AWS Billing GetAnomalies
CertifiedList AWS cost anomalies detected by Cost Anomaly Detection
AWS Billing GetAnomalies
List AWS cost anomalies detected by Cost Anomaly Detection
Calls the Cost Explorer GetAnomalies API to list the cost anomalies detected in a time period, optionally for
one anomaly monitor and above a minimum total impact. Unlike the other Cost Explorer tasks, endDate is inclusive here,
so startDate and endDate can be the same day. Each paginated request costs $0.01.
type: io.kestra.plugin.aws.billing.GetAnomaliesExamples
List anomalies of the last 7 days with an impact of at least 100 USD and log how many were found.
id: aws_cost_anomalies
namespace: company.finops
tasks:
- id: anomalies
type: io.kestra.plugin.aws.billing.GetAnomalies
region: us-east-1
accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
startDate: "{{ now() | dateAdd(-7, 'DAYS') | date('yyyy-MM-dd') }}"
endDate: "{{ now() | date('yyyy-MM-dd') }}"
minImpactUsd: 100
fetchType: FETCH
- id: log_anomalies
type: io.kestra.plugin.core.log.Log
message: "{{ outputs.anomalies.size }} anomalies, {{ outputs.anomalies.totalImpact }} USD of total impact"
Properties
endDate *string
End date
End of the time period, as yyyy-MM-dd. Exclusive for GetCostAndUsage and GetCostForecast, like in the Cost Explorer API (the whole month of January is 2026-01-01 to 2026-02-01); inclusive for GetAnomalies (2026-01-01 to 2026-01-31).
startDate *string
Start date
Start of the time period, inclusive, as yyyy-MM-dd.
accessKeyId string
Access Key Id in order to connect to AWS
If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150endpointOverride string
The endpoint with which the SDK should communicate
This property allows you to use a different S3 compatible storage backend.
fetchType string
STORESTOREFETCHFETCH_ONENONEFetch strategy
Default STORE writes all anomalies to internal storage. FETCH returns all anomalies, FETCH_ONE the first one, NONE only the count and total impact. FETCH_ONE stops requesting pages as soon as a page returns an anomaly; if more pages exist, truncated is true and totalImpact only covers the pages read.
maxPages integerstring
10Maximum number of pages
Stops after this many GetAnomalies requests, each one costing $0.01, and logs a warning if more anomalies were available. Default 10, between 1 and 1000.
minImpactUsd numberstring
Minimum total impact (USD)
Only return anomalies whose total impact is greater than or equal to this amount.
monitorArn string
Monitor ARN
Only return anomalies detected by this anomaly monitor. All monitors when not set.
region string
AWS region with which the SDK should communicate
secretKeyId string
Secret Key Id in order to connect to AWS
If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
sessionToken string
AWS session token, retrieved from an AWS token service, used for authenticating that this user has received temporary permissions to access a given resource
If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
stsEndpointOverride string
The AWS STS endpoint with which the SDKClient should communicate
stsRoleArn string
AWS STS Role
The Amazon Resource Name (ARN) of the role to assume. If set the task will use the StsAssumeRoleCredentialsProvider. If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
stsRoleExternalId string
AWS STS External Id
A unique identifier that might be required when you assume a role in another account. This property is only used when an stsRoleArn is defined.
stsRoleSessionDuration string
PT15MAWS STS Session duration
The duration of the role session (default: 15 minutes, i.e., PT15M). This property is only used when an stsRoleArn is defined.
stsRoleSessionName string
AWS STS Session name
This property is only used when an stsRoleArn is defined.
Outputs
row object
First anomaly
Single anomaly when fetchType is FETCH_ONE.
rows array
Anomalies
All anomalies when fetchType is FETCH, each with anomalyId, dates, dimensionValue, monitorArn, impact amounts in USD (totalImpact, maxImpact, totalActualSpend, totalExpectedSpend), scores and rootCauses.
size integer
Anomaly count
Number of anomalies in the output: all anomalies read for FETCH, STORE and NONE, 1 or 0 for FETCH_ONE.
totalImpact number
Total impact (USD)
Sum of the total impact of the anomalies read.
truncated boolean
Truncated
True when more pages were available but not read: maxPages was reached, or fetchType is FETCH_ONE and the first page with an anomaly was not the last one. totalImpact then only covers the pages read.
uri string
uriStored data URI
Internal storage URI of an ION file with all anomalies when fetchType is STORE.
Metrics
fetch.rows counter
rowsNumber of anomalies fetched or stored.
requests counter
requestsNumber of paid Cost Explorer requests made.
