How can I monitor daily EstimatedCharges and activate a CloudWatch alarm based on my usage threshold?

Short description

The EstimatedCharges metric is published at approximately 6-hour intervals. The results reset every month. Use the MetricMath RATE expression to calculate the EstimatedCharges value for each day. To calculate MetricMath RATE, divide the difference between the latest data point value and the previous data point value. Then, divide by the time difference in seconds between the two values.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you use the most recent AWS CLI version.

Use the AWS Management Console to create a CloudWatch alarm

Complete the following steps:

1. Create a CloudWatch alarm based on a metric math expression.
2. In the navigation pane, under Metrics, choose All metrics.
3. On the of the Metrics page, enter the following code in the Source tab:

   {    
       "metrics": [
           [ { "expression": "IF(RATE(m1)>0,RATE(m1)*86400,0)", "label": "Expression1", "id": "e1", "period": 86400, "stat": "Maximum" } ],
           [ "AWS/Billing", "EstimatedCharges", "Currency", "USD", { "id": "m1" } ]
       ],    
       "view": "timeSeries",
       "stacked": false,
       "region": "us-east-1",
       "stat": "Maximum",
       "period": 86400
   }

   Note: The preceding code creates the metric math expression [ IF(RATE(m1)>0,RATE(m1)*86400,0) ] that uses EstimatedCharges as the base metric with the label "m1".
4. To create a CloudWatch alarm for the metric math expression, choose the Graphed metrics tab.
5. In the Actions column for the DailyEstimatedCharges metric, choose the Alarm icon.
6. In the CloudWatch alarm creation wizard, complete the following steps:
   Confirm the details of the metric configuration.
   Add an appropriate threshold value to receive notifications when the threshold is exceeded, for example 50.00 USD.
   Configure your alarm actions.
   Add an alarm name and description.

Use the AWS CLI to create a CloudWatch alarm

Complete the following steps:

1. Create an alarm configuration as a JSON file.
   Example JSON file:

   $ cat alarm_config.json
   {
       "AlarmName": "DailyEstimatedCharges",
       "AlarmDescription": "This alarm would be triggered if the daily estimated charges exceeds 50$",
       "ActionsEnabled": true,
       "AlarmActions": [
           "arn:aws:sns:<REGION>:<ACCOUNT_ID>:<SNS_TOPIC_NAME>"
       ],
       "EvaluationPeriods": 1,
       "DatapointsToAlarm": 1,
       "Threshold": 50,
       "ComparisonOperator": "GreaterThanOrEqualToThreshold",
       "TreatMissingData": "breaching",
       "Metrics": [{
           "Id": "m1",
           "MetricStat": {
               "Metric": {
                   "Namespace": "AWS/Billing",
                   "MetricName": "EstimatedCharges",
                   "Dimensions": [{
                       "Name": "Currency",
                       "Value": "USD"
                   }]
               },
               "Period": 86400,
               "Stat": "Maximum"
           },
           "ReturnData": false
       },
       {
           "Id": "e1",
           "Expression": "IF(RATE(m1)>0,RATE(m1)*86400,0)",
           "Label": "DailyEstimatedCharges",
           "ReturnData": true
       }]
   }

   Note: Replace the REGION, ACCOUNT_ID, and SNS_TOPIC_NAME with your values.

2. Call the PutMetricAlarm API.
   Example API call:

   aws cloudwatch put-metric-alarm --cli-input-json file://alarm_config.json

   (Optional) To find the previous day's top ten contributors to the Maximum DailyEstimatedCharges value, run the following query:

   $ cat top_contributors_query.json
   {
       "MetricDataQueries": [{
           "Id": "e1",
           "Expression": "SORT(RATE(SEARCH('{AWS/Billing,Currency,ServiceName} AWS/Billing ServiceName', 'Maximum', 86400))*86400, MAX, DESC, 10)",
           "Label": "DailyEstimatedCharges",
           "Period": 86400
       }],
       "ScanBy": "TimestampAscending"
   }
   
   
   $ aws cloudwatch get-metric-data --cli-input-json file://top_contributors_query.json --start-time `date -v -2d '+%Y-%m-%dT%H:%M:%SZ'` --end-time `date '+%Y-%m-%dT%H:%M:%SZ'` --region us-east-1

   The supported DateTime format for StartTime and EndTime is 2020-01-01T00:00:00Z.

   Important: The preceding command incurs charges based on the number of metrics that each GetMetricData API call retrieves. For more information, see Amazon CloudWatch Pricing.