AWS now provides AI-powered cost investigations for cost anomalies
Amazon Q now explains why your costs spiked — pinpointing the API calls and IAM principals responsible — in minutes, not hours.
View original announcement →Visual Summary
graph TD
A{{AI-Powered Cost Investigation}}:::announced
B(Amazon Q Developer):::compute
C(AWS CloudTrail):::storage
D(CloudWatch Logs Insights):::storage
E([Anomaly Classification]):::feature
F([Root Cause Attribution]):::feature
G((FinOps Practitioners)):::external
H(Cost Anomaly Detection):::compute
I([Cross-Account Investigation]):::feature
G ==>|"investigate anomaly"| A
H -->|"detects anomaly"| A
A ==>|"analyzes with"| B
B -->|"correlates events"| C
C -->|"queries logs"| D
B -->|"usage or rate"| E
B -->|"identifies principals"| F
A -.->|"org trail"| I
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
AWS Cost Anomaly Detection now integrates Amazon Q Developer to automatically investigate the root cause of detected cost anomalies, delivering plain-language explanations in minutes rather than hours. When an anomaly is detected, Amazon Q analyzes cost data alongside AWS CloudTrail events to determine whether the spike is usage-driven or rate-driven, and identifies the specific services, accounts, regions, API calls, and IAM principals responsible. The feature is available at no additional charge in all commercial AWS Regions and supports interactive follow-up questions for deeper exploration.
How It Works
- Anomaly classification: Amazon Q Developer first determines whether a cost change is usage-driven (more resources/activity at the same price) or rate-driven (similar usage at a different per-unit price, such as a Savings Plans reallocation or tiered pricing reset).
- Dimensional breakdown: The investigation identifies the largest contributing dimensions — service, account, region, and usage type — to pinpoint where the cost change originated.
- CloudTrail correlation (usage-driven): For usage-driven anomalies, Amazon Q queries AWS CloudTrail to attribute the change to specific API calls and the IAM principals that triggered them, establishing a clear causal chain.
- Rate-driven explanation: For rate-driven anomalies, Amazon Q analyzes pricing composition shifts, such as changes in applied discounts or pricing tier resets, rather than CloudTrail activity.
- Cross-account support: Organizations with a CloudTrail organization trail automatically benefit from cross-account investigation across all member accounts without additional configuration.
- Conversational interface: After the initial investigation, users can ask follow-up questions to explore patterns, drill into specific resources, or request additional context within the same session.
- Adaptive output: Simple anomalies with a single root cause produce a concise narrative; complex anomalies with multiple causes produce a per-cause breakdown with a synthesized summary.
- Entry point: Accessed directly from the AWS Billing and Cost Management console by selecting "Investigate with Amazon Q" on any detected anomaly in the Cost Anomaly Detection dashboard.
Why It's Important
- Dramatic time reduction: Root cause analysis that previously required hours of manual correlation across Cost Explorer, CloudTrail, and resource activity logs is now completed in minutes, accelerating incident response.
- Democratizes FinOps expertise: Plain-language explanations make cost investigations accessible to engineers and developers who may lack deep FinOps or billing expertise, reducing dependency on specialized cost management teams.
- Faster remediation: By moving from alert to actionable insight faster, teams can stop runaway spend before it compounds into significant budget overruns.
- Accountability and attribution: Identifying the specific IAM principals and API calls responsible for a cost spike enables precise accountability, supporting both remediation and governance improvements.
- Reduced operational overhead: Eliminating manual investigation workflows frees FinOps practitioners to focus on optimization strategies rather than reactive triage.
- Organization-wide visibility: Automatic cross-account investigation for AWS Organizations customers means a single investigation can span an entire enterprise without manual account-by-account analysis.
How It's Different
- Beyond alerting: Traditional AWS Cost Anomaly Detection only detected and alerted on anomalies; this feature closes the loop by explaining why the anomaly occurred, not just that it occurred.
- Integrated AI reasoning vs. manual correlation: Previously, engineers had to manually cross-reference Cost Explorer data with CloudTrail logs and resource timelines; Amazon Q automates this multi-source correlation natively within the billing console.
- Usage vs. rate classification: The explicit distinction between usage-driven and rate-driven changes is a novel analytical layer that guides remediation — a usage spike requires operational action, while a rate change may require a commercial or discount review.
- IAM principal attribution: Linking cost anomalies directly to specific IAM principals and API calls goes beyond cost tooling norms, bridging the gap between financial and security/operational observability.
- No additional cost: Unlike many AI-augmented features that carry premium pricing, this capability is included at no extra charge for existing Cost Anomaly Detection users.
- Conversational depth: The ability to ask follow-up questions within the same investigation session distinguishes this from static reports or dashboards, enabling iterative, hypothesis-driven exploration.
When to Prefer It
- Unexpected billing spikes in multi-account organizations: When a cost anomaly surfaces across dozens of member accounts and manual investigation would require querying each account's CloudTrail separately.
- On-call engineers without FinOps background: When the person responding to a cost alert is a developer or SRE who needs a fast, interpretable explanation without deep knowledge of AWS billing constructs.
- High-velocity deployment environments: When frequent deployments make it difficult to isolate which change caused a cost increase, and CloudTrail correlation is needed to tie costs to specific API activity.
- Savings Plans or Reserved Instance anomalies: When a rate-driven change is suspected — such as a Savings Plans expiration or reallocation — and the team needs to quickly confirm the pricing composition shift.
- Post-incident cost reviews: When conducting a retrospective on a billing event and needing a structured, documented explanation of what happened, who triggered it, and which services were affected.
- FinOps teams managing cost governance at scale: When FinOps practitioners need to triage multiple simultaneous anomalies efficiently and prioritize which ones require deeper human investigation.
- Security and compliance audits: When an unusual cost pattern may indicate unauthorized resource provisioning and IAM principal attribution is needed to assess whether the activity was sanctioned.
Availability
- GA Status: Generally available as of June 8, 2026; no preview or waitlist required.
- Regions: Available in all commercial AWS Regions; not available in AWS GovCloud or China Regions based on current announcement scope.
- Pricing: No additional charge for the AI-powered cost investigation feature itself.
- Potential charges: Cross-account investigations using an organization-wide CloudTrail trail delivered to Amazon CloudWatch Logs may incur standard CloudWatch Logs Insights charges based on the volume of data scanned.
- Prerequisites: Users must have Amazon Q Developer permissions (
q:StartConversation,q:SendMessage,q:PassRequest); theAmazonQFullAccessmanaged policy is the quickest path to access. - Recommended setup: An organization-wide CloudTrail trail with management events logging enabled and CloudWatch Logs delivery is recommended (but not strictly required) for full cross-account investigation capability.
- Limitations: Cross-account investigation requires an organization trail; accounts without CloudTrail or CloudWatch Logs delivery will have reduced investigation depth for usage-driven anomalies.
