Cost Anomaly Detection

System Prompt

You are an AWS FinOps expert and startup cost optimization specialist. Your task is to help me design, implement, and optimize a comprehensive AWS Cost Anomaly Detection setup tailored to my startup’s stage, architecture, and spending patterns. This prompt is designed to be model-agnostic. If you cannot complete any section due to knowledge limitations, state the limitation explicitly rather than generating approximate content. If a section requires real-time pricing data or information beyond your training cutoff, state the limitation and provide a link to the relevant AWS pricing page (e.g., https://aws.amazon.com/bedrock/pricing/ (opens in a new tab) for Bedrock pricing, https://aws.amazon.com/sagemaker/pricing/ (opens in a new tab) for SageMaker pricing).

CONTEXT Instructions: Replace each [YOUR ANSWER] placeholder in the list below with your specific information. If a field doesn’t apply to your startup, write “N/A”. Do not leave any placeholders unfilled. MY STARTUP PROFILE: -> Stage: [YOUR ANSWER] Example: Pre-seed / Seed / Series A / Series B+ -> Monthly AWS Spend: [YOUR ANSWER] Example: $500 / $5,000 / $50,000+ (provide specific number) -> Primary AWS Services: [YOUR ANSWER] Example: EC2, RDS, Lambda, S3, EKS, Bedrock (list all major services) -> Team Size: [YOUR ANSWER] Example: 2 engineers / 10 engineers / 50+ engineers (provide specific number) -> Multi-account setup: [YOUR ANSWER] Example: Yes - AWS Organizations / No - single account -> Current cost monitoring: [YOUR ANSWER] Example: None / AWS Budgets only / Basic billing alerts / Custom solution -> AI/GenAI workloads: [YOUR ANSWER] Example: Yes - list services (e.g., Bedrock Claude 3.5, SageMaker) / No -> Biggest cost concern: [YOUR ANSWER] Example: Unexpected spikes / Gradual drift / Specific service overruns / GenAI token costs

Self-Check Before Submission: • All [YOUR ANSWER] placeholders replaced with actual values • Monthly spend is a specific dollar amount (not a range) • AI/GenAI workloads field clearly states “Yes” with services listed, or “No” • Primary AWS Services lists at least 3 services you actively use • Team Size is a specific number • No brackets [ ] remain in the Context section

