Skip to content

aws.ce.get_anomalies

Example SQL Queries

SELECT * FROM
aws.ce.get_anomalies
WHERE
"date_interval" = 'VALUE';

Description

Retrieves all of the cost anomalies detected on your account during the time period that's specified by the DateInterval object. Anomalies are available for up to 90 days.

Table Definition

Column NameColumn Data Type
date_interval Required Input Column

Assigns the start and end dates for retrieving cost anomalies. The returned anomaly object will have an AnomalyEndDate in the specified time range.

STRUCT(
"start_date" VARCHAR,
"end_date" VARCHAR
)
Show child fields
date_interval.end_date

The last date an anomaly was observed.

date_interval.start_date

The first date an anomaly was observed.

feedback Input Column

Filters anomaly results by the feedback field on the anomaly object.

VARCHAR
max_results Input Column

The number of entries a paginated response contains.

BIGINT
monitor_arn Input Column

Retrieves all of the cost anomalies detected for a specific cost anomaly monitor Amazon Resource Name (ARN).

VARCHAR
next_page_token Input Column

The token to retrieve the next set of results. Amazon Web Services provides the token when the response from a previous call has more results than the maximum page size.

VARCHAR
total_impact Input Column

Filters anomaly results by the total impact field on the anomaly object. For example, you can filter anomalies GREATER_THAN 200.00 to retrieve anomalies, with an estimated dollar impact greater than 200.

STRUCT(
"numeric_operator" VARCHAR,
"start_value" DOUBLE,
"end_value" DOUBLE
)
Show child fields
total_impact.end_value

The upper bound dollar value that's used in the filter.

total_impact.numeric_operator

The comparing value that's used in the filter.

total_impact.start_value

The lower bound dollar value that's used in the filter.

_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

anomalies

A list of cost anomalies.

STRUCT(
"anomaly_id" VARCHAR,
"anomaly_start_date" VARCHAR,
"anomaly_end_date" VARCHAR,
"dimension_value" VARCHAR,
"root_causes" STRUCT(
"service" VARCHAR,
"region" VARCHAR,
"linked_account" VARCHAR,
"usage_type" VARCHAR,
"linked_account_name" VARCHAR
)[],
"anomaly_score" STRUCT(
"max_score" DOUBLE,
"current_score" DOUBLE
),
"impact" STRUCT(
"max_impact" DOUBLE,
"total_impact" DOUBLE,
"total_actual_spend" DOUBLE,
"total_expected_spend" DOUBLE,
"total_impact_percentage" DOUBLE
),
"monitor_arn" VARCHAR,
"feedback" VARCHAR
)[]
Show child fields
anomalies[]
Show child fields
anomalies[].anomaly_end_date

The last day the anomaly is detected.

anomalies[].anomaly_id

The unique identifier for the anomaly.

anomalies[].anomaly_score

The latest and maximum score for the anomaly.

Show child fields
anomalies[].anomaly_score.current_score

The last observed score.

anomalies[].anomaly_score.max_score

The maximum score that's observed during the AnomalyDateInterval.

anomalies[].anomaly_start_date

The first day the anomaly is detected.

anomalies[].dimension_value

The dimension for the anomaly (for example, an Amazon Web Service in a service monitor).

anomalies[].feedback

The feedback value.

anomalies[].impact

The dollar impact for the anomaly.

Show child fields
anomalies[].impact.max_impact

The maximum dollar value that's observed for an anomaly.

anomalies[].impact.total_actual_spend

The cumulative dollar amount that was actually spent during the anomaly.

anomalies[].impact.total_expected_spend

The cumulative dollar amount that was expected to be spent during the anomaly. It is calculated using advanced machine learning models to determine the typical spending pattern based on historical data for a customer.

anomalies[].impact.total_impact

The cumulative dollar difference between the total actual spend and total expected spend. It is calculated as TotalActualSpend - TotalExpectedSpend.

anomalies[].impact.total_impact_percentage

The cumulative percentage difference between the total actual spend and total expected spend. It is calculated as (TotalImpact/TotalExpectedSpend) * 100. When TotalExpectedSpend is zero, this field is omitted. Expected spend can be zero in situations such as when you start to use a service for the first time.

anomalies[].monitor_arn

The Amazon Resource Name (ARN) for the cost monitor that generated this anomaly.

anomalies[].root_causes[]
Show child fields
anomalies[].root_causes[].linked_account

The member account value that's associated with the cost anomaly.

anomalies[].root_causes[].linked_account_name

The member account name value that's associated with the cost anomaly.

anomalies[].root_causes[].region

The Amazon Web Services Region that's associated with the cost anomaly.

anomalies[].root_causes[].service

The Amazon Web Service name that's associated with the cost anomaly.

anomalies[].root_causes[].usage_type

The UsageType value that's associated with the cost anomaly.