Implement Budget Alerts for Central Accounts

Create AWS Budgets with SNS-backed alerts for all central Landing Zone accounts (Management, Security, Log Archive, Network) to detect unexpected cost increases early. Complement static budget thresholds with AWS Cost Anomaly Detection for intra-month spike detection that threshold-based budgets alone cannot catch.

Central accounts typically have stable, predictable cost profiles. Any meaningful deviation is worth investigating as it may indicate log bombing, a misconfigured service, unauthorized resource creation, or an active security incident.

Two complementary detection layers are required:

1. AWS Budgets - threshold-based alerting

Configure monthly cost budgets per central account with notifications at:

• 80% of budget: early warning
• 100% of budget: missconfiguration or breach confirmed
• 100% forecasted: proactive alert before the month ends

Use SNS topics (not raw email) as the notification target so alerts can be routed to your incident management tooling (PagerDuty, Slack, etc.) via Lambda or EventBridge.

2. AWS Cost Anomaly Detection - ML-based spike detection

Static budget thresholds only fire when cumulative monthly spend crosses a boundary. A sudden spike on day 3 of the month (e.g., 10x normal daily spend) may not breach the monthly threshold but still warrants immediate investigation. Cost Anomaly Detection uses ML to baseline per-service spend patterns and alerts on deviations regardless of where you are in the billing cycle.

Create one Anomaly Monitor per central account scoped to LINKED_ACCOUNT and configure an Anomaly Subscription with a minimum impact threshold (e.g., $50 absolute or 20% relative) to avoid alert fatigue from minor fluctuations.