AWS Billing Monitor

Proactive AWS cost monitoring and alerting system

📋 Overview

The AWS Billing Monitor is an automated solution that tracks AWS spending and alerts your team when costs change significantly. After experiencing billing incidents that weren't caught by existing monitoring solutions, this system was created to provide proactive cost oversight.

🚨 Problem Statement

There have been 2 incidents in the last few months that weren't triggered by our existing monitoring solutions. To prevent future billing surprises, we implemented aws-billing-monitor-production which tracks the Cost Explorer data daily and automatically alerts when costs deviate from expected patterns.

🏗️ Architecture

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   CloudWatch    │    │   Lambda         │    │   Cost Explorer │
│   Events        │───▶│   Function       │───▶│   API           │
│   (Daily)       │    │                  │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘
                                │
                                │
                    ┌───────────▼───────────┐
                    │                       │
                    ▼                       ▼
            ┌──────────────┐        ┌──────────────┐
            │     SNS      │        │    Slack     │
            │   (Email)    │        │   Webhook    │
            └──────────────┘        └──────────────┘

✨ Features

📊 Rolling 7-Day Comparison: Compares last 7 days vs previous 7 days for fair analysis
🎯 Configurable Thresholds: Alert when cost changes exceed specified percentage (default: 15%)
📧 Multi-Channel Alerts: Email (SNS) and Slack notifications
🔍 Service-Level Analysis: Identifies which AWS services are driving cost changes
📈 CloudWatch Dashboard: Monitor function performance and billing trends
🔒 Secure: Follows AWS security best practices with least-privilege IAM
🚀 Infrastructure as Code: Complete Terraform deployment

🛠️ Quick Start

Prerequisites

AWS CLI configured with appropriate permissions
Terraform >= 1.0 installed
Cost Explorer enabled in your AWS account
Email addresses for notifications
Slack webhook URL (optional)

1. Setup

Edit terraform.tfvars:

aws_region = "us-east-1"
environment = "production"
threshold_percentage = 1
email_addresses = [
  "sunil@xyz.com"
]
slack_webhook_url = "https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK"
lambda_schedule = "rate(1 day)"

3. Deploy

terraform init
terraform plan
terraform apply

4. Confirm Email Subscriptions

Check your email for AWS SNS confirmation messages and click the confirmation links.

5. Test

# Manual test
aws lambda invoke \
  --function-name aws-billing-monitor-production \
  --payload '{}' \
  response.json

# View logs
aws logs tail /aws/lambda/aws-billing-monitor-production --follow

📊 How It Works

Date Logic

The monitor uses rolling 7-day periods for fair comparison:

Today: Friday, Sept 13, 2025

Current Period:  [Sept 7] → [Sept 13]  (7 days)
Previous Period: [Aug 31] → [Sept 6]   (7 days)

This ensures equal comparison periods regardless of when the function runs.

Cost Analysis

Fetch Cost Data: Retrieves costs from AWS Cost Explorer API
Calculate Changes: Compares total costs and service-level costs
Threshold Check: Alerts if change exceeds configured percentage
Service Breakdown: Identifies which services changed most significantly

Sample Output

{
  "statusCode": 200,
  "body": {
    "message": "Billing analysis completed",
    "alert_sent": true,
    "total_current": "1250.45",
    "total_previous": "980.32",
    "percentage_change": 27.54
  }
}

🔧 Configuration

Environment Variables

Variable	Description	Default
`THRESHOLD_PERCENTAGE`	Alert threshold (%)	10
`SNS_TOPIC_ARN`	SNS topic for emails	-
`SLACK_WEBHOOK_URL`	Slack webhook URL	-

Terraform Variables

Variable	Description	Default
`threshold_percentage`	Alert threshold	15
`email_addresses`	Email list for alerts	[]
`slack_webhook_url`	Slack webhook	""
`lambda_schedule`	Execution schedule	"rate(1 day)"

Schedule Options

rate(1 day) - Daily at midnight UTC
rate(12 hours) - Twice daily
cron(0 9 ? * MON *) - Every Monday at 9 AM
cron(0 18 ? * FRI *) - Every Friday at 6 PM

📧 Alert Examples

Email Alert

Subject: AWS Billing Alert - Significant Cost Change

AWS Billing Alert - Significant Cost Change Detected

SUMMARY:
========
Current Period (2025-09-07 to 2025-09-13): $1,250.45
Previous Period (2025-08-31 to 2025-09-06): $980.32
Change: $270.13 (27.54%)

