Build AWS Cost Guardrails

Create AWS budget and anomaly alerts to catch unexpected cloud spend.

Introduction

30 Second Summary

A small cloud charge can be easy to miss until the bill lands in your inbox. By then, the spending has already happened.

In this project, you will build a two-layer cost guardrail in AWS. It watches a $10 monthly ceiling plus unusual spending changes.

What You'll Build

When a warning arrives, you will open AWS Billing and Cost Management and trace it to the spending pattern behind it.

By the end of this project, you'll have:

A visible cost baseline in AWS Cost Explorer that shows what AWS currently knows about your spending.
A recurring $10 monthly guardrail in AWS Budgets with email alerts for actual spending and forecasted spending.
An AWS Services monitor in AWS Cost Anomaly Detection that emails daily summaries when unusual spend crosses your threshold.
Secret Mission: Tune the alert subscription to combine a $1 absolute threshold with a 100 percent percentage threshold under AND logic.

What do I need for this project?

You need an AWS account plus access to the email inbox that will receive alerts.

The AWS Management Console runs in Safari with no local installation.

Before We Start

Before any console work begins, this checkpoint connects every action to the reason behind it. You are building a $10 recurring monthly budget plus AWS Cost Anomaly Detection to help prevent surprise AWS charges.

Verify Billing Access

You have chosen a two-layer guardrail with a monthly budget plus AWS Cost Anomaly Detection. That plan depends on access to the billing console plus an inbox that can receive warnings.

Billing permissions are still uncertain. You will verify them with your normal administrative identity before any cost alerts depend on that access.

In this step, get ready to:

Open the Billing and Cost Management console with your normal administrative identity.
Resolve IAM billing permissions if access is denied.
Confirm access to the inbox that will receive cost alerts.

Open Billing and Cost Management

The AWS Management Console gives your administrative identity access to account services. You will use Safari to reach Billing and Cost Management directly.

The navigation pane is the launch point for AWS Cost Explorer plus AWS Budgets. It also provides access to AWS Cost Anomaly Detection.

Press Cmd+Space on your Mac to open the search bar.
Type Safari to find the browser.
Press Enter to start Safari.

You will see a Safari window ready for the AWS console.

Enter https://console.aws.amazon.com/costmanagement/ in the Safari address bar.
Sign in with your normal administrative identity.

You will either see the Billing and Cost Management navigation pane or a message explaining that your identity lacks access.

Choose the tab below that matches what Safari shows.

✔️ I can see the navigation pane

Billing and Cost Management is available to your normal administrative identity.

Confirm that Cost Explorer appears in the navigation pane.
Confirm that Budgets appears in the navigation pane.
Confirm that Cost Anomaly Detection appears in the navigation pane.

ⓧ My identity is denied access

Root access can feel sensitive because the account owner uses powerful credentials for this one required change.

Sign out of the normal administrative identity.
Ask the account owner to sign in with root credentials.
Choose the account name in the console header.
Choose Account.
Find IAM User and Role Access to Billing Information.
Choose Edit.
Choose Activate IAM Access.
Choose Update.

The account now permits IAM identities to receive billing permissions. Your normal identity still needs an appropriate policy.

Ask the account owner to attach the AWS managed Billing policy to the IAM user or role used for this project.
Sign out of the root session.
Sign back in with your normal administrative identity.
Re-enter https://console.aws.amazon.com/costmanagement/ in the Safari address bar.

You should now see the Billing and Cost Management navigation pane.

Why Are There Two Permission Gates?

Activating IAM billing access makes billing permissions available to IAM identities. The Billing policy grants the selected identity permission to use the Billing and Cost Management console.

Still Blocked from Billing?

Ask the account owner to confirm that IAM billing access is active. Ask them to confirm that the billing policy is attached to the exact user or role you use.

If the page still blocks your normal identity, help me diagnose my AWS billing permissions.

Confirm the alert inbox

Both alert systems need an email destination you can reach. An automatically created anomaly subscription uses the AWS account root email by default.

Open a new tab in Safari.
Go to the sign-in page for the email address you plan to use for alerts.

You will see the email provider's sign-in page or your inbox.

Sign in to the email inbox.
Confirm that you can open the inbox message list.
Record the accessible alert address here: your alert email address.
Confirm access to the AWS account root email inbox if your account uses an automatically created anomaly subscription.

Good, your alert destination is reachable before any notification depends on it.

Run the final access check

Before the final check, do you expect your normal administrative identity to reach all three cost tools?

