The problem

Cloud bills rarely explode in one go. They leak: unattached volumes, idle IPs, gp2 disks nobody migrated, snapshots from 2021. Each leak is small, so nobody owns it. This project gives the leaks an owner, a dollar value and an automatic fix where it is safe to apply one.

What you’ll build

• Cost Anomaly Detection per service with immediate SNS alerts above a dollar threshold
• AWS Budgets alerts at 80% actual and 100% forecast
• A CUR 2.0 data export (daily, resource-level, Parquet) ready for Athena
• A weekly waste-hunter Lambda scanning multiple regions for unattached EBS, gp2 volumes, idle Elastic IPs, old snapshots, idle EC2 and Graviton candidates
• JSON + CSV reports in S3 with estimated $/month and the owner tag for every finding

AWS services used

How it works

1. DetectAnomaly Detection learns normal spend per service and alerts on unusual spikes.
2. GuardBudgets catch slow drift that never looks like a spike.
3. ExplainCUR 2.0 answers “which resource?” down to the line item.
4. FixEvery Monday the hunter reports savings and, with autoFix=true, converts gp2 to gp3 and releases idle IPs.

Key design decisions

• Auto-fix is limited to safe, reversible actions. Everything else is report-only.
• Findings carry the owner tag, so the report routes itself to the right team.
• Graviton suggestions are surfaced, not forced: performance testing stays a human decision.

Deploy it

npm install
npx cdk deploy -c alertEmail=you@example.com -c monthlyBudgetUsd=500 -c anomalyThresholdUsd=50
# Optional: auto-apply safe fixes (gp2->gp3, release idle EIPs)
npx cdk deploy -c alertEmail=you@example.com -c autoFix=true -c scanRegions=us-east-1,us-west-2,eu-west-1

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Create an unattached 100 GB gp2 volume and allocate an Elastic IP, then invoke the hunter. The SNS summary lists both with dollar estimates, and the CSV shows exactly what to delete.

Skills this demonstrates