SERVICE-LEVEL CHANGES:
=====================

Amazon Elastic Compute Cloud - Compute:
  Current: $450.23
  Previous: $320.15
  Change: $130.08 (40.63%)

Amazon Simple Storage Service:
  Current: $89.45
  Previous: $65.23
  Change: $24.22 (37.12%)

Slack Alert

Rich Slack notifications with:

Color-coded alerts (red for increases, green for decreases)
Cost comparison tables
Service breakdown
Direct links to AWS Console

🔍 Monitoring

CloudWatch Dashboard

Access the dashboard at:

https://us-east-1.console.aws.amazon.com/cloudwatch/home?region=us-east-1#dashboards:name=aws-billing-monitor-production-dashboard

Log Analysis

# Real-time logs
aws logs tail /aws/lambda/aws-billing-monitor-production --follow

# Search for alerts
aws logs filter-log-events \
  --log-group-name /aws/lambda/aws-billing-monitor-production \
  --filter-pattern "Alert required"

# Error tracking
aws logs filter-log-events \
  --log-group-name /aws/lambda/aws-billing-monitor-production \
  --filter-pattern "ERROR"

🚨 Troubleshooting

Common Issues

1. Email Not Received

Check spam/junk folders
Confirm SNS subscription via email
Verify email addresses in terraform.tfvars

# Check subscription status
aws sns list-subscriptions-by-topic \
  --topic-arn $(terraform output -raw sns_topic_arn)

2. No Cost Data

Ensure Cost Explorer is enabled (24-hour delay for data)
Verify Lambda has Cost Explorer permissions
Check date ranges in logs

3. Permission Errors

# Test Cost Explorer access
aws ce get-cost-and-usage \
  --time-period Start=2025-01-01,End=2025-01-02 \
  --granularity DAILY \
  --metrics BlendedCost

4. Function Timeout

Increase timeout in Terraform (default: 300s)
Check for large number of services in account

Debug Commands

# Function status
aws lambda get-function --function-name aws-billing-monitor-production

# Manual invoke with logs
aws lambda invoke \
  --function-name aws-billing-monitor-production \
  --log-type Tail \
  --payload '{}' \
  response.json

# Test SNS
aws sns publish \
  --topic-arn $(terraform output -raw sns_topic_arn) \
  --subject "Test" \
  --message "Test message"

🔐 Security

IAM Permissions

The Lambda function uses minimal required permissions:

Cost Explorer read access
SNS publish to specific topic
CloudWatch Logs write access

Data Protection

No sensitive data in logs
Environment variables for configuration
Encryption at rest for SNS topics
VPC deployment option available

🚀 Advanced Usage

Custom Thresholds

Modify the Lambda function for service-specific thresholds:

service_thresholds = {
    'Amazon Elastic Compute Cloud - Compute': 20,  # 20% for EC2
    'Amazon Simple Storage Service': 15,            # 15% for S3
    'default': 10                                   # 10% for others
}

Multi-Account Monitoring

Deploy across multiple AWS accounts using cross-account roles.

Integration Examples

ServiceNow incident creation
Datadog metrics export
PagerDuty integration
Custom webhooks

📈 Cost Optimization

Lambda Costs

Estimated monthly cost: $2-5 (including logs, SNS)
Execution time: ~30-60 seconds daily
Memory: 256MB (optimized)

Data Retention

CloudWatch Logs: 14 days (configurable)
Cost Explorer: No additional charges

🤝 Contributing

Fork the repository
Create a feature branch
Make your changes
Test thoroughly
Submit a pull request

📝 Changelog

v1.0.0

Initial release with basic cost monitoring
Email and Slack notifications
Terraform deployment

v1.1.0

Added rolling 7-day comparison
Service-level cost breakdown
CloudWatch dashboard
Enhanced error handling

📞 Support

For issues or questions:

Check troubleshooting section above
Review CloudWatch logs
Open GitHub issue with logs and configuration

📄 License

MIT License - see LICENSE file for details.

Built with ❤️ to prevent billing surprises

Name		Name	Last commit message	Last commit date
Latest commit History 1 Commit
lambda		lambda
terraform		terraform
README.md		README.md

Folders and files

Latest commit

History

Repository files navigation