up to 24 hours
3. An unrelated issue causing high data transfer that hasn't been identified yet

Since CloudWatch doesn't show corresponding high usage or costs when you break it down by day, this suggests there might be a discrepancy in the reporting.

For next steps:
- Continue monitoring your actual usage in CloudWatch
- Wait for your invoice at the end of the month to see the actual charges
- Consider setting up AWS Budgets with specific thresholds to get additional alerts if actual spending exceeds expected amounts
- Analyze the root cause details provided in the anomaly alert to see if there are specific timestamps or resources causing the spike

If the anomaly persists without corresponding usage evidence, it may be worth contacting AWS Support to investigate further.  
**Sources**  
[Detecting unusual spend with AWS Cost Anomaly Detection - AWS Cost Management](https://docs.aws.amazon.com/cost-management/latest/userguide/manage-ad.html)  
[COST02-BP05 Implement cost controls - Cost Optimization Pillar](https://docs.aws.amazon.com/wellarchitected/latest/cost-optimization-pillar/cost_govern_usage_controls.html)  
[COST02-BP05 Implement cost controls - AWS Well-Architected Framework (2023-04-10)](https://docs.aws.amazon.com/wellarchitected/2023-04-10/framework/cost_govern_usage_controls.html)  
[AWS Cost Anomaly Detection - Amazon Web Services](https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/)

Cost Anomaly Detection with no attached spend or usage

Add your answer

Relevant content