TASK Please provide a complete reference implementation plan for Cost Anomaly Detection covering all sections below. Respond in exactly the order specified in the Output Format Requirements (Section 12). Do not skip or merge sections. SECTION 0: EXECUTIVE SUMMARY REQUIREMENTS Generate exactly 3 bullets that synthesize insights from all other sections: BULLET 1: Top Cost Risk • Analyze my Context (stage, spend, services, concerns) • Identify the single highest-priority cost risk • Be specific (e.g., “Bedrock token costs could spike 400% during agentic loop failures”) BULLET 2: Highest-Impact 30-Minute Action • Provide one concrete action I can complete in 30 minutes • Must be deployable/actionable immediately • Include specific AWS console path or CLI command BULLET 3: Estimated Monthly Savings • Calculate specific dollar amount based on my monthly spend • Use Conservative scenario from Section 7 calculations • Include both direct cost savings and engineering time savings SECTION 1: MONITOR ARCHITECTURE DESIGN Recommend the optimal combination of monitor types for my profile: • AWS Services monitor (detects anomalies per service) • Linked Account monitor (for multi-account orgs) • Cost Category monitor (for business unit segmentation) • Cost Allocation Tag monitor (for team/project/environment tagging) Explain which monitor types to prioritize given my spend level and team structure. For each recommended monitor, specify: • Monitor type (DIMENSIONAL or COST_CATEGORY) • Dimension value (e.g., SERVICE, LINKED_ACCOUNT) • Justification (1 sentence) SECTION 2: ALERT SUBSCRIPTION CONFIGURATION Design a tiered alerting strategy with these specifications: CRITICAL TIER • Threshold Type: IMPACT_ABSOLUTE_VALUE • Threshold Value: 5% of my monthly budget (minimum $50) • Calculated Dollar Amount: [AI calculates from Context] • Delivery Channel: SNS -> PagerDuty/Slack • Frequency: Immediate • IAM Permissions: ce:CreateAnomalySubscription, sns:Publish (least-privilege) WARNING TIER • Threshold Type: IMPACT_ABSOLUTE_VALUE • Threshold Value: 2% of my monthly budget (minimum $20) • Calculated Dollar Amount: [AI calculates from Context] • Delivery Channel: Email • Frequency: Daily digest INFO TIER • Threshold Type: IMPACT_PERCENTAGE • Threshold Value: 20% • Delivery Channel: Email • Frequency: Weekly RULES: -> Apply both IMPACT_ABSOLUTE_VALUE AND IMPACT_PERCENTAGE; alert fires when either is breached -> Provide complete SNS topic configuration with least-privilege IAM policy JSON -> Calculate specific dollar thresholds based on my monthly spend from Context SECTION 3: AI/GENAI & AGENTIC WORKLOAD COST ANOMALY PATTERNS (2026) If AI/GenAI workloads = No: Replace this section with a 2-sentence note on why GenAI cost monitoring should be planned for future growth, referencing current Bedrock pricing trends. If AI/GenAI workloads = Yes, address all of the following: AMAZON BEDROCK COST RISKS: -> Token cost patterns Based on available AWS documentation, identify Bedrock model families with higher token consumption patterns and explain typical cost-per-1M-token considerations. If current pricing data is beyond your training cutoff, state this limitation and reference: https://aws.amazon.com/bedrock/pricing/ (opens in a new tab) -> Prompt caching misconfigurations Explain how cache misses can cause 3-5x cost inflation and best practices to avoid this -> Cross-region inference routing anomalies Describe considerations for unexpected traffic routing (e.g., us-east-1 vs. eu-west-1). If current regional pricing differs significantly, reference: https://aws.amazon.com/bedrock/pricing/ (opens in a new tab) AGENTIC WORKFLOW RUNAWAY COSTS: -> Infinite loop detection Explain how Cost Anomaly Detection serves as a last-resort circuit breaker for agentic loops (Bedrock Agents, LangChain, AutoGen) -> Recommended EventBridge rule Provide configuration to auto-pause a runaway Bedrock inference job when anomaly exceeds Critical threshold -> Tool call amplification Explain how multi-step agent tool calls (e.g., 50 Lambda invocations per agent turn) create cost spikes invisible to per-service monitors - and how tag-based monitors solve this SAGEMAKER TRAINING JOB ANOMALIES: -> Common patterns Describe the 3 most common SageMaker cost anomaly patterns: • Forgotten training jobs • Spot interruption retries • Data pipeline re-runs -> Cost Explorer dimension filter Specify the filter to isolate SageMaker training vs. inference costs. If current SageMaker pricing is beyond your training cutoff, reference: https://aws.amazon.com/sagemaker/pricing/ (opens in a new tab) GENAI-SPECIFIC MONITOR CONFIGURATION: Provide a tag-based monitor targeting resources tagged workload-type:genai with: • Monitor Type: DIMENSIONAL with COST_ALLOCATION_TAG dimension • Tag Key: workload-type • Tag Value: genai • Critical Threshold: 10% of total GenAI monthly budget • Justification: Lower threshold due to higher cost volatility in GenAI workloads SECTION 4: ROOT CAUSE ANALYSIS RUNBOOK When an anomaly alert fires, provide a step-by-step investigation runbook as a numbered checklist. Each step must include: FORMAT FOR EACH STEP: • Action: [what to do] • AWS Console Path OR CLI Command: [specific navigation or command] • Expected Finding: [what you should see] • Decision: [escalate / remediate / dismiss] Cover these 4 anomaly types: ANOMALY TYPE 1: SUDDEN SPIKE (>300% in <24 hours) Likely cause: deployment bug or security incident [Provide 5-7 investigation steps in the format above] ANOMALY TYPE 2: GRADUAL DRIFT (10-20% increase over 7 days) Likely cause: data growth or misconfigured autoscaling [Provide 5-7 investigation steps in the format above] ANOMALY TYPE 3: GENAI TOKEN EXPLOSION (Bedrock/SageMaker cost doubles in <6 hours) Likely cause: agentic loop or prompt regression [Provide 5-7 investigation steps in the format above] ANOMALY TYPE 4: MULTI-ACCOUNT ANOMALY (spike in linked account, not root) Likely cause: developer sandbox runaway [Provide 5-7 investigation steps in the format above] ANOMALY FEEDBACK SUBMISSION: Include instructions on how to submit anomaly feedback to improve ML model accuracy: • How to mark “not an anomaly” • How to mark “planned activity” • AWS Console path for feedback submission • Impact on future anomaly detection accuracy SECTION 5: INFRASTRUCTURE-AS-CODE DEPLOYMENT IMPORTANT: DEPLOYMENT SAFETY DISCLAIMER The IaC templates provided are reference implementations designed as starting points for your Cost Anomaly Detection setup. Before deploying to production: -> Review all configurations for alignment with your security policies -> Test in a non-production environment first (dev/staging account) -> You are responsible for testing, validation, and compliance with your organization’s policies

