COST01-BP06 - Monitor cost proactively

Cost Monitoring Dashboard:
  Real-time Widgets:
    Current Day Spend:
      Metric: Daily cost accumulation
      Threshold: $5,000 (daily budget)
      Alert: >90% of daily budget by 6 PM
    
    Anomaly Alerts:
      Metric: Cost anomalies detected
      Threshold: >$500 unexpected spend
      Alert: Immediate notification to FinOps team
    
    Top Cost Drivers:
      Metric: Services contributing >10% of daily cost
      Update: Every hour
      Alert: New service in top 5 cost drivers

  Trend Analysis Widgets:
    7-Day Cost Trend:
      Metric: Daily cost over past 7 days
      Threshold: >15% increase from previous week
      Alert: Trend alert to management
    
    Monthly Forecast:
      Metric: Projected month-end cost
      Threshold: >105% of monthly budget
      Alert: Budget overrun warning
    
    Service Growth Rates:
      Metric: Week-over-week service cost growth
      Threshold: >25% growth for any service
      Alert: Service-specific investigation required

  Optimization Widgets:
    Right-sizing Opportunities:
      Metric: Number of oversized resources
      Update: Daily
      Alert: >10 optimization opportunities available
    
    Unused Resources:
      Metric: Resources with <5% utilization
      Update: Daily
      Alert: >$100/day in unused resource costs
    
    Reserved Instance Coverage:
      Metric: RI coverage percentage
      Threshold: <80% coverage
      Alert: RI purchase opportunity available

# Example automated cost monitoring workflow
import boto3
import json
from datetime import datetime, timedelta

class ProactiveCostMonitor:
    def __init__(self):
        self.ce_client = boto3.client('ce')
        self.sns_client = boto3.client('sns')
        self.cloudwatch = boto3.client('cloudwatch')
    
    def daily_cost_check(self):
        """Perform daily cost monitoring checks"""
        today = datetime.now().date()
        yesterday = today - timedelta(days=1)
        
        # Get yesterday's costs
        response = self.ce_client.get_cost_and_usage(
            TimePeriod={
                'Start': str(yesterday),
                'End': str(today)
            },
            Granularity='DAILY',
            Metrics=['BlendedCost']
        )
        
        daily_cost = float(response['ResultsByTime'][0]['Total']['BlendedCost']['Amount'])
        
        # Check against daily budget
        daily_budget = 5000  # $5,000 daily budget
        if daily_cost > daily_budget * 0.9:  # 90% threshold
            self.send_alert(
                f"Daily cost alert: ${daily_cost:.2f} (90% of ${daily_budget} budget)",
                "high"
            )
        
        # Check for week-over-week growth
        week_ago = today - timedelta(days=7)
        week_ago_response = self.ce_client.get_cost_and_usage(
            TimePeriod={
                'Start': str(week_ago),
                'End': str(week_ago + timedelta(days=1))
            },
            Granularity='DAILY',
            Metrics=['BlendedCost']
        )
        
        week_ago_cost = float(week_ago_response['ResultsByTime'][0]['Total']['BlendedCost']['Amount'])
        growth_rate = (daily_cost - week_ago_cost) / week_ago_cost * 100
        
        if growth_rate > 15:  # 15% growth threshold
            self.send_alert(
                f"Cost growth alert: {growth_rate:.1f}% increase from last week",
                "medium"
            )
    
    def check_service_anomalies(self):
        """Check for service-level cost anomalies"""
        # Get cost by service for last 7 days
        end_date = datetime.now().date()
        start_date = end_date - timedelta(days=7)
        
        response = self.ce_client.get_cost_and_usage(
            TimePeriod={
                'Start': str(start_date),
                'End': str(end_date)
            },
            Granularity='DAILY',
            Metrics=['BlendedCost'],
            GroupBy=[{'Type': 'DIMENSION', 'Key': 'SERVICE'}]
        )
        
        # Analyze service cost patterns
        for result in response['ResultsByTime']:
            for group in result['Groups']:
                service = group['Keys'][0]
                cost = float(group['Metrics']['BlendedCost']['Amount'])
                
                # Check against service-specific thresholds
                if self.is_service_anomaly(service, cost):
                    self.send_alert(
                        f"Service anomaly detected: {service} cost ${cost:.2f}",
                        "medium"
                    )
    
    def forecast_month_end(self):
        """Forecast month-end costs and check against budget"""
        today = datetime.now().date()
        month_start = today.replace(day=1)
        
        # Get month-to-date costs
        response = self.ce_client.get_cost_and_usage(
            TimePeriod={
                'Start': str(month_start),
                'End': str(today)
            },
            Granularity='MONTHLY',
            Metrics=['BlendedCost']
        )
        
        mtd_cost = float(response['ResultsByTime'][0]['Total']['BlendedCost']['Amount'])
        days_elapsed = (today - month_start).days + 1
        days_in_month = 30  # Simplified
        
