Catch AWS Spend Spikes Before Standup

id: aws-cost-anomaly-slack-alert
namespace: company.team
description: |
  Pull yesterday's AWS spend from Cost Explorer, compare it with your
  daily budget, and alert Slack with the delta the moment spend runs hot.

triggers:
  - id: daily_spend_check
    type: io.kestra.plugin.core.trigger.Schedule
    description: Run every morning so last night's spend spike is caught before the
      workday starts.
    cron: "0 8 * * *"
    disabled: true
  - id: webhook_spend_check
    type: io.kestra.plugin.core.trigger.Webhook
    description: Call from a deploy or incident pipeline when you want an on-demand
      spend read.
    key: aws-spend-check

inputs:
  - id: daily_budget_usd
    type: FLOAT
    defaults: 100.0
    description: Yesterday's blended spend above this amount is treated as an anomaly.
  - id: region
    type: STRING
    defaults: us-east-1
    description: Region used for the Cost Explorer API call (Cost Explorer is global
      but requires a region).

tasks:
  - id: fetch_yesterday_cost
    type: io.kestra.plugin.aws.cli.AwsCLI
    description: Query Cost Explorer for yesterday's blended cost and land the raw
      JSON next to the execution working directory.
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    region: "{{ inputs.region }}"
    commands:
      - aws ce get-cost-and-usage --time-period Start={{ now() | dateAdd(-1,
        'DAYS') | date('yyyy-MM-dd') }},End={{ now() | date('yyyy-MM-dd') }}
        --granularity DAILY --metrics BlendedCost --output json > cost.json

  - id: parse_cost
    type: io.kestra.plugin.scripts.python.Script
    description: Parse the Cost Explorer JSON, extract yesterday's blended cost as a
      float, and emit it through the stdout outputs protocol so downstream tasks
      get a typed value.
    containerImage: python:3.11-slim
    warningOnStdErr: false
    script: |
      import json

      with open('cost.json') as f:
          data = json.load(f)

      amount = float(data['ResultsByTime'][0]['Total']['BlendedCost']['Amount'])
      currency = data['ResultsByTime'][0]['Total']['BlendedCost'].get('Unit', 'USD')
      print('yesterday blended cost: ' + str(amount) + ' ' + currency)
      print('::' + json.dumps({'outputs': {'cost': amount, 'currency': currency}}) + '::')

  - id: check_budget
    type: io.kestra.plugin.core.flow.If
    description: Branch on the parsed cost — over budget pages you, under budget
      just gets logged for the trend.
    condition: "{{ outputs.parse_cost.vars.cost > inputs.daily_budget_usd }}"
    then:
      - id: alert_overspend
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Post the measured spend next to the budget so the alert says how
          big the anomaly is, not just that one exists.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": ":warning: AWS spend anomaly — yesterday cost {{ outputs.parse_cost.vars.cost }} {{ outputs.parse_cost.vars.currency }}, over your {{ inputs.daily_budget_usd }} budget. Execution {{ execution.id }}. Check Cost Explorer for the spike driver."
          }
    else:
      - id: log_within_budget
        type: io.kestra.plugin.core.log.Log
        description: Record in-budget spend on every run so execution history is your
          daily spend trend.
        message: "AWS spend within budget: {{ outputs.parse_cost.vars.cost }} {{
          outputs.parse_cost.vars.currency }} (budget {{ inputs.daily_budget_usd
          }})."

errors:
  - id: alert_fetch_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert when the cost pull itself fails — no data read must ever look
      like a normal day.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "AWS cost fetch FAILED in flow {{ flow.id }} (execution {{ execution.id }}). Verify the AWS credentials secret and Cost Explorer permissions."
      }

outputs:
  - id: cost_summary
    type: JSON
    description: 'Yesterday''s cost and currency, e.g. {"cost": 42.13, "currency": "USD"}.'
    value: "{{ outputs.parse_cost.vars | toJson }}"