These rules verify that foundational AWS cost guardrails are in place, including budget alerts and anomaly detection monitors that catch unexpected spend before it escalates.
| Rule ID | Scan Type | Severity | Name |
|---|---|---|---|
| CLDBRN-AWS-COSTGUARDRAILS-1 | Discovery | Low | AWS Budgets Missing |
| CLDBRN-AWS-COSTGUARDRAILS-2 | Discovery | Low | Cost Anomaly Detection Missing |
| CLDBRN-AWS-COSTGUARDRAILS-3 | Discovery | High | AWS Budget Limit Exceeded |
CLDBRN-AWS-COSTGUARDRAILS-1
AWS Budgets Missing
Scan type: Discovery
Severity: Low
What it checks
Flags AWS accounts that do not have any AWS Budgets configured. Budgets are the simplest guardrail for alerting when spend exceeds a threshold.
Why it matters
Without a budget, there is no automated alert when spending exceeds expected levels. AWS charges accumulate in real time, and a missing budget means a runaway cost event can go unnoticed until the monthly bill arrives. AWS Budgets is free for the first two budgets per account.
What triggers a finding
budgetCount is 0 for the account summary record.
How to remediate
Create at least one AWS Budget in the Billing console or via the API. Start with a monthly cost budget set to your expected spend with an alert at 80% and 100% thresholds.
aws budgets create-budget --account-id 123456789012 \
--budget file://budget.json \
--notifications-with-subscribers file://notifications.json
CLDBRN-AWS-COSTGUARDRAILS-2
Cost Anomaly Detection Missing
Scan type: Discovery
Severity: Low
What it checks
Flags AWS accounts that do not have any Cost Anomaly Detection monitors configured. Anomaly Detection uses ML to flag unusual spending patterns automatically.
Why it matters
AWS Cost Anomaly Detection is free and catches spend spikes that fixed-threshold budgets miss. Without it, gradual cost increases or new service charges can go undetected. A single anomaly detection monitor covering the entire account provides broad coverage with zero configuration overhead.
What triggers a finding
monitorCount is 0 for the account summary record.
How to remediate
Create a Cost Anomaly Detection monitor in the AWS Cost Management console. Start with an AWS service monitor type that covers all services, and set up an SNS topic or email for alerts.
CLDBRN-AWS-COSTGUARDRAILS-3
AWS Budget Limit Exceeded
Scan type: Discovery
Severity: High
What it checks
Flags configured AWS Budgets whose actual spend has already gone past the configured limit. Unlike CLDBRN-AWS-COSTGUARDRAILS-1, this rule assumes a budget exists and checks whether it is doing its job.
Why it matters
A budget alert is only useful if someone acts on it. A budget that has already exceeded its limit means the guardrail fired and the overspend is real, ongoing AWS cost — not a forecast. Left unreviewed, the same budget keeps exceeding its limit month after month.
What triggers a finding
actualSpend is strictly greater than budgetLimit for a budget in the account's budget spend summary.
How to remediate
Review the flagged budget in the Billing console to identify which service or resource drove the overage. Either address the underlying spend (rightsizing, cleanup, reserved capacity) or raise the budget limit if the new spend level is intentional and expected going forward.
See Also
- CLI discover command - scan live AWS resources
- SDK Reference - run discovery programmatically