Skip to main content

Anomaly Detection

This is an optional add-on to the AWS CLI setup — complete that guide first. It provisions an AWS-managed Cost Anomaly Detection monitor on the management account, so Infracost can surface AWS-detected cost anomalies alongside your cost data.

Check for an existing monitor first​

AWS allows only one managed SERVICE-dimension, DIMENSIONAL-type Cost Anomaly Detection monitor per account — many accounts already have one (for example, a Default-Services-Monitor created via the Cost Explorer console).

aws ce get-anomaly-monitors --query \
  "AnomalyMonitors[?MonitorType=='DIMENSIONAL' && MonitorDimension=='SERVICE'].MonitorArn" \
  --output text

If that returns an ARN, leave it in place — do not create a second one, it will fail. No further action is needed: Infracost discovers and reads it automatically via the ce:Describe*/ce:Get*/ce:List* permissions already granted in the core setup guide.

Step 1: Create the monitor​

If the command above returned nothing:

aws ce create-anomaly-monitor \
  --anomaly-monitor MonitorName=InfracostServicesMonitor,MonitorType=DIMENSIONAL,MonitorDimension=SERVICE \
  --no-cli-pager

No alert subscription is needed — Infracost reads detected anomalies directly via the cross-account role, so skip create-anomaly-subscription.

note

If you are managing a custom cross-account role instead of following the core setup guide exactly, ensure it has the ce:GetAnomalyMonitors and ce:GetAnomalies permissions.

Removing​

MONITOR_ARN=$(aws ce get-anomaly-monitors --query \
  "AnomalyMonitors[?MonitorName=='InfracostServicesMonitor'].MonitorArn" --output text)
aws ce delete-anomaly-monitor --monitor-arn "$MONITOR_ARN"

Only do this if you created the monitor for Infracost and nothing else in your account depends on it. If you used a pre-existing monitor, leave it in place.

Troubleshooting​

create-anomaly-monitor fails with a ValidationException about an existing monitor​

See Check for an existing monitor first above — leave the existing monitor in place instead of creating a new one.