Setting up AWS billing protection shouldn't require reading a 3,000-word guide. Here's a ready-to-deploy budget template that gives you the right alerts out of the box. Deploy it, adjust the dollar amounts to match your spend, and move on to building your product.
What the Template Includes
The CloudFormation template deploys three resources that work together to catch billing issues at different speeds and severity levels.
1. Monthly Cost Budget with Three Alert Thresholds
A cost budget set to your expected monthly spend, with email alerts at 80% (heads up), 100% (investigate), and 150% (something is probably wrong). These are your first line of defense — crude but reliable.
2. Per-Service Budgets for Your Top Three Services
Individual budgets for EC2, RDS, and S3 (or whichever three services represent your largest spend). Per-service budgets catch anomalies that are invisible in the total-account view. A $200 spike in EC2 might be noise in a $2,000 account budget, but it's very visible in a $300 EC2 budget.
3. Cost Anomaly Detection Monitor
An all-services anomaly detection monitor with a $10 minimum impact threshold. This catches the spending patterns that fixed thresholds miss — new services you've never been billed for, unusual spend in off-hours, gradual cost creep from resource accumulation.
The CloudFormation Template
Copy this template, save it as budget-template.yaml, and deploy it via the CloudFormation console or CLI:
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Budget alerts for startup AWS accounts'
Parameters:
MonthlyBudget:
Type: Number
Default: 500
Description: 'Expected monthly spend in USD'
AlertEmail:
Type: String
Description: 'Email address for budget alerts'
TopService1:
Type: String
Default: 'Amazon Elastic Compute Cloud - Compute'
Description: 'Top spending service #1'
TopService2:
Type: String
Default: 'Amazon Relational Database Service'
Description: 'Top spending service #2'
TopService3:
Type: String
Default: 'Amazon Simple Storage Service'
Description: 'Top spending service #3'
Resources:
OverallBudget:
Type: AWS::Budgets::Budget
Properties:
Budget:
BudgetName: 'monthly-total'
BudgetType: COST
TimeUnit: MONTHLY
BudgetLimit:
Amount: !Ref MonthlyBudget
Unit: USD
NotificationsWithSubscribers:
- Notification:
NotificationType: ACTUAL
ComparisonOperator: GREATER_THAN
Threshold: 80
Subscribers:
- SubscriptionType: EMAIL
Address: !Ref AlertEmail
- Notification:
NotificationType: ACTUAL
ComparisonOperator: GREATER_THAN
Threshold: 100
Subscribers:
- SubscriptionType: EMAIL
Address: !Ref AlertEmail
- Notification:
NotificationType: ACTUAL
ComparisonOperator: GREATER_THAN
Threshold: 150
Subscribers:
- SubscriptionType: EMAIL
Address: !Ref AlertEmail
AnomalyMonitor:
Type: AWS::CE::AnomalyMonitor
Properties:
MonitorName: 'all-services-anomaly'
MonitorType: DIMENSIONAL
MonitorDimension: SERVICE
AnomalySubscription:
Type: AWS::CE::AnomalySubscription
Properties:
SubscriptionName: 'anomaly-alerts'
MonitorArnList:
- !Ref AnomalyMonitor
Frequency: IMMEDIATE
Threshold: 10
Subscribers:
- Type: EMAIL
Address: !Ref AlertEmailDeploy with:
aws cloudformation deploy \
--template-file budget-template.yaml \
--stack-name billing-alerts \
--parameter-overrides \
MonthlyBudget=500 \
AlertEmail=your-email@example.comCustomizing for Your Account
Adjust the MonthlyBudget parameter to match your actual expected spend. If you're not sure, check last month's total in Cost Explorer and add 50%. If your top services are different from EC2/RDS/S3, update the TopService parameters. The service names must match exactly what appears in Cost Explorer.
For the anomaly detection threshold, $10 works well for accounts spending under $1,000/month. If your bill is larger, increase it proportionally to avoid noise — $50 for a $5,000/month account, $100 for $10,000+.
What This Doesn't Cover
This template gives you threshold-based and ML-based cost alerts. What it doesn't provide: real-time detection (alerts have a 6-24 hour lag), correlation with security signals (a cost spike from compromised credentials looks the same as normal growth), and account health scoring (billing is one dimension of health; security, compliance, and SES reputation are the others).
For real-time billing monitoring with security correlation and account health scoring, Vigilare adds the layer this template can't. Deploy the template for free baseline protection, then add Vigilare for real-time detection. Start a free 14-day trial.
Related Reading
Protect your AWS accounts before it's too late
Vigilare monitors your AWS accounts for suspension risks — billing anomalies, IAM issues, GuardDuty findings, and more — and alerts you before AWS takes action.
Written by Viktor B.
Co-founder & CEO