aws-cost-anomaly-triagelisted

# AWS Cost Anomaly Triage This skill encodes the internal SOP our FinOps team uses when an AWS cost anomaly is raised. Apply it whenever you see a cost spike alert, an unfamiliar line item on the bill, or a customer-reported overage. ## When to invoke - An anomaly is reported by AWS Cost Anomaly Detection (email, Slack, EventBridge) - Month-over-month spend on any service rises by more than the threshold in `resources/thresholds.md` - A customer or team asks "why is my AWS bill higher than expected" ## Triage workflow Follow these steps **in order**. Do not skip ahead even if the cause seems obvious — early steps surface confounding factors that shape later recommendations. ### Step 1 — Bound the anomaly 1. Identify the **time window** (start, end, ongoing?). Use Cost Explorer `GetCostAndUsage` grouped by `SERVICE` over the past 30 days at daily granularity. 2. Identify the **scope**: account, region, service, usage type, linked account, or tag dimension. Always confirm the anomaly persists when you remove plausible confounders (RI/SP amortization, credits, refunds — see `resources/confounders.md`). 3. Quantify: absolute $ delta and % delta. If <$50 or <5%, downgrade to monitoring rather than active triage. ### Step 2 — Classify Match against the patterns in `resources/anomaly-patterns.md`. The common ones in order of frequency: - Compute scale-up (EC2/Fargate/Lambda) - Data transfer (especially cross-AZ and NAT GW egress) - Storage growth (S3 standard