        # Simple linear forecast
        forecast = mtd_cost * (days_in_month / days_elapsed)
        monthly_budget = 150000  # $150,000 monthly budget
        
        if forecast > monthly_budget * 1.05:  # 105% threshold
            self.send_alert(
                f"Month-end forecast alert: ${forecast:.2f} (${forecast - monthly_budget:.2f} over budget)",
                "high"
            )
    
    def send_alert(self, message, severity):
        """Send alert notification"""
        topic_arn = "arn:aws:sns:us-east-1:123456789012:cost-alerts"
        
        self.sns_client.publish(
            TopicArn=topic_arn,
            Message=json.dumps({
                'timestamp': datetime.now().isoformat(),
                'severity': severity,
                'message': message,
                'source': 'ProactiveCostMonitor'
            }),
            Subject=f"Cost Alert - {severity.upper()}"
        )
    
    def is_service_anomaly(self, service, cost):
        """Check if service cost represents an anomaly"""
        # Simplified anomaly detection logic
        service_thresholds = {
            'Amazon Elastic Compute Cloud - Compute': 2000,
            'Amazon Simple Storage Service': 500,
            'Amazon Relational Database Service': 1000
        }
        
        threshold = service_thresholds.get(service, 100)
        return cost > threshold

# Usage
if __name__ == "__main__":
    monitor = ProactiveCostMonitor()
    monitor.daily_cost_check()
    monitor.check_service_anomalies()
    monitor.forecast_month_end()

# Weekly Cost Monitoring Review - Week of March 15, 2024

## Executive Summary
- **Weekly Spend**: $32,500 (vs $35,000 budget) ✅ 7.1% under budget
- **Month-to-Date**: $97,500 (vs $105,000 budget) ✅ 7.1% under budget
- **Forecast**: $146,250 (vs $150,000 budget) ✅ 2.5% under budget
- **Key Issues**: 2 anomalies detected, 1 optimization opportunity identified

## Cost Performance Analysis

### Top Cost Drivers This Week
1. **EC2 Instances**: $13,000 (40%) - Stable, no issues
2. **Data Transfer**: $6,500 (20%) - ↑ 15% from last week ⚠️
3. **RDS**: $4,875 (15%) - ↓ 5% from last week ✅
4. **S3 Storage**: $3,250 (10%) - Stable
5. **Lambda**: $2,275 (7%) - ↑ 25% from last week ⚠️

### Anomalies Detected
1. **Data Transfer Spike** (March 13)
   - **Impact**: +$1,200 unexpected cost
   - **Root Cause**: New CDN configuration causing inefficient routing
   - **Status**: Fixed, monitoring for recurrence
   - **Owner**: Network Team

2. **Lambda Cost Increase** (March 14-15)
   - **Impact**: +$500 unexpected cost
   - **Root Cause**: Increased function execution due to new feature
   - **Status**: Expected behavior, updating budget forecast
   - **Owner**: Development Team

### Optimization Opportunities Identified
1. **EC2 Right-sizing** - Potential savings: $800/week
   - 5 instances running at <20% CPU utilization
   - Recommended action: Downsize to smaller instance types
   - Timeline: This weekend during maintenance window

2. **Unused EBS Volumes** - Potential savings: $150/week
   - 8 unattached EBS volumes identified
   - Recommended action: Review and delete unused volumes
   - Timeline: End of week after team confirmation

## Proactive Monitoring Insights

### Trend Analysis
- **7-day moving average**: Stable with slight downward trend
- **Service growth rates**: Lambda showing 25% week-over-week growth
- **Utilization trends**: Overall compute utilization improving

### Forecast Updates
- **Month-end projection**: Updated from $148,000 to $146,250
- **Confidence level**: High (based on current trends)
- **Risk factors**: Potential new project launch in week 4

### Early Warning Indicators
- **Budget burn rate**: 65% of month elapsed, 65% of budget used ✅
- **Service concentration**: No single service >45% of total cost ✅
- **Account distribution**: Balanced across production and non-production ✅

## Actions Required

### Immediate (This Week)
- [ ] Implement EC2 right-sizing recommendations
- [ ] Clean up unused EBS volumes
- [ ] Monitor data transfer patterns post-fix
- [ ] Update Lambda budget forecast

### Short-term (Next 2 Weeks)
- [ ] Review CDN configuration optimization
- [ ] Implement automated unused resource cleanup
- [ ] Enhance Lambda cost monitoring
- [ ] Prepare for potential new project costs

### Long-term (This Month)
- [ ] Implement predictive cost modeling
- [ ] Enhance anomaly detection sensitivity
- [ ] Develop automated optimization workflows
- [ ] Review and update monitoring thresholds

## Team Feedback and Improvements
- **Monitoring effectiveness**: 95% of cost issues detected within 24 hours
- **Alert accuracy**: 90% of alerts were actionable (target: >85%)
- **Response time**: Average 4 hours from detection to action (target: <6 hours)
- **Suggested improvements**: 
  - Add business context to anomaly alerts
  - Implement automated right-sizing recommendations
  - Enhance cross-service cost correlation analysis