Switch back to the Billing and Cost Management tab in Safari.
Check the signed-in identity shown in the console header.
Confirm that Cost Explorer is visible in the navigation pane.
Confirm that Budgets is visible in the navigation pane.
Confirm that Cost Anomaly Detection is visible in the navigation pane.
Switch back to the alert-email tab.
Confirm that the inbox remains accessible.

You will see the AWS Management Console open in Safari under your normal administrative identity. The Billing and Cost Management navigation will include Cost Explorer, Budgets, plus Cost Anomaly Detection.

Your accessible inbox is ready for AWS Budgets plus AWS Cost Anomaly Detection alerts. The AWS account root email is also accessible when an automatically created anomaly subscription uses it.

That clears the access blocker before your cost guardrail starts relying on these services.

Your billing tools plus alert inbox are ready. Next, you will reveal the cost baseline that anchors your guardrail.

Reveal Your Cost Baseline

Your Billing and Cost Management access is confirmed. Now you can reveal the cost baseline that anchors the rest of the guardrail.

AWS Cost Explorer shows the cost data AWS currently has for your account. Before setting a limit, you need to know whether a cost graph is ready or the account is waiting for its first data refresh.

In this step, get ready to:

Check whether Cost Explorer is active.
Launch Cost Explorer when the welcome page appears.
Verify the final Billing and Cost Management state.

Check your Cost Explorer status

What Is a Cost Baseline?

A cost baseline is the spending history currently available for your account. It gives future budget alerts a visible reference point.

Return to the Billing and Cost Management console from earlier.
Choose Cost Explorer in the left navigation pane.
Identify which page is shown.

✔️ I see the Cost Explorer dashboard

Your account already has Cost Explorer active. You have your baseline in view.

The available totals and graph show the cost history AWS currently has for this account.

ⓧ I see Welcome to Cost Explorer

Launching Cost Explorer starts the account's cost-data pipeline. Eligible accounts can also receive an automatically configured anomaly-detection setup.

Choose Launch Cost Explorer.

AWS confirms the launch before it starts preparing the account's cost data.

Current-month data can take about 24 hours to appear. A preparation state means the activation worked.

What Happens After Activation?

Cost Explorer prepares current-month billing data in the background. The graph becomes available after AWS processes that data.

For eligible accounts, activation also configures Cost Anomaly Detection automatically. You will inspect that configuration in a later step.

Confirm the baseline is active

An active baseline can appear in two valid forms. The account either shows available costs or confirms that data preparation is underway.

Before you check, which state do you expect this account to show?

Inspect the main Cost Explorer area.
Confirm the navigation pane lists Cost Anomaly Detection.

Existing accounts show available cost totals plus a graph. Newly activated accounts show a successful launch or data-preparation confirmation.

You should also see Cost Anomaly Detection in Billing and Cost Management. This confirms that the second guardrail is available for configuration.

Your cost baseline is visible or preparing successfully. Next, you will turn that reference point into a recurring $10 monthly guardrail.

Set a $10 Monthly Guardrail

Your AWS Cost Explorer baseline now gives you a place to review recorded spending. That view helps you understand what has already happened.

A recurring AWS Budgets cost budget adds a planned ceiling. A fixed budget evaluates only the thresholds you configure.

In this step, get ready to:

Create a recurring fixed monthly budget with a $10 ceiling.
Add email alerts for actual spending plus forecasted spending.
Open the budget to review its status against the ceiling.

Create the recurring cost budget

A cost budget compares tracked spend with a limit you choose. The recurring setting starts a fresh tracking period each month.

No Workload Charges

You can create this guardrail without starting billable infrastructure. AWS provides budget monitoring plus email notifications free of charge.

Switch back to the Billing and Cost Management console from earlier.
Select Budgets in the left navigation pane.
Click Create budget.
Select Customize (advanced).
Select Cost budget.
Click Next.

You will see the cost budget setup fields.

Enter Monthly Cost Guardrail in the Budget name field.
Select Monthly for Period.

The budget now has a recognisable name plus a monthly tracking period.

Select Recurring budget for Budget renewal type.
Select Fixed for Budgeting method.

The settings now describe a monthly ceiling that repeats at the same amount.

Enter 10 as the Budgeted amount.
Click Next.

You will see the alert configuration area for your $10 monthly budget.

How the Monthly Reset Works

A recurring budget creates a fresh tracking period each month. The fixed method keeps the ceiling at $10 for every period.

The budget compares available cost data with that ceiling until you edit the configuration.

Add the two email alerts

An Actual alert responds to spending that AWS has already recorded. A Forecasted alert responds when AWS expects month-end spending to reach the configured threshold.

