The first time most people find out about a billing spike is the invoice. Budget alarms tell you the same week it starts, and take ten minutes to set up.

1. Enable billing alerts (root account, once)

Billing data only reaches CloudWatch if this is turned on. Go to the Billing console → Billing preferences → check “Receive CloudWatch Billing Alerts.” This has to be done from the root account or an account with explicit billing permissions; it’s a one-time setting per account.

2. Create a budget with an alert threshold

AWS Budgets is the actual tool for this, not a raw CloudWatch alarm — it understands cost forecasting, not just current spend.

aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{
    "BudgetName": "monthly-total",
    "BudgetLimit": {"Amount": "500", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST"
  }' \
  --notifications-with-subscribers '[{
    "Notification": {
      "NotificationType": "ACTUAL",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 80
    },
    "Subscribers": [{"SubscriptionType": "EMAIL", "Address": "you@example.com"}]
  }]'

Set at least two thresholds, not one: an early warning around 50-80% of your expected monthly spend (catches a slow trend) and a hard alert at 100%+ (catches something already gone wrong). One threshold at exactly your limit tells you after it’s too late to do anything but investigate.

3. Add a forecasted-spend alert, not just actual spend

"NotificationType": "ACTUAL" only fires once you’ve already spent the threshold amount. Add a second notification with "NotificationType": "FORECASTED" — Budgets projects your end-of-month spend based on the current trend and alerts you before you actually hit it, which is the difference between “you’re going to have a problem” and “you have a problem.”

4. Turn on Cost Anomaly Detection

Budgets catch “you’re spending more than X total.” They don’t catch “your Lambda bill tripled overnight while everything else stayed flat” — a real spike hidden inside a total that still looks normal. Cost Anomaly Detection watches per-service spend patterns and flags statistical outliers:

Console → Cost Management → Cost Anomaly Detection → Create monitor, scoped to your whole account or a specific service. Attach an alert subscription with a dollar threshold so you’re not notified on every $2 blip.

This is the tool that actually catches the classic runaway cases — an infinite Lambda retry loop, a misconfigured cron job firing every minute instead of every hour, a forgotten dev environment left running. A flat monthly budget alarm often doesn’t trip until well after the damage, because the spike gets averaged into a month that still nets out under threshold.

5. Set a Service Control Policy backstop for real emergencies, if you’re in an AWS Organization

Budgets and anomaly detection tell you about a problem. They don’t stop it. If you want an actual circuit breaker — not just a notification — AWS Budgets can trigger an action (via a linked IAM policy or Service Control Policy) that restricts specific actions once a threshold is breached. This is a bigger commitment than an email alert and can itself cause an outage if misconfigured, so reserve it for accounts where a runaway bill is a bigger risk than a false-positive lockout — typically sandbox or dev accounts, not production.

The realistic minimum

If you do nothing else: one monthly total budget with an 80% actual-spend email alert, and Cost Anomaly Detection turned on for the whole account with a $50-100 threshold. That’s the ten-minute version, and it catches the two failure modes that actually happen — slow overspend and sudden spike — without needing an Organization or SCPs at all.