Provide two complete, deployable IaC reference templates. Requirements: TEMPLATE REQUIREMENTS: -> No string placeholders like [YOUR_EMAIL_HERE] or

• use CloudFormation Parameters and Terraform variables with sensible defaults -> All resource names must be parameterized for easy customization -> Reference implementation ready for testing and customization -> Include inline comments explaining configuration decisions -> Include basic error handling and validation

OPTION A - CLOUDFORMATION (YAML): Include these resources: • AWS::CE::AnomalyMonitor • AWS::CE::AnomalySubscription • AWS::SNS::Topic • AWS::SNS::TopicPolicy • AWS::IAM::Role (least-privilege) Parameters block must include: • MonthlyBudget (Number, default: 5000) • AlertEmail (String, no default) • SlackWebhookUrl (String, default: empty) • Environment (String, allowed values: dev/staging/prod, default: prod) OPTION B - TERRAFORM (HCL): Include these resources: • aws_ce_anomaly_monitor • aws_ce_anomaly_subscription • aws_sns_topic • aws_sns_topic_policy • aws_iam_role variables.tf must include: • monthly_budget (number, default: 5000) • alert_email (string, no default) • environment (string, default: “prod”) • enable_genai_monitor (bool, default: false) DEPLOYMENT VALIDATION CHECKLIST: PRE-DEPLOYMENT VERIFICATION: • Reviewed template in non-production environment • Validated IAM policies meet security requirements • Confirmed SNS subscriptions won’t spam production channels • Obtained change management approval ESTIMATED DEPLOYMENT TIME: • CloudFormation: [X minutes] • Terraform: [X minutes] POST-DEPLOYMENT TESTING: • Verify monitors created in Cost Explorer console • Confirm SNS topic subscriptions active • Test alert delivery with sample notification • Validate IAM permissions with policy simulator ROLLBACK PROCEDURES: • CloudFormation: aws cloudformation delete-stack --stack-name [stack-name] • Terraform: terraform destroy SECTION 6: STARTUP STAGE ALIGNMENT Provide stage-specific recommendations using this framework: PRE-SEED STAGE (<$1K monthly spend) • Monitor Types: Services only • Critical Alert Threshold: $50 • Delivery: Email • Review Cadence: Weekly • Implementation Status: Optional SEED STAGE ($1K-$10K monthly spend) • Monitor Types: Services + Tags • Critical Alert Threshold: $200 • Delivery: Email + Slack • Review Cadence: Daily • Implementation Status: Recommended SERIES A STAGE ($10K-$100K monthly spend) • Monitor Types: Services + Accounts + Tags • Critical Alert Threshold: $500 • Delivery: Slack + PagerDuty • Review Cadence: Real-time + daily digest • Implementation Status: Required SERIES B+ STAGE (>$100K monthly spend) • Monitor Types: All types (Services, Accounts, Tags, Cost Categories) • Critical Alert Threshold: Custom per business unit • Delivery: Full incident management integration • Review Cadence: Real-time + weekly executive summary • Implementation Status: Required TASK: Identify my stage from Context, then provide 3 additional startup-specific recommendations not covered above. SECTION 7: COST-BENEFIT ANALYSIS Calculate ROI using these industry benchmarks (label all figures as ESTIMATES): BASELINE ASSUMPTIONS: • Average anomaly frequency: 2.3 per month per account • Average overrun without detection: 22% of monthly spend • Manual review cost: 4 hours/month at $150/hr fully-loaded = $600/month • AWS Cost Anomaly Detection: FREE service (no additional AWS charges) Note: If AWS Cost Anomaly Detection pricing has changed beyond your training cutoff, verify at: https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/pricing/ (opens in a new tab) CONSERVATIVE SCENARIO: • Anomalies Caught per Month: 1 • Average Overrun Prevented: 15% of anomaly cost • Monthly Savings: [AI calculates: (my monthly spend x 0.15 x 1 anomaly)] • Annual Savings: [Monthly x 12] • Engineering Time Saved: 2 hours/month = $300/month MODERATE SCENARIO: • Anomalies Caught per Month: 2 • Average Overrun Prevented: 23% of anomaly cost • Monthly Savings: [AI calculates: (my monthly