AWS::CE::AnomalySubscription - AWS CloudFormation
SyntaxPropertiesReturn valuesExamplesSee also

AWS::CE::AnomalySubscription

The AWS::CE::AnomalySubscription resource (also referred to as an alert subscription) is a Cost Explorer resource type that sends notifications about specific anomalies that meet an alerting criteria defined by you.

You can specify the frequency of the alerts and the subscribers to notify.

Anomaly subscriptions can be associated with one or more AWS::CE::AnomalyMonitor resources, and they only send notifications about anomalies detected by those associated monitors. You can also configure a threshold to further control which anomalies are included in the notifications.

Anomalies that don’t exceed the chosen threshold and therefore don’t trigger notifications from an anomaly subscription will still be available on the console and from the GetAnomalies API.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::CE::AnomalySubscription",
  "Properties" : {
      "Frequency" : String,
      "MonitorArnList" : [ String, ... ],
      "ResourceTags" : [ ResourceTag, ... ],
      "Subscribers" : [ Subscriber, ... ],
      "SubscriptionName" : String,
      "Threshold" : Double,
      "ThresholdExpression" : String
    }
}

YAML

Type: AWS::CE::AnomalySubscription
Properties: 
  Frequency: String
  MonitorArnList: 
    - String
  ResourceTags: 
    - ResourceTag
  Subscribers: 
    - Subscriber
  SubscriptionName: String
  Threshold: Double
  ThresholdExpression: String

Properties

Frequency

The frequency that anomaly notifications are sent. Notifications are sent either over email (for DAILY and WEEKLY frequencies) or SNS (for IMMEDIATE frequency). For more information, see Creating an Amazon SNS topic for anomaly notifications.

Required: Yes

Type: String

Allowed values: DAILY | IMMEDIATE | WEEKLY

Update requires: No interruption

MonitorArnList

A list of cost anomaly monitors.

Required: Yes

Type: List of String

Update requires: No interruption

ResourceTags

Property description not available.

Required: No

Type: List of ResourceTag

Update requires: Replacement

Subscribers

A list of subscribers to notify.

Required: Yes

Type: List of Subscriber

Update requires: No interruption

SubscriptionName

The name for the subscription.

Required: Yes

Type: String

Minimum: 0

Maximum: 1024

Pattern: [\S\s]*

Update requires: No interruption

Threshold

(deprecated)

An absolute dollar value that must be exceeded by the anomaly's total impact (see Impact for more details) for an anomaly notification to be generated.

This field has been deprecated. To specify a threshold, use ThresholdExpression. Continued use of Threshold will be treated as shorthand syntax for a ThresholdExpression.

One of Threshold or ThresholdExpression is required for AWS::CE::AnomalySubscription. You cannot specify both.

Required: No

Type: Double

Update requires: No interruption

ThresholdExpression

An Expression object in JSON string format used to specify the anomalies that you want to generate alerts for. This supports dimensions and nested expressions. The supported dimensions are ANOMALY_TOTAL_IMPACT_ABSOLUTE and ANOMALY_TOTAL_IMPACT_PERCENTAGE, corresponding to an anomaly’s TotalImpact and TotalImpactPercentage, respectively (see Impact for more details). The supported nested expression types are AND and OR. The match option GREATER_THAN_OR_EQUAL is required. Values must be numbers between 0 and 10,000,000,000 in string format.

One of Threshold or ThresholdExpression is required for AWS::CE::AnomalySubscription. You cannot specify both.

For further information, see the Examples section of this page.

Required: No

Type: String

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Reffunction, Refreturns SubscriptionArn. For example:

           { "Ref": "myAnomalyMonitorLogicalName" }        

For more information about using the Reffunction, see Ref.

Fn::GetAtt

The Fn::GetAttintrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAttintrinsic function, see Fn::GetAtt.

AccountId

Your unique account identifier.

SubscriptionArn

The AnomalySubscription Amazon Resource Name (ARN).

Examples

Attaching subscriptions to monitors

The following example shows two monitors attached to a subscription.

JSON


{
  "Resources": {
    "CustomAnomalyMonitorWithLinkedAccount": {
      "Type": "AWS::CE::AnomalyMonitor",
      "Properties": {
        "MonitorName": "MonitorName",
        "MonitorType": "CUSTOM",
        "MonitorSpecification": " { \"Dimensions\" : { \"Key\" : \"LINKED_ACCOUNT\", \"Values\" : [ \"123456789012\", \"123456789013\" ] } }"
      }
    },
    "AnomalyServiceMonitor": {
      "Type": "AWS::CE::AnomalyMonitor",
      "Properties": {
        "MonitorName": "MonitorName",
        "MonitorType": "DIMENSIONAL",
        "MonitorDimension": "SERVICE"
      }
    },
    "AnomalySubscription": {
      "Type": "AWS::CE::AnomalySubscription",
      "Properties": {
        "SubscriptionName": "SubscriptionName",
        "Threshold": 100,
        "Frequency": "DAILY",
        "MonitorArnList": [
          {"Ref": "CustomAnomalyMonitorWithLinkedAccount"},
          {"Ref": "AnomalyServiceMonitor"}
        ],
        "Subscribers": [
          {
            "Type": "EMAIL",
            "Address": "abc@def.com"
          }
        ]
      }
    }
  }
}