Select Add an alert threshold.
Enter 80 for the first alert threshold.
Select % of budgeted amount as the threshold unit.
Select Actual as the spend type.
Enter your alert email address under Email recipients.

The first alert now watches recorded spending at 80 percent of the monthly ceiling.

Select Add an alert threshold again.
Enter 100 for the second alert threshold.
Select % of budgeted amount as the threshold unit.
Select Forecasted as the spend type.
Enter your alert email address under Email recipients.

The second alert now watches the projected month-end spend at 100 percent of the ceiling.

Leave Amazon SNS unconfigured.
Leave AWS Chatbot unconfigured.
Leave budget actions unconfigured.
Continue without creating an AWS Budgets Report.
Click Next.

You will reach the review page with an email-only budget configuration.

Create the monthly guardrail

The review page is your final configuration check. Each setting should match the planned monthly guardrail before AWS creates it.

Confirm Budget name shows Monthly Cost Guardrail.
Confirm Period shows Monthly.
Confirm Budget renewal type shows Recurring budget.
Confirm Budgeting method shows Fixed.
Confirm the budgeted amount shows $10.
Confirm the first alert shows 80 percent Actual.
Confirm the second alert shows 100 percent Forecasted.
Click Create budget.

Good work. Monthly Cost Guardrail now appears in the Budgets list.

Can't See the Budget?

Return to the review page if the budget is missing from the list.
Confirm each alert has an email recipient.
Choose Create budget again.

Help me troubleshoot the missing AWS budget.

Before you inspect the finished budget, suppose AWS records an unusual one-time $5 charge while the forecast remains below $10. Do you think either alert sends an email?

Select Monthly Cost Guardrail from the Budgets list.
Locate the current spend in the budget details.
Locate the forecasted spend in the budget details.
Review the two alert thresholds.

You will see a recurring monthly cost budget of $10. Its alerts show 80 percent Actual plus 100 percent Forecasted.

The Actual alert starts at $8. The Forecasted alert starts at $10.

With the forecast below $10, the one-time $5 charge triggers neither alert. That change could still be unusual even though the fixed budget stays quiet.

Your $10 ceiling now handles planned-spend warnings. Next, you will add AWS Cost Anomaly Detection to catch changes that fixed thresholds miss.

Configure Anomaly Detection

Your AWS Budgets guardrail now compares actual spend plus forecasted spend with a fixed $10 ceiling. Its alerts activate when spending reaches the levels you configured.

A smaller increase can still be unusual for your account. This step tests whether the fixed budget can recognize that pattern.

In this step, get ready to:

Test what the fixed budget can detect.
Inspect the account's existing anomaly setup.
Configure daily email alerts for at least $1 of cost impact.

Test the fixed threshold

A fixed budget evaluates spending against defined alert levels. Your budget has an Actual alert at 80% plus a Forecasted alert at 100%.

Before you check, do you think an unusual current spend below $8 would trigger the Actual alert?

Return to Budgets in Billing and Cost Management.
Open Monthly Cost Guardrail from the budget list.
Compare the current spend with the 80% Actual alert level.
Review the 100% Forecasted alert level.

You see alert levels tied to the $10 ceiling. The budget has no test for whether a smaller change is unusual for this account.

What Fills the Gap?

AWS Cost Anomaly Detection uses machine learning to understand spending patterns. It can surface an abnormal increase even when the increase remains below the budget ceiling.

The budget asks whether spending crossed a planned limit. The anomaly monitor asks whether spending departed from the account's established pattern.

Configure the monitor and subscription

Cost Explorer can automatically create an AWS services monitor plus a daily email subscription. Inspecting the existing setup first prevents a duplicate monitor.

Choose Cost Anomaly Detection in the Billing and Cost Management navigation pane.
Choose the Cost monitors tab.
Check whether an AWS services monitor is listed.
Choose the Alert subscriptions tab.
Check whether a daily email subscription is listed.

Your account now matches one of the two paths below.

This project uses email for anomaly alerts. Amazon SNS plus AWS Chatbot remain unconfigured.

Choose the tab that matches the monitor shown in your account.

✔️ An AWS services monitor exists

Reuse the existing AWS services monitor. Editing its subscription keeps one broad monitor across the services used by the account.

Select the alert subscription attached to the AWS services monitor.
Choose Edit.
Set Alerting frequency to Daily summaries.
Enter the accessible email address under Alert recipients.
Set the absolute Threshold to 1.
Remove any percentage threshold from the subscription.
Choose Save.

