Cost Is a Signal

Before the detail — Decision: route a cost anomaly as a page, a sub-critical notice, or no action, using whether it is still accumulating, never by computing what it cost. Outcome: a resource left running by mistake surfaces inside a review cycle instead of at a quarterly close nobody was watching for it. Artifact: the anomaly finding, its routing decision, and — where a cloud region has no such feature — a documented compensating control. Status of what follows: reusable guidance; binding only where a documented compensating control is required for a workload running without native anomaly detection.

Prompt first: route it, do not price it

Here are the current and prior anomaly rows, plus incident-record
references overlapping those dates [paste; use NONE].

Determine whether the signal is rising, bounded, or back near
baseline. If accumulation or causality is not evidenced by the
supplied artifacts, write UNKNOWN. Do not infer cause from spend
alone and do not compute a monthly incident cost.

Cost data arrives roughly a day late, so this prompt never answers “should we page right now” the way an availability alert does — it answers “did anything stay switched on that a human should still be looking at,” and keeping routing separate from the dollar amount keeps the assistant out of a costing exercise nobody asked it to run.

A signal with a day of latency, not a bill review

A cloud bill is a low-rate, high-latency stream that occasionally sees what the availability metrics missed entirely: a leak that quietly autoscaled a database, a retry storm, a job that never stopped. The committed check computes median absolute deviation over a trailing fourteen-day window per service and component and flags positive robust z scores at or above 3.5; this is a signal, not a bill review.

The committed synthetic scan reports database spend of $924.25, $807.58, $712.61, and $593.71 from 2026-08-18 through 2026-08-21, plus an egress finding of $130.21 on 2026-08-18 — flagging three more days after the incident that caused it had already closed, because whatever scaled up during that incident never scaled back down.

Data Products 6.2 (a separate training in this series) owns measuring what a product actually costs to run in your own environment. This lesson only detects and routes.

The empty bucket: cost as the only signal

Published in late April 2024, Maciej Pocwierz’s newly created empty Amazon S3 bucket received about 100 million rejected PUT requests and incurred more than $1,300 in one day, because a widely used open-source tool’s default backup-bucket name happened to collide with his — cost was the only signal, with no error, no latency change, and no security alert of any kind. Every application-level metric stayed green throughout; the anomaly was visible only on the invoice, found by a person manually checking billing. AWS announced the billing change on 2024-05-13, so rejected requests of this kind stop generating charges to the account they land on.

A billing-only anomaly with nobody assigned to watch it keeps running until someone happens to open the invoice — exactly why this class of signal needs the same page-or-ticket routing decision as any other alert, not a monthly finance meeting that finds it whenever it finds it.

Detection lag, and where to route it

Every major provider’s cost-anomaly feature carries a lag no availability alert would tolerate. Amazon Web Services (AWS) runs Cost Anomaly Detection about three times daily, using Cost Explorer data delayed by up to 24 hours; a new monitor needs 24 hours. Azure evaluates daily, free, about 36 hours after the UTC day ends, emails once, and permits at most five alerts per subscription.

Google Cloud (GCP) budget alerts default to 50, 90, and 100 percent and can publish to Pub/Sub, the provider’s message bus and native automation path.

Route PAGE only when the anomaly is still accumulating and urgent operational action remains; route SUB-CRITICAL when it is bounded, declining, or tied to a closed incident; route NO ACTION only when a known cause is mitigated and the signal has returned to baseline.

A fixed daily review catches a forgotten resource in calendar days; a quarterly close can leave the exposure running for months.

Stop and escalate when a flagged anomaly is still accumulating and correlates with a currently open incident — that stops being a finance question the moment the two overlap, and it goes to whoever is already commanding that incident, not to a separate cost review scheduled for later in the month.

The commercial starting practice is provider-native anomaly detection. The federal delta is that Azure Government does not offer the feature; if Meridian deploys a contract-scoped workload there, the applicable contract or adopted control baseline determines whether a compensating control is required. The handoff artifact is a documented manual-review cadence plus fixed budget thresholds. What is not equivalent: an unavailable feature requires a different control from an available feature that was never enabled.

Practice status — among organizations that treat cloud spend as an operational signal, commercial and federal

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

Cost is a real operational signal precisely because it is slow and low-rate — the empty-bucket case shows it catching what every other metric missed, and Meridian’s own database anomaly shows the same shape at a smaller scale: something scaled up during an incident and quietly stayed that way for days. Route PAGE only when the anomaly is still accumulating and urgent action remains, SUB-CRITICAL when bounded or tied to a closed incident, and NO ACTION only when a known cause is mitigated and the signal is back at baseline — never route on the dollar figure attached to it. Where Azure Government ships without the native feature, the applicable contract or control baseline decides whether a compensating control is required. Module 3 turns from what pages a person to what that person does once they answer: command.

LEADERSHIP DECISION   where the contract or adopted control baseline
                      requires it, fund a documented compensating control
                      before a workload runs in a region without native
                      cost-anomaly detection
PRACTITIONER ACTION   route every flagged anomaly as page, sub-critical, or
                      no action using whether it is still accumulating and
                      whether it touches an open incident - never a price tag
SUCCESS MEASURE       zero contract-scoped workloads in a region lacking
                      native anomaly detection without a documented
                      compensating control on file