How to set up cloud cost alerts: a step-by-step guide

Why You Need Alerts, Not Just Dashboards

Cloud cost dashboards are passive. You have to remember to look at them. By the time the monthly AWS bill arrives and you see the spike, the damage is done — you’ve spent the money, and the most you can do is track down what caused it.

Cost alerts flip the model: instead of you checking the dashboard, the system tells you when something changes. The goal is to detect runaway spend within hours, not at end-of-month billing.

This guide walks through setting up cloud cost alerts on AWS, GCP, and Azure — from basic budget notifications to anomaly detection that catches unusual patterns before they compound.

AWS: Three Layers of Cost Alerting

AWS offers three distinct alerting mechanisms, and you should use all three. They catch different types of spend problems.

Layer 1: AWS Budgets

AWS Budgets lets you define a spending threshold and get notified when you hit it. This is the baseline — every AWS account should have at least one budget alert.

Set up a monthly account-level budget:

1. Go to AWS Budgets → Create a budget
2. Choose “Cost budget” and set your monthly threshold (start with 110% of your average spend)
3. Add alert thresholds: 80% (warning), 100% (critical), 120% (emergency)
4. Add notification targets: email and/or SNS topic (for Slack integration)

Better: service-level budgets with tags

Account-level budgets tell you the bill is high. Service-level budgets tell you which service is responsible:

aws budgets create-budget   --account-id $ACCOUNT_ID   --budget '{
    "BudgetName": "EC2-Production-Monthly",
    "BudgetLimit": {"Amount": "5000", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST",
    "CostFilters": {
      "Service": ["Amazon Elastic Compute Cloud - Compute"],
      "TagKeyValue": ["user:Environment$production"]
    }
  }'   --notifications-with-subscribers '[{
    "Notification": {
      "NotificationType": "ACTUAL",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 100,
      "ThresholdType": "PERCENTAGE"
    },
    "Subscribers": [{
      "SubscriptionType": "SNS",
      "Address": "arn:aws:sns:us-east-1:123456789:cost-alerts"
    }]
  }]'

Tag your resources consistently — Environment: production, Team: platform, Service: api — and you can create targeted budgets that attribute spend to teams and services automatically.

Layer 2: AWS Cost Anomaly Detection

Budgets catch spend that exceeds a fixed threshold. They don’t catch unusual spend patterns — a service that suddenly spends 5x its normal amount but is still under the absolute budget threshold.

Cost Anomaly Detection uses machine learning to establish a baseline for each service and alert when spend deviates significantly:

1. Go to AWS Cost Management → Cost Anomaly Detection
2. Create a monitor for each AWS service (or start with “AWS services” to catch all)
3. Set an alert threshold: alert when anomaly exceeds $50 (adjust based on your scale)
4. Add SNS notification for real-time alerting

A practical threshold for most startups: $50 anomaly or 20% above baseline, whichever is lower. This catches a forgotten GPU instance or a data transfer spike without too many false positives.

Layer 3: CloudWatch Billing Alarms

CloudWatch billing alarms are the simplest to set up and the fastest to trigger — they alert on estimated charges every 6 hours, not daily like Budgets.

# Enable billing alerts (one-time setup per account)
aws ce update-cost-allocation-tags-status

# Create a CloudWatch billing alarm
aws cloudwatch put-metric-alarm   --alarm-name "TotalEstimatedCharges-500"   --alarm-description "Alert when estimated monthly charges exceed $500"   --metric-name EstimatedCharges   --namespace AWS/Billing   --statistic Maximum   --period 86400   --threshold 500   --comparison-operator GreaterThanThreshold   --dimensions Name=Currency,Value=USD   --evaluation-periods 1   --alarm-actions arn:aws:sns:us-east-1:123456789:cost-alerts   --treat-missing-data notBreaching

Note: billing metrics are only available in us-east-1. Always create billing alarms in that region regardless of where your workloads run.

---

See the IAN team run on your cloud. We connect to your AWS account via a scoped read-only role, run the Observe-tier agents, and leave you with a concrete audit report — cost waste, security exposure, compliance gaps, and a labor-offset estimate. You keep the findings regardless of next steps. Get a free infrastructure audit →

---

Routing Alerts to Slack

Email notifications get ignored. Route cost alerts to a dedicated Slack channel so they’re visible to the team.

The pattern: AWS Budget → SNS topic → Lambda function → Slack webhook.