The existing subscription now sends daily email summaries when total cost impact reaches at least $1.

ⓧ No AWS services monitor exists

Create one AWS managed monitor for AWS services. The same workflow also creates its email subscription.

Return to the Cost monitors tab.
Choose Create monitor.
Select Managed by AWS.
Select AWS services.

Why Use One Broad Monitor?

An AWS services monitor watches anomalous spend across the AWS services used by the account. This gives the guardrail broad coverage without separate monitors for each service.

Select Create a new subscription.
Enter Daily Cost Anomalies as the subscription name.
Set Alerting frequency to Daily summaries.
Enter the accessible email address under Alert recipients.
Set the absolute Threshold to 1.
Leave the percentage threshold unset.
Choose Create monitor.

The new AWS services monitor now has a daily email subscription with a $1 absolute threshold.

Can't Save the Subscription?

Confirm that the subscription has an accessible email recipient. Check that the absolute threshold contains 1.

If you created a monitor, confirm that Managed by AWS plus AWS services are selected.

Help me troubleshoot my anomaly monitor setup.

Verify the daily anomaly guardrail

The final check confirms the monitor plus its subscription as separate parts of one guardrail. The monitor finds unusual spend while the subscription controls when email is sent.

Before you check, which monitor plus subscription settings do you expect to find?

Return to the Cost monitors tab.
Confirm that one AWS services monitor is listed.
Switch to the Alert subscriptions tab.
Open the daily email subscription.
Confirm that Alerting frequency shows Daily summaries.
Confirm that the alert recipient matches the accessible email address.
Confirm that the absolute total-cost-impact threshold is $1.
Confirm that no percentage threshold is configured.

You'll see one AWS services monitor plus one daily email subscription with a $1 absolute threshold. That closes the fixed budget's blind spot for smaller changes that are unusual for your account.

Why Is the Inbox Quiet?

A quiet inbox after setup is normal. A new monitor can take about 24 hours to start detecting anomalies.

The monitor also needs historical usage data before it can identify anomalies for a newly used service. Your saved configuration proves the guardrail is ready while that history accumulates.

Your two cost guardrails are ready. Next, you'll practice the investigation path from a warning to the relevant cost details.

Run a Cost Incident Check

Inside the AWS Management Console, your AWS Budgets ceiling tracks planned spend. Your AWS Cost Anomaly Detection monitor watches for unusual changes.

A warning only helps when you can trace it to the relevant cost details. This step turns both configurations into a repeatable investigation path.

In this step, get ready to:

Classify a budget warning as actual spending or forecasted spending.
Investigate a detected anomaly.
Verify the complete operating state.

Compare actual and forecasted spend

An Actual alert measures spending already recorded against your budget. A Forecasted alert evaluates where AWS expects spending to finish.

Return to the Billing and Cost Management console in Safari.
Choose Budgets in the navigation pane.
Select Monthly Cost Guardrail from the budgets list.
Identify the current spend shown in the budget details.
Compare the current spend with the 80 percent Actual alert threshold.
Identify the forecasted spend shown in the budget details.
Compare the forecasted spend with the 100 percent Forecasted alert threshold.
Use the alert type to classify a future budget warning.

You should see a recurring monthly cost budget of $10.

The Actual alert should show an 80 percent threshold. The Forecasted alert should show a 100 percent threshold.

How Do the Two Alerts Differ?

The Actual alert tells you that recorded spending has reached its configured share of the budget.

The Forecasted alert tells you that predicted month-end spending has reached its configured share of the budget.

Inspect detected anomalies

Cost Anomaly Detection keeps detected anomalies in the console even when they fall below the email threshold. The list can also be empty while new monitoring gathers enough data.

Before you check, do you expect this account to have a detected anomaly yet?

Choose Cost Anomaly Detection in the Billing and Cost Management navigation pane.
Choose Detected anomalies.

✔️ I see a detected anomaly

Select the anomaly's Start date.
Inspect Cost impact.
Inspect Impact %.
Inspect Top root cause.

You can now connect the unusual spending pattern with its cost effect plus its likely source.

ⓧ The list is empty

Confirm that the empty detection view has loaded.

This empty view is a valid result. It confirms that you reached the investigation view before an anomaly was detected.

Read the Fields as a Story

Cost impact frames the dollar effect of an anomaly.

Impact % frames the change against the expected spending pattern.

Top root cause points you toward the first source to investigate.

Confirm the complete operating state

A dependable response path needs both guardrails to remain available. This final check confirms that each warning still has somewhere useful to lead you.

