c1.10 Set billing and cost-anomaly alarms
A sudden spike in spend is often the first visible sign of a compromise (cryptomining, botnets). Alarm on unexpected cost so the security team hears about it early — not on the next invoice.
Implementation guidance
Why cost is a security signal
When an attacker gets into an account, they frequently spin up expensive compute to mine cryptocurrency or run a botnet. That shows up as a cost spike before anything else, so billing alarms are a cheap, high-value early-warning tripwire.
Two complementary approaches
- CloudWatch billing alarms — set a threshold alarm on estimated charges. Alarm on the total bill and on compute services (EC2, ECS, EKS, Lambda), not just the security services.
- AWS Cost Anomaly Detection — uses machine learning to flag unusual spend without you setting thresholds, and helps with root-cause analysis. It is free.
Route the alert where it will be seen
Send alarms to an actively monitored destination — a distribution list of two or more people, SMS, or a chat channel — and make sure the security team receives them, not only FinOps. A cost alarm nobody reads is not a control.
Create a billing alarm with the CLI
Estimated-charges metrics live in us-east-1. Alarm when the total bill crosses a threshold and notify an SNS topic the security team subscribes to:
aws cloudwatch put-metric-alarm \
--region us-east-1 \
--alarm-name "billing-total-over-threshold" \
--namespace "AWS/Billing" --metric-name EstimatedCharges \
--dimensions Name=Currency,Value=USD \
--statistic Maximum --period 21600 --evaluation-periods 1 \
--threshold 500 --comparison-operator GreaterThanThreshold \
--alarm-actions arn:aws:sns:us-east-1:111122223333:billing-alertsHow to validate
- Are billing alarms configured on the total bill and on compute services (not only security services)?
- Do the alarms reach the security team, or only FinOps?
- Do they reach more than one person (a distribution list)?
Threats addressed
- A cost spike is an early, hard-to-hide signal of abuse — for example an attacker running cryptomining or launching resources for a botnet. Alarming on unexpected spend detects the compromise sooner and caps the financial damage.
AWS services
AWS Budgets 
Amazon CloudWatch Pricing
AWS Cost Anomaly Detection is free. The CloudWatch alarms and SNS notifications it triggers have a small cost. See CloudWatch pricing.