# Lambda function: forward SNS cost alert to Slack
import json
import urllib.request

SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"

def lambda_handler(event, context):
    sns_message = event['Records'][0]['Sns']['Message']
    alert_data = json.loads(sns_message)

    # Format the Slack message
    text = f"""
:rotating_light: *Cloud Cost Alert*
Budget: {alert_data.get('budgetName', 'Unknown')}
Account: {alert_data.get('accountId', 'Unknown')}
Actual: ${alert_data.get('actualSpend', {}).get('amount', 'N/A')}
Threshold: ${alert_data.get('budgetLimit', {}).get('amount', 'N/A')}
    """.strip()

    payload = json.dumps({"text": text}).encode()
    req = urllib.request.Request(
        SLACK_WEBHOOK_URL,
        data=payload,
        headers={"Content-Type": "application/json"}
    )
    urllib.request.urlopen(req)
    return {"statusCode": 200}

GCP: Budget Alerts and Recommender

GCP’s cost alerting is simpler than AWS’s but covers the essentials.

Set up a billing budget:

1. Go to Billing → Budgets & alerts → Create budget
2. Scope to a project or all projects
3. Set alert thresholds at 50%, 90%, and 100% of budget
4. Enable email notifications and Pub/Sub topic for programmatic handling

GCP also offers Cost Recommender — it proactively identifies idle VMs, oversized instances, and committed use discount opportunities. Unlike budget alerts (which are reactive), Recommender runs continuously and surfaces optimization suggestions without you having to ask.

Enable the Recommender API and check recommendations weekly:

gcloud recommender recommendations list   --project=my-project   --location=global   --recommender=google.compute.instance.MachineTypeRecommender   --format="table(name,description,stateInfo.state,primaryImpact.costProjection.cost.units)"

Azure: Cost Alerts and Advisor

Azure Cost Management supports both budget alerts and anomaly alerts:

1. Go to Cost Management → Budgets → Add
2. Set scope (subscription, resource group, or resource)
3. Configure alert conditions at 80% and 100% of budget
4. Add action groups with email, SMS, or webhook notification

Azure Advisor is the equivalent of AWS Trusted Advisor — it generates cost optimization recommendations automatically. Check Advisor recommendations regularly; they identify idle VMs, unattached disks, and reserved instance opportunities.

Building a Cost Alert Runbook

An alert without a runbook is noise. Before you go live, write a short runbook for each alert type:

Alert	First Action	Common Causes	Resolution
EC2 spend anomaly	Check running instance count vs baseline	Forgot-to-stop dev instance, autoscaling runaway, spot interruption cycle	Stop idle instances, review ASG config
S3 transfer spike	Check S3 access logs for egress destination	DDoS or scraper hitting your bucket, new feature shipping large assets	Enable S3 request metrics, add CloudFront, enable public access block
RDS cost spike	Check RDS storage and instance count	Multi-AZ failover in wrong region, backup retention increase, storage autoscaling	Review RDS config, check backup window
Data transfer alert	Run Cost Explorer, filter by data transfer	Cross-AZ traffic from new service, NAT gateway inefficiency	Move services to same AZ, use VPC endpoints

How IAN Automates Cost Alerting

Manual alert setup works for a handful of accounts. At scale — multiple AWS accounts, GCP projects, Azure subscriptions — maintaining alerts becomes its own operational burden.

IAN connects to your cloud accounts and:

1. Applies a standard alerting baseline automatically — budget alerts, anomaly detection, and CloudWatch billing alarms configured consistently across all accounts
2. Correlates alerts with deployments — when a cost spike occurs, IAN identifies which infrastructure change or deployment caused it
3. Surfaces idle resource alerts — proactively identifies instances, databases, and storage that are running but unused, before they show up in the bill
4. Routes alerts with context — Slack notifications include the specific resource, the responsible team tag, and a suggested remediation — not just “your bill is high”
5. Tracks alert coverage — reports which services and accounts lack cost alert coverage, so gaps don’t persist silently

Cost alerts are table stakes. The harder problem is knowing what to do when they fire.

Set Up Your First Cost Alert Today

Start with a single account-level monthly budget alert. It takes five minutes and will catch the most common cost overrun scenario: a forgotten resource that nobody noticed. Expand to service-level budgets and anomaly detection once the baseline is in place.

Get a free infrastructure audit → | See pricing →