Before you verify the setup, how many monitors plus daily subscriptions do you expect to find?

Return to Cost monitors.
Confirm that one AWS services monitor is listed.
Choose Alert subscriptions.
Confirm that one Daily summaries email subscription is listed.
Confirm that the subscription has an absolute total-cost-impact threshold of $1.

You should see one AWS services monitor. You should also see one Daily summaries subscription with a $1 absolute threshold.

Return to Budgets.
Open Monthly Cost Guardrail.
Confirm that the recurring monthly amount is $10.
Confirm that the Actual alert threshold is 80 percent.
Confirm that the Forecasted alert threshold is 100 percent.

The budget remains a recurring monthly $10 guardrail. Its Actual plus Forecasted alert thresholds remain ready for future spending.

That completes your response path. You can now move from either type of warning to the console details that explain it.

Secret mission

Tune Out Low-Signal Anomalies

Add a percentage condition to your daily anomaly subscription so emails require meaningful cost impact. Reopen the subscription to prove that both thresholds use AND logic.

Clean Up Your Resources

Choose whether to keep your cost guardrail active, pause its notifications, or delete its removable resources. The prescribed path has no ongoing charge.

Avoid Paid Reports

Budget monitoring is free through AWS Budgets. Budget notifications are also free on this project path.

AWS Budgets Reports cost $0.01 for each report delivered. This project did not create a report.

Resources you used:

One recurring AWS Budgets cost budget named Monthly Cost Guardrail.
One AWS services monitor in AWS Cost Anomaly Detection.
One Daily summaries email subscription with a $1 absolute threshold. The subscription also requires a 100% percentage threshold through AND logic.

AWS Cost Explorer remains enabled because AWS does not provide a disable option after activation.

Keep everything running

No action needed. Choose this if you want both email guardrails to keep watching the account.

Leave Monthly Cost Guardrail active.
Leave the AWS services cost monitor active.
Leave the Daily summaries email subscription active.

Your planned-spend alerts remain active. Your unusual-spend alerts remain active too.

Pause - I'll come back to this later

Deleting the two alerting resources stops their emails. Your Cost Explorer history stays available.

The budget controls the fixed-threshold emails.

Choose Budgets in the Billing and Cost Management navigation pane.
Select Monthly Cost Guardrail.
Choose Actions.
Choose Delete.
Choose Confirm.

The Budgets list should no longer show Monthly Cost Guardrail.

The daily subscription controls the anomaly emails.

Choose Cost Anomaly Detection in the Billing and Cost Management navigation pane.
Choose the Alert subscriptions tab.
Select the daily email subscription.
Choose Delete.
Confirm the deletion in the dialog.

The Alert subscriptions tab should no longer list the daily email subscription. The AWS services monitor should remain listed under Cost monitors.

Delete - I don't want to use this again

Deleting the removable guardrails is permanent. This project created no workloads that need deletion.

The budget is the first removable resource.

Choose Budgets in the Billing and Cost Management navigation pane.
Select Monthly Cost Guardrail.
Choose Actions.
Choose Delete.
Choose Confirm.

The Budgets list should no longer show Monthly Cost Guardrail.

The alert subscription is the next removable resource.

Choose Cost Anomaly Detection in the Billing and Cost Management navigation pane.
Choose the Alert subscriptions tab.
Select the daily email subscription.
Choose Delete.
Confirm the deletion in the dialog.

The Alert subscriptions tab should no longer list the daily email subscription.

The AWS services monitor is the final removable resource.

Choose the Cost monitors tab.
Select the AWS services monitor.
Choose Delete.
Confirm the deletion in the dialog.

The Cost monitors tab should no longer list the AWS services monitor. The Alert subscriptions tab should remain empty.

Cost Explorer remains enabled after this cleanup. Your account cost history stays available in the console.

Nice Work!

You did it! Your two-layer AWS cost guardrail is ready to track planned spending alongside unusual cost changes.

What you learned:

Establish a visible cost baseline through AWS Cost Explorer. Recognize its confirmed data-preparation state while current-month data becomes available.
Build a recurring $10 monthly budget in AWS Budgets. Separate an 80% Actual alert from a 100% Forecasted alert.
Monitor unusual service spend with an AWS services monitor in AWS Cost Anomaly Detection. Receive qualifying alerts in daily email summaries. Trace each detected anomaly from cost impact to root cause.
Secret Mission: Combine a $1 absolute threshold with a 100% percentage threshold through AND logic. This reduces low-signal anomaly emails.

Ready to quiz yourself?