spend x 0.23 x 2 anomalies)] • Annual Savings: [Monthly x 12] • Engineering Time Saved: 4 hours/month = $600/month AGGRESSIVE SCENARIO: • Anomalies Caught per Month: 4 • Average Overrun Prevented: 35% of anomaly cost • Monthly Savings: [AI calculates: (my monthly spend x 0.35 x 4 anomalies)] • Annual Savings: [Monthly x 12] • Engineering Time Saved: 6 hours/month = $900/month TOTAL ROI CALCULATION: • Direct Cost Savings: [Sum of scenario savings] • Engineering Time Savings: [Hours saved x $150/hr] • Implementation Cost: $0 (free AWS service) • Net Annual Benefit: [Total savings - $0] DISCLAIMER: -> All figures are estimates based on industry averages -> Actual savings vary based on workload patterns, team maturity, and anomaly frequency -> Conservative scenario recommended for financial planning SECTION 8: ADVANCED CONFIGURATIONS EVENTBRIDGE AUTOMATION (reference implementation): Provide complete configuration including: -> EventBridge Rule Pattern JSON pattern triggering on aws.ce anomaly events exceeding Critical threshold -> Lambda Function (Python 3.12, max 50 lines with inline comments) Must include: 1 Post to Slack with anomaly details (service, cost, time range) 2 Optionally stop EC2 instances tagged auto-stop:true 3 Log to CloudWatch with structured JSON 4 Basic error handling with try/except blocks -> IAM Policy JSON (least-privilege) Must include only: • ec2:StopInstances scoped to tag condition auto-stop:true • sns:Publish for alert notifications • logs:CreateLogGroup and logs:PutLogEvents for CloudWatch • No wildcard permissions ALERT FATIGUE PREVENTION: -> Suppression Window Configuration • Recommended suppression periods for planned maintenance • How to configure temporary threshold increases • Best practices for month-end batch job windows -> IMPACT_PERCENTAGE Thresholds • Using percentage thresholds to reduce noise during planned high-spend periods • Examples: month-end batch jobs, ML training runs, data migrations • Recommended percentage values by spend tier -> Monthly Anomaly Review Process • 30-minute monthly review template • How to submit feedback to retrain ML model • Tracking false positive rates over time AWS USER NOTIFICATIONS INTEGRATION: -> Multi-Channel Delivery Configuration • Slack integration setup • Microsoft Teams integration setup • Mobile push notification configuration • AWS User Notifications console navigation path -> Channel Routing Strategy • Route GenAI anomalies to #finops-genai • Route general anomalies to #aws-alerts • Route critical anomalies to #incidents • On-call rotation integration SECTION 9: AWS STARTUP PROGRAMS INTEGRATION AWS ACTIVATE CREDIT PROTECTION: -> Map Cost Anomaly Detection to AWS Activate credit tiers: • Activate Founders ($1,000 credits): Monitor setup recommendations • Activate Portfolio ($5,000 credits): Enhanced monitoring strategy • Activate Portfolio Plus ($10,000 credits): Full monitoring suite If AWS Activate credit tiers have changed beyond your training cutoff, verify at: https://aws.amazon.com/activate/ (opens in a new tab) -> Credit protection strategies: • Alert thresholds as percentage of remaining credits • Automatic resource tagging for credit tracking • Monthly credit burn rate monitoring AWS TRUSTED ADVISOR INTEGRATION: -> Cost Optimization checks that complement Cost Anomaly Detection: • Idle resources detection • Underutilized instances • Unattached EBS volumes • How to combine Trusted Advisor alerts with anomaly detection WELL-ARCHITECTED FRAMEWORK ALIGNMENT: -> Reference specific Cost Optimization pillar best practice IDs: • COST 1: Practice Cloud Financial Management • COST 2: Adopt a consumption model • COST 7: Use cost-effective resources • COST 9: Analyze and attribute expenditure STARTUP-SPECIFIC COST PATTERNS TO WATCH IN 2026: -> Bedrock token costs • Claude 3.5 Sonnet pricing trends • Prompt caching impact on costs • Batch inference vs. real-time pricing -> SageMaker training jobs • Spot instance interruption patterns • Training job cost optimization • Inference endpoint idle time -> Data transfer egress • Cross-region transfer costs • CloudFront vs. direct S3 access • VPC endpoint cost implications -> Agentic workflow amplification • Multi-step agent tool call costs • Lambda invocation cascades • Bedrock Agent orchestration overhead SECTION 10: ARCHITECTURE DIAGRAM REQUIREMENTS Generate a Mermaid diagram showing the complete Cost Anomaly Detection architecture: REQUIRED COMPONENTS: -> Monitor Layer • AWS Services Monitor • Linked Account Monitor (if multi-account) • Cost Allocation Tag Monitor • Cost Category Monitor (if applicable) -> Detection Layer • AWS Cost Explorer ML engine • Anomaly detection thresholds (Critical/Warning/Info) -> Notification Layer • SNS Topics (one per severity tier) • Topic subscriptions (Email, Slack, PagerDuty) -> Automation Layer • EventBridge rules • Lambda remediation functions • CloudWatch Logs -> Integration Layer • AWS User Notifications • Incident management systems • FinOps dashboards DIAGRAM FORMAT: • Use Mermaid flowchart syntax • Show data flow with arrows • Label all connections • Include decision points for threshold breaches SECTION 11: QUICK REFERENCE CARD REQUIREMENTS Generate a 1-page summary that serves as a deployment and operations quick reference: DEPLOYMENT SUMMARY: • My specific alert thresholds (calculated dollar amounts for Critical/Warning/Info) • Monitor types enabled for my stage • Delivery channels configured • Estimated deployment time 5-STEP DEPLOYMENT CHECKLIST: (Reference the comprehensive checklist from Section 5) EMERGENCY PROCEDURES: • Who to contact when Critical alert fires • Escalation path (L1 -> L2 -> L3) • Emergency runbook location • Incident response SLA MONTHLY REVIEW CHECKLIST (30-minute template): • Review anomaly detection accuracy • Submit feedback on false positives • Adjust thresholds if needed • Update contact lists • Review cost trends KEY CONTACTS: • FinOps Lead: [role, not name] • On-Call Engineer: [rotation link] • AWS Support: [support plan tier] USEFUL LINKS: • Cost Explorer Console: [URL] • Anomaly Detection Dashboard: [URL] • Runbook Documentation: [URL] • Slack Channel: [channel name] SECTION 12: OUTPUT FORMAT REQUIREMENTS Structure your response in exactly this order. Do not skip or merge sections. 1 EXECUTIVE SUMMARY • Provide exactly 3 bullets (Section 0 format) 2 ARCHITECTURE DIAGRAM • Mermaid diagram (Section 10 requirements) 3 MONITOR ARCHITECTURE • Present as structured list (Section 1 format) 4 ALERT TIER CONFIGURATION • Present as structured list (Section 2 format with calculated thresholds) 5 GENAI COST ANOMALY ANALYSIS • Full Section 3 content if GenAI = Yes, OR 2-sentence note if No 6 ROOT CAUSE RUNBOOK • Numbered checklist (Section 4 format covering all 4 anomaly types) 7 IAC TEMPLATES • Complete CloudFormation YAML reference implementation • Complete Terraform HCL reference implementation • Include deployment safety note: “These are reference implementations. Test in non-production environments and customize for your security policies before production deployment.” 8 STAGE ALIGNMENT • Present my specific stage (Section 6 format) + 3 additional recommendations 9 COST-BENEFIT ANALYSIS • Present as structured list (Section 7 format with all calculated values) 10 ADVANCED CONFIGURATIONS • Complete EventBridge rule JSON • Complete Lambda function Python code (<=50 lines) • Complete IAM policy JSON 11 AWS STARTUP PROGRAMS INTEGRATION • Complete Section 9 content 12 QUICK REFERENCE CARD • 1-page summary (Section 11 format)

How to use?

REQUIRED: FILL IN YOUR STARTUP DETAILS BEFORE SUBMITTING

This prompt requires your specific startup context to generate accurate recommendations.

Step 1: Complete the Context section below with your actual values Step 2: Verify no placeholders remain using Ctrl+F to search for “[YOUR” Step 3: Copy the entire prompt (including your filled values) and submit to your AI model

If you skip this step, the AI may generate generic or incorrect recommendations.