Cost Alerts — Budgets, Anomaly Detection & Slack
Cost allocation tags, tiered budget alerts, ML-based anomaly detection, and Slack notifications via AWS Chatbot.
Directory: global/cost-alerts/
Files: tags.tf, budgets.tf, anomaly-detection.tf, slack-notifications.tf, providers.tf, variables.tf
What It Manages
Cost Allocation Tags
Activates the Ontopix tag taxonomy in AWS Cost Explorer so costs can be broken down by tag in billing reports.
Taxonomy tags (standard set all teams follow):
billing-mode · client · component · cost-center · env · owner · product · project · source · team
Budget
| Property | Value |
|---|---|
| Budget name | My Monthly Cost Budget |
| Monthly limit | $500 USD |
| Spending baseline | $150–250/month |
Alert Thresholds
| Threshold | Forecasted | Actual |
|---|---|---|
| 50% ($250) | Normal ceiling signal | Reached normal ceiling |
| 80% ($400) | Trending above normal | Well above normal |
| 100% ($500) | Will exceed budget | Budget exceeded |
| 150% ($750) | — | Significant overshoot |
All thresholds notify via email + SNS (which routes to Slack).
Cost Anomaly Detection
ML-based per-service anomaly detection using aws_ce_anomaly_monitor (DIMENSIONAL/SERVICE).
| Property | Value |
|---|---|
| Monitor | ontopix-service-anomaly-monitor |
| Frequency | IMMEDIATE |
| Threshold | $25 absolute impact (~10% of normal monthly spend) |
| Subscriber | SNS topic only (IMMEDIATE frequency limits to one subscriber) |
Slack Integration (AWS Chatbot)
Budget Alerts ──→ SNS Topic (us-east-1) ──→ AWS Chatbot ──→ Slack #infra
Anomaly Alerts ─┘
| Component | Resource |
|---|---|
| SNS Topic | ontopix-cost-alerts in us-east-1 |
| Chatbot | ontopix-cost-alerts channel config |
| IAM Role | ontopix-chatbot-cost-alerts |
The SNS topic must be in us-east-1 — this is an AWS requirement for both Budgets and Cost Anomaly Detection (see P-003).
Prerequisites: The Slack workspace must be authorized in the AWS Chatbot console before Terraform can manage channel configurations. This is a one-time manual step.
Variables
| Variable | Type | Default | Description |
|---|---|---|---|
budget_start_date | string | "2026-03-01_00:00" | Start date for budget tracking |
budget_alert_emails | list(string) | Configured list | Email addresses for alerts |
budget_alert_slack | object | Configured | Slack workspace and channel IDs |
The budget_alert_slack variable:
{
workspace_id = "T..." # Slack workspace ID
channel_id = "C..." # Slack channel ID
}
Set to null to disable Chatbot resources while keeping SNS and email alerts active.
Provider Requirements
This module requires a aws.us_east_1 provider alias, passed from the root module. See providers.tf for the configuration alias declaration.