Skip to content
AWS for Query.Farm

aws.ce.get_anomaly_monitors

Example SQL Queries

SELECT * FROM
aws.ce.get_anomaly_monitors;

Description

Retrieves the cost anomaly monitor definitions for your account. You can filter using a list of cost anomaly monitor Amazon Resource Names (ARNs).

Table Definition

Column NameColumn Data Type
max_results Input Column

The number of entries that a paginated response contains. 

BIGINT
monitor_arn_list Input Column

A list of cost anomaly monitor ARNs. 

VARCHAR[]
Show child fields
monitor_arn_list[]
next_page_token Input Column

The token to retrieve the next set of results. Amazon Web Services provides the token when the response from a previous call has more results than the maximum page size. 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

anomaly_monitors

A list of cost anomaly monitors that includes the detailed metadata for each monitor. 

STRUCT(
    "monitor_arn" VARCHAR,
    "monitor_name" VARCHAR,
    "creation_date" VARCHAR,
    "last_updated_date" VARCHAR,
    "last_evaluated_date" VARCHAR,
    "monitor_type" VARCHAR,
    "monitor_dimension" VARCHAR,
    "monitor_specification" STRUCT(
        "dimensions" STRUCT(
            "key" VARCHAR,
            "values" VARCHAR[],
            "match_options" VARCHAR[]
        ),
        "tags" STRUCT(
            "key" VARCHAR,
            "values" VARCHAR[],
            "match_options" VARCHAR[]
        ),
        "cost_categories" STRUCT(
            "key" VARCHAR,
            "values" VARCHAR[],
            "match_options" VARCHAR[]
        )
    ),
    "dimensional_value_count" BIGINT
)[]
Show child fields
anomaly_monitors[]
Show child fields
anomaly_monitors[].creation_date

The date when the monitor was created.

anomaly_monitors[].dimensional_value_count

The value for evaluated dimensions.

anomaly_monitors[].last_evaluated_date

The date when the monitor last evaluated for anomalies.

anomaly_monitors[].last_updated_date

The date when the monitor was last updated.

anomaly_monitors[].monitor_arn

The Amazon Resource Name (ARN) value.

anomaly_monitors[].monitor_dimension

The dimensions to evaluate.

anomaly_monitors[].monitor_name

The name of the monitor.

anomaly_monitors[].monitor_specification

Use Expression to filter in various Cost Explorer APIs.

Not all Expression types are supported in each API. Refer to the documentation for each specific API to see what is supported.

There are two patterns:

  • Simple dimension values.

    • There are three types of simple dimension values: CostCategories, Tags, and Dimensions.

      • Specify the CostCategories field to define a filter that acts on Cost Categories.

      • Specify the Tags field to define a filter that acts on Cost Allocation Tags.

      • Specify the Dimensions field to define a filter that acts on the DimensionValues .

    • For each filter type, you can set the dimension name and values for the filters that you plan to use.

      • For example, you can filter for REGION==us-east-1 OR REGION==us-west-1. For GetRightsizingRecommendation, the Region is a full name (for example, REGION==US East (N. Virginia).

      • The corresponding Expression for this example is as follows: { "Dimensions": { "Key": "REGION", "Values": [ "us-east-1", "us-west-1" ] } }

      • As shown in the previous example, lists of dimension values are combined with OR when applying the filter.

    • You can also set different match options to further control how the filter behaves. Not all APIs support match options. Refer to the documentation for each specific API to see what is supported.

      • For example, you can filter for linked account names that start with "a".

      • The corresponding Expression for this example is as follows: { "Dimensions": { "Key": "LINKED_ACCOUNT_NAME", "MatchOptions": [ "STARTS_WITH" ], "Values": [ "a" ] } }

  • Compound Expression types with logical operations.

    • You can use multiple Expression types and the logical operators AND/OR/NOT to create a list of one or more Expression objects. By doing this, you can filter by more advanced options.

    • For example, you can filter by ((REGION == us-east-1 OR REGION == us-west-1) OR (TAG.Type == Type1)) AND (USAGE_TYPE != DataTransfer).

    • The corresponding Expression for this example is as follows: { "And": [ {"Or": [ {"Dimensions": { "Key": "REGION", "Values": [ "us-east-1", "us-west-1" ] }}, {"Tags": { "Key": "TagName", "Values": ["Value1"] } } ]}, {"Not": {"Dimensions": { "Key": "USAGE_TYPE", "Values": ["DataTransfer"] }}} ] }

    Because each Expression can have only one operator, the service returns an error if more than one is specified. The following example shows an Expression object that creates an error: { "And": [ ... ], "Dimensions": { "Key": "USAGE_TYPE", "Values": [ "DataTransfer" ] } }

    The following is an example of the corresponding error message: "Expression has more than one roots. Only one root operator is allowed for each expression: And, Or, Not, Dimensions, Tags, CostCategories"

For the GetRightsizingRecommendation action, a combination of OR and NOT isn't supported. OR isn't supported between different dimensions, or dimensions and tags. NOT operators aren't supported. Dimensions are also limited to LINKED_ACCOUNT, REGION, or RIGHTSIZING_TYPE.

For the GetReservationPurchaseRecommendation action, only NOT is supported. AND and OR aren't supported. Dimensions are limited to LINKED_ACCOUNT.

Show child fields
anomaly_monitors[].monitor_specification.cost_categories

The filter that's based on CostCategory values.

Show child fields
anomaly_monitors[].monitor_specification.cost_categories.key

The unique name of the Cost Category.

anomaly_monitors[].monitor_specification.cost_categories.match_options[]
anomaly_monitors[].monitor_specification.cost_categories.values[]
anomaly_monitors[].monitor_specification.dimensions

The specific Dimension to use for Expression.

Show child fields
anomaly_monitors[].monitor_specification.dimensions.key

The names of the metadata types that you can use to filter and group your results. For example, AZ returns a list of Availability Zones.

Not all dimensions are supported in each API. Refer to the documentation for each specific API to see what is supported.

LINK_ACCOUNT_NAME and SERVICE_CODE can only be used in CostCategoryRule.

ANOMALY_TOTAL_IMPACT_ABSOLUTE and ANOMALY_TOTAL_IMPACT_PERCENTAGE can only be used in AnomalySubscriptions.

anomaly_monitors[].monitor_specification.dimensions.match_options[]
anomaly_monitors[].monitor_specification.dimensions.values[]
anomaly_monitors[].monitor_specification.tags

The specific Tag to use for Expression.

Show child fields
anomaly_monitors[].monitor_specification.tags.key

The key for the tag.

anomaly_monitors[].monitor_specification.tags.match_options[]
anomaly_monitors[].monitor_specification.tags.values[]
anomaly_monitors[].monitor_type

The possible type values.