These rules verify that foundational AWS cost guardrails are in place, including budget alerts and anomaly detection monitors that catch unexpected spend before it escalates.
| Rule ID | Scan Type | Severity | Name |
|---|---|---|---|
| CLDBRN-AWS-COSTGUARDRAILS-1 | Discovery | Low | AWS Budgets Missing |
| CLDBRN-AWS-COSTGUARDRAILS-2 | Discovery | Low | Cost Anomaly Detection Missing |
| CLDBRN-AWS-COSTGUARDRAILS-3 | Discovery | High | AWS Budget Limit Exceeded |
| CLDBRN-AWS-COSTGUARDRAILS-4 | Discovery | Medium | AWS Budget Forecasted Breach |
CLDBRN-AWS-COSTGUARDRAILS-1
AWS Budgets Missing
Scan type: Discovery
Severity: Low
What it checks
Flags AWS accounts that do not have any AWS Budgets configured. Budgets are the simplest guardrail for alerting when spend exceeds a threshold.
Why it matters
Without a budget, there is no automated alert when spending exceeds expected levels. AWS charges accumulate in real time, and a missing budget means a runaway cost event can go unnoticed until the monthly bill arrives. AWS Budgets is free for the first two budgets per account.
What triggers a finding
budgetCount is 0 for the account summary record.
How to remediate
Create at least one AWS Budget in the Billing console or via the API. Start with a monthly cost budget set to your expected spend with an alert at 80% and 100% thresholds.
aws budgets create-budget --account-id 123456789012 \
--budget file://budget.json \
--notifications-with-subscribers file://notifications.json
CLDBRN-AWS-COSTGUARDRAILS-2
Cost Anomaly Detection Missing
Scan type: Discovery
Severity: Low
What it checks
Flags AWS accounts that do not have any Cost Anomaly Detection monitors configured. Anomaly Detection uses ML to flag unusual spending patterns automatically.
Why it matters
AWS Cost Anomaly Detection is free and catches spend spikes that fixed-threshold budgets miss. Without it, gradual cost increases or new service charges can go undetected. A single anomaly detection monitor covering the entire account provides broad coverage with zero configuration overhead.
What triggers a finding
monitorCount is 0 for the account summary record.
How to remediate
Create a Cost Anomaly Detection monitor in the AWS Cost Management console. Start with an AWS service monitor type that covers all services, and set up an SNS topic or email for alerts.
CLDBRN-AWS-COSTGUARDRAILS-3
AWS Budget Limit Exceeded
Scan type: Discovery
Severity: High
What it checks
Flags configured AWS Budgets whose actual spend has already gone past the configured limit. Unlike CLDBRN-AWS-COSTGUARDRAILS-1, this rule assumes a budget exists and checks whether it is doing its job.
Why it matters
A budget alert is only useful if someone acts on it. A budget that has already exceeded its limit means the guardrail fired and the overspend is real, ongoing AWS cost — not a forecast. Left unreviewed, the same budget keeps exceeding its limit month after month.
What triggers a finding
actualSpend is strictly greater than budgetLimit for a budget in the account's budget spend summary.
How to remediate
Review the flagged budget in the Billing console to identify which service or resource drove the overage. Either address the underlying spend (rightsizing, cleanup, reserved capacity) or raise the budget limit if the new spend level is intentional and expected going forward.
CLDBRN-AWS-COSTGUARDRAILS-4
AWS Budget Forecasted Breach
Scan type: Discovery
Severity: Medium
What it checks
Flags AWS Budgets whose actual spend is still within the limit but whose AWS-supplied forecast for the budget period already exceeds it. This is the early warning that arrives before CLDBRN-AWS-COSTGUARDRAILS-3 fires on the same budget.
Why it matters
Once a budget has actually been breached, the overspend has already happened and the money is gone. A forecasted breach still leaves time in the budget period to act: pause a runaway job, rightsize the resource driving the trend, or adjust the limit deliberately rather than discovering the overage on the invoice.
What triggers a finding
All of the following must be true for a budget in the account's budget spend summary:
actualSpendis less than or equal tobudgetLimitforecastedSpendis presentforecastedSpendis greater thanbudgetLimit
Budgets that AWS does not forecast (typically new budgets without enough history) produce no finding. Budgets whose actual spend already exceeds the limit are reported by CLDBRN-AWS-COSTGUARDRAILS-3 instead, so the two rules never report the same budget at once.
How to remediate
Open the flagged budget in the Billing console and compare the forecast against the current run rate. If the trend is driven by an unintended change, address it while the period is still open. If the new spend level is expected, raise the limit so the budget keeps working as a guardrail instead of alerting every period. Adding a forecasted-spend notification to the budget gets the same signal to your team by email or SNS between CloudBurn scans:
aws budgets create-notification \
--account-id 123456789012 \
--budget-name monthly-cost \
--notification NotificationType=FORECASTED,ComparisonOperator=GREATER_THAN,Threshold=100,ThresholdType=PERCENTAGE \
--subscribers SubscriptionType=EMAIL,Address=finops@example.com
See Also
- CLI discover command - scan live AWS resources
- SDK Reference - run discovery programmatically