Daily

Catch AWS spend spikes in Slack

Slack warns you when a day's spend jumps well above the recent average.

Runs: Daily
Apps: AWS
AI: Not needed
Access: ce:GetCostAndUsage

Send this to your assistant

Create a ClickRuntime automation: every morning, compare yesterday's AWS spend with the 7-day average and alert #ops in Slack if it's more than 50% higher.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

Monthly budgets in AWS are a blunt instrument. By the time an alert fires because you crossed eighty percent of the month's budget, the damage is done and the spike may have been going on for two weeks. A crypto-mining script on a compromised key, a load test left running or a misconfigured autoscaling group can add thousands of dollars within days, and a daily-average comparison would have caught it on day one.

Each day, ClickRuntime fetches the last eight days of AWS cost, averages the seven days before yesterday and compares yesterday against that average. If yesterday is well above normal, it sends a notification with the amount, the average and the services responsible.

Companies with variable workloads, such as data pipelines and batch jobs, especially benefit from a baseline that moves with their usage. It also works for teams that cannot predict a fixed monthly budget.

What you get out of it

Compromised credentials are caught fast
A leaked access key used to start expensive instances shows up as an abrupt jump. Finding it within a day limits the bill and lets you rotate keys before real damage occurs.
The baseline adapts to your normal
Comparing with a recent average means a steadily growing company does not trigger alarms every day. Only departures from the recent pattern produce a notification. Only real departures from your recent pattern ever reach your inbox today.
Misconfigured autoscaling is noticed
An autoscaling group stuck at maximum capacity can double compute spend overnight. The next morning's alert makes the problem obvious while the fix is a single setting. The fix is often one setting, changed the next morning.
Experiments do not become surprise costs
Load tests and data migrations are often forgotten after they finish. An alert tells you something is still running, so you turn it off before it becomes a line on next month's bill.
Refund requests have better evidence
If a spike was caused by an AWS error, a dated notification with the figures supports a request for credit. Support teams respond better to specific amounts and dates. Support teams respond better to specific amounts and dates.

How it works

What happens, step by step

Every day ClickRuntime gets your AWS spend for the last eight days.
It compares yesterday's spend with the average of the seven days before.
If yesterday was well above that average, your Slack channel gets both figures and the percentage jump. Normal days stay quiet.

Before it runs live

Connect AWS

What you get

RunsDaily

Catch AWS spend spikes in Slacktoday, 9:00Succeeded

Slack · #opsAWS spend spike: $96.40 yesterday vs $52.10 7-day average (+85%)

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other AWS steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

get_alerted_when_spend_spikes.pyexample

from datetime import date, timedelta
import boto3
from clickruntime import on_trigger, credentials, notify

REGION = "us-east-1"

def aws(service):
    return boto3.client(service, region_name=REGION, aws_access_key_id=credentials.secret("AWS_ACCESS_KEY_ID"),
                        aws_secret_access_key=credentials.secret("AWS_SECRET_ACCESS_KEY"))

@on_trigger
def run(event):
    result = aws("ce").get_cost_and_usage(
        TimePeriod={"Start": str(date.today() - timedelta(days=8)), "End": str(date.today())},
        Granularity="DAILY", Metrics=["UnblendedCost"])["ResultsByTime"]
    daily = [float(r["Total"]["UnblendedCost"]["Amount"]) for r in result]
    yesterday, average = daily[-1], sum(daily[:-1]) / len(daily[:-1])
    if average and yesterday > average * 1.5:
        notify.slack(f"AWS spend spike: ${yesterday:,.2f} yesterday vs ${average:,.2f} 7-day average "
                     f"(+{(yesterday / average - 1) * 100:.0f}%)", channel="#ops")
    return {"yesterday": yesterday, "average": average}

FAQ

Common questions

What counts as a spike?

You choose the rule, for example yesterday exceeding the seven-day average by 30 percent or by a fixed dollar amount. A percentage works well for steady workloads, while a fixed amount avoids false alarms on very small accounts.

Which services does the alert name?

The cost data is grouped by service, so the message lists the services that grew the most compared with their averages. That points you to EC2, data transfer or another cause immediately, rather than leaving you to dig through Cost Explorer.

Will it alert every day during a long spike?

It can. If you prefer a single notification per incident, ask your AI assistant to remember that an alert was sent and wait until spending returns to normal first. Many teams keep daily reminders until someone acknowledges the cause.

What permissions does it need?

ce:GetCostAndUsage. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (daily). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

On a schedule