Anomaly details (2024-06-17)

The summary you shared shows regional (=inside the region) data transfer costs, but confusingly, under EBS, Elastic Block Store, which is the virtual hard drive service. Are you perhaps using some third-party backup software that could be backing data up to or reading or replicating it from EBS snapshots (https://docs.aws.amazon.com/ebs/latest/userguide/ebs-accessing-snapshot.html)? Or have you been using the VM import/export feature of EC2 (https://aws.amazon.com/ec2/vm-import/)?

You can possibly gain more insights into your costs by using the Cost Explorer in your account. For "granularity", choose "daily" and for "date range", select a start date perhaps one or two months ago and set the end date to 2 days before today. More recent data will be incomplete. In the filter selections on the right, for "charge type", set the "Tax" type to be "excluded". Finally, in the graph view, select the stacked column graph type, which is the rightmost symbol in the upper right-hand corner of the graph.

This should give a good overview of how your costs used to be and how they are now (up to two days ago). It'll show which service is accountable. Perhaps it's Elastic Block Store, or maybe it's EC2-Other, or maybe it's several services.

Change the "dimension" setting from "service" to "usage type" to see a more granular breakdown of the costs. Is it only "USE2-DataTransfer-Regional-Bytes" that has increased, or were multiple cost types affected?

You can additionally try "API operation" for the "dimension" selection to see if there's more detail available for the sources with the largest cost increases.

If there are too many "usage types" or "API operations" to make sense of in the graph, you can apply the filters on the right to include only the "service" and/or "usage type" or "usage type group" where you saw most of the costs originating, so that the breakdown based on "usage type" or "API operation" will only break down those specific services.

Below steps could be useful to investigate the anomaly specific to AWS EBS (Elastic Block Store) and data transfer costs, Hope it helps you to find out the root cause -

Check the AWS Cost Explorer:

• In the AWS Cost Explorer, filter the view by service to focus on the "Amazon Elastic Block Store" and "AWS Data Transfer" services.
• Look for any unusual spikes or high costs for these services during the period when the anomaly occurred.

Analyze the EBS Volume Details:

• Go to Amazon EC2 console and review the EBS volumes associated with your instances.
• Check for any unusually large or unexpected EBS volumes that could be contributing to high storage costs.
• Do you see any volumes that have been provisioned with higher IOPS (Input/Output Operations Per Second) or throughput settings, which can increase costs.

Review Data Transfer Patterns:

• In the AWS Cost Explorer, drill down into the EC2-Other service and then to "AWS Data Transfer" service usage to see the breakdown of costs by transfer type (e.g., internet, intra-region, inter-region).
• check for any unexpected or excessive data transfer activities that could be contributing to the high costs.
• Check the origin and destination resources involved in the data transfer, such as EC2 instances, S3 buckets, or other AWS services.

Check CloudTrail Logs:

• Search the CloudTrail logs for any API calls related to EBS volume creation, modification, or deletion during the period when the anomaly occurred.
• Also, look for API calls related to data transfer activities, such as S3 PUT or GET operations, EC2 instance data transfer, or any other relevant services.

Investigate Backup and Replication Activities: If you are using AWS Backup or AWS DataSync for data backup or replication, check the configurations and logs for any excessive data transfer or storage usage.

Consider checking AWS Trusted Advisor: - Use the AWS Trusted Advisor service to check for any cost optimization recommendations related to EBS volumes or data transfer.

Hi, reading into the first table - Cost anomaly detection has discovered an anomaly in the costs for a time period (outside what was expected), I suspect this was from a Service Monitor. It has tried to pin point a root cause on the service/region/usage. Whilst it has EBS as a service the usage more implies that this is Data Transfer

Some tips to pin this down (you may have used something similar for the second table):

• In the console select the anomaly in the Detection history tab, there should be a blue link to take you to CostExplorer with the relevant filters so that you can visualise this and see the increase in a graph
• If you can visualize the increase, try using groupby to narrow it down (tags/account etc)
• If you have resource granularity enabled then try groupby resource to see if there is any key usage to specfic resources. The resource level view is for the last 14days, but that time window should fit this

This Blog may be of assistance