Cost Anomaly Alerts That Reach Somebody
AWS Cost Anomaly Detection with monitors and the alerts that make them useful. A monitor alone leaves anomalies in the console; AWS sends immediate alerts only over SNS and summaries only by email, so this module builds both, with a topic encrypted by a key the service may use. It needs a cost threshold, and says an account holds one AWS services monitor.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-16 · how we verify
Use it from the registry
terraform · opentofumodule "cost_anomaly_detection" {
source = "www.iac-bazaar.com/iac-bazaar/aws-cost-anomaly-detection/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-cost-anomaly-detection
AWS Cost Anomaly Detection. Works with Terraform and OpenTofu (>= 1.6),
aws provider >= 6.0, < 7.0.
A monitor alone tells nobody. Anomalies it finds stay in the console until
an alert subscription sends them. AWS delivers individual alerts only through an
SNS topic, and daily or weekly summaries only by email, so this module creates
an immediate subscription with its own topic and, when you list recipients, an
email summary. It refuses a configuration with no subscription at all, but a
topic nobody subscribes to still reaches nobody: add immediate_alert_emails
or connect a chat integration to sns_topic_arn.
The topic is encrypted with a key Cost Anomaly Detection can use. AWS's
instructions for encrypted topics grant costalerts.amazonaws.com a customer
managed key. The key and topic policies both limit the service to this account.
Email subscribers to the topic must confirm before anything arrives
(pending_email_confirmations).
One AWS services monitor per account. If the account already has one,
creating another fails: set create_services_monitor = false and pass the
existing monitor's ARN. Linked account monitors can only be created in the
organisation's management account.
A threshold is required. The default alerts on anomalies with $100 or more of
total cost impact; threshold_percentage adds a relative threshold, and either
one alerts.
Not real time. AWS detects an anomaly up to 24 hours after the usage.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-budgets
A budget with no notification tracks correctly and tells nobody, so the invoice is the first notice; ACTUAL-only alerts arrive after the money is gone. And include_credit defaults true, so a budget on a credited account reports runway rather than spend - until the credits end and nothing crosses a threshold.
aws-control-tower
A Control Tower landing zone from a manifest the module writes: the governed regions (the only usable ones), the Security and Sandbox units, centralized logging in the log archive account you name kept a year (access logs ten) under your KMS key (the AWS-managed key by name), the audit account, Identity Center access, and the controls you map to organizational units.
aws-account-baseline
The IAM password policy, S3 account-wide Block Public Access and, per region, default EBS encryption, snapshot and AMI sharing blocks, IMDSv2 as the default and the serial console off. Five of these are per region, so the module covers a list. The password policy follows NIST SP 800-63-4, and the module says which settings destroying it turns back off.
aws-organizations
The organization, its organizational units, member accounts and the service control policies attached to them. Root attachment is off by default, because an SCP sets the ceiling on what anybody may do - including the account root user who would have to undo it.