Detect cloud cost anomalies with AWS Cost Explorer, GCP Billing and GPT-4o-mini
Go to Workflow
Rahul Joshi
Description
Quick overview
This workflow runs daily to detect AWS and optional GCP cost spikes, enriches AWS anomalies with CloudTrail context and an OpenAI explanation, posts actionable alerts and a run summary to Slack, and logs anomalies plus approve/ignore decisions to Google Sheets via one-time webhook links.
How it works
Runs every day on a schedule (9 AM IST) and loads threshold/config values plus the existing anomaly log from Google Sheets.
Pulls recent daily AWS spend by service and region from AWS Cost Explorer (and optionally queries GCP costs from a BigQuery billing export) and normalizes both into a common structure.
Detects day-over-day cost anomalies using dollar, percent, and z-score thresholds while skipping already-seen anomalies and those muted by prior “ignore” decisions.
Posts a one-message run summary to Slack listing the anomalies alerted in this run.
For each anomaly, fetches recent AWS CloudTrail write events for the affected region when available and sends the anomaly context to OpenAI (gpt-4o-mini) to generate a probable root cause and suggested actions.
Posts a Slack alert with key metrics, AI explanation, and buttons to approve as expected or ignore for 7 days, then records the anomaly in Google Sheets.
When a button link is clicked, a webhook validates the one-time token, updates the anomaly status (Approved or Ignored with a suppression date) in Google Sheets, returns a confirmation/error page, and posts the decision back to Slack.
Setup
Create a Google Sheet with an “Anomaly Log” tab and paste its spreadsheet ID into all Google Sheets steps.
Add AWS credentials that allow Cost Explorer (GetCostAndUsage) and CloudTrail (LookupEvents), and enable AWS in the config values.
If using GCP, add Google OAuth2 credentials with BigQuery access, enable GCP in the config values, and set the GCP project ID and billing export table name.
Add OpenAI credentials (for gpt-4o-mini) and Slack credentials, then set the target Slack channel ID for both the run summary and anomaly alerts.
Set the webhook base URL in the config values and ensure the “cost-anomaly-action” webhook URL is reachable from Slack button clicks.
This workflow was created by Rahul Joshi and shared publicly on the n8n community template library. n8nFind indexes it for discovery — the workflow remains the property of its original creator.