A data analytics startup's cloud bill arrived once a month — and every month it held surprises. We built a daily cost pipeline that breaks spend down by team, detects anomalies, and pings the owning engineers the day something misbehaves.
Typical results
$4K/mo
Leak caught in one day
24 hrs
To detect a spike
-23%
Monthly cloud spend
2%
Untagged resources left
Figures reflect typical results for this kind of automation.
The challenge
The team discovered cost spikes three weeks late, when the invoice landed. A forgotten test cluster once burned $4,000 before anyone noticed. A third of resources carried no owner tag, so even when spend jumped, nobody knew whose it was — and finance chased engineers through screenshots and guesswork every single month.
Before and after
Time to detect a cost spike
−95%Monthly cloud spend
−23%Untagged resources
−94%The automation
We built a Make pipeline that pulls daily billing exports from the cloud provider, allocates every line to a team and service using tags, and computes rolling baselines per owner. When spend deviates from its baseline, the owning team's Slack channel gets an alert naming the exact resources and the cost delta. Untagged resources open tagging tasks automatically, and a weekly digest tracks each team's spend against budget.
How it works
- 01
Ingest
Daily billing exports are pulled from the cloud provider and broken down by service, environment and team tag.
- 02
Baseline
Rolling spend baselines are computed per team and service, so 'normal' is always current.
- 03
Detect
Deviations from baseline are flagged with the exact resources driving the jump.
- 04
Alert
The owning team's Slack channel gets the anomaly, the cost delta and a link to the offending resources.
- 05
Digest
A weekly summary tracks every team's spend against budget, and untagged resources open tagging tasks automatically.
Starts from
- Daily cloud billing exports
- Team budgets & resource tags
Delivers
- Slack cost alerts
- Weekly budget digest
- Tagging tasks
The impact
Detection went from three weeks to one day, so a leak such as a forgotten test cluster is typically caught within 24 hours of starting. Untagged resources fell from 34% to 2%, and with owners accountable for their own baselines, monthly cloud spend dropped from $52K to $40K.
Questions about this automation
How does it decide that spend is abnormal?
Daily billing exports are split by service, environment and team tag, and a rolling baseline is kept for each owner and service. When a day's spend rises past a set percentage or dollar amount above that baseline, it is flagged as an anomaly along with the specific resources driving the increase.
Who gets alerted, and through which channel?
The alert goes to the Slack channel of the team that owns the resources, with the cost change and links to the resources in question. Finance receives a weekly digest showing each team's spend against budget, so nobody has to chase engineers with screenshots at month end.
What about resources with no owner tag?
Untagged resources cannot be assigned to a team, so the automation opens a tagging task for the most likely owner, based on the account or project where the resource runs. Open tasks appear in the weekly digest until they are fixed. Simple automations like this are usually live within days of getting read access to the billing export.