YAML


Resources:
   CustomAnomalyMonitorWithLinkedAccount:
    Type: 'AWS::CE::AnomalyMonitor'
    Properties:
      MonitorName: "MonitorName"
      MonitorType: "CUSTOM"
      MonitorSpecification: '
            {
              "Dimensions" : {
                "Key" : "LINKED_ACCOUNT",
                "Values" : [ "123456789012", "123456789013" ]
              }
            }' 
            
   AnomalyServiceMonitor:
    Type: 'AWS::CE::AnomalyMonitor'
    Properties:
      MonitorName: 'MonitorName'
      MonitorType: 'DIMENSIONAL'
      MonitorDimension: 'SERVICE' 

   AnomalySubscription:
    Type: 'AWS::CE::AnomalySubscription'
    Properties:
      SubscriptionName: "SubscriptionName"
      Threshold: 100
      Frequency: "DAILY"
      MonitorArnList: [
         !Ref CustomAnomalyMonitorWithLinkedAccount,
         !Ref AnomalyServiceMonitor
      ]
      Subscribers: [
        {
          "Type": "EMAIL",
          "Address": "abc@def.com"
        }
      ]

Using a percentage-based threshold

The following example creates a subscription using a percentage-based threshold.

JSON


{
  "Resources": {
    "AnomalySubscription": {
      "Type": "AWS::CE::AnomalySubscription",
      "Properties": {
        "SubscriptionName": "SubscriptionName",
        "ThresholdExpression": "{ \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_PERCENTAGE\", \"Values\": [ \"100\" ], \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ] } }",
        "MonitorArnList": [],
        "Subscribers": [
          {
            "Address": "abc@def.com",
            "Type": "EMAIL"
          }
        ],
        "Frequency": "DAILY"
      }
    }
  }
}

YAML


Resources:
   AnomalySubscription:
    Type: 'AWS::CE::AnomalySubscription'
    Properties:
      SubscriptionName: "Subscription 1"
      ThresholdExpression: '{
        "Dimensions": {
          "Key": "ANOMALY_TOTAL_IMPACT_PERCENTAGE",
          "MatchOptions": [ "GREATER_THAN_OR_EQUAL" ],
          "Values": [ "100" ]
        }
      }'
      Frequency: "DAILY"
      MonitorArnList: [ ]
      Subscribers: [
        {
          "Type": "EMAIL",
          "Address": "abc@def.com"
        }
      ]

Using a percentage-based threshold and absolute threshold combined with AND

The following example creates a subscription using a percentage-based threshold and absolute threshold combined with AND.

JSON


{
  "Resources": {
    "AnomalySubscription": {
      "Type": "AWS::CE::AnomalySubscription",
      "Properties": {
        "SubscriptionName": "SubscriptionName",
        "ThresholdExpression": "{ \"And\": [ { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_PERCENTAGE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } }, { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_ABSOLUTE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"200\" ] } } ] }",
        "MonitorArnList": [],
        "Subscribers": [
          {
            "Address": "abc@def.com",
            "Type": "EMAIL"
          }
        ],
        "Frequency": "DAILY"
      }
    }
  }
}

YAML


Resources:
  AnomalySubscription:
    Type: 'AWS::CE::AnomalySubscription'
    Properties:
      SubscriptionName: "SubscriptionName"
      ThresholdExpression: '{
        "And": [
          {
            "Dimensions": {
              "Key": "ANOMALY_TOTAL_IMPACT_PERCENTAGE",
              "MatchOptions": [ "GREATER_THAN_OR_EQUAL" ],
              "Values": [ "100" ]
            }
          },
          {
            "Dimensions": {
              "Key": "ANOMALY_TOTAL_IMPACT_ABSOLUTE",
              "MatchOptions": [ "GREATER_THAN_OR_EQUAL" ],
              "Values": [ "200" ]
            }
          }
        ]
      }'
      Frequency: "DAILY"
      MonitorArnList: [ ]
      Subscribers: [
        {
          "Type": "EMAIL",
          "Address": "abc@def.com"
        }
      ]

Using a percentage-based threshold and absolute threshold combined with OR

The following example creates a subscription using a percentage-based threshold and absolute threshold combined with OR.

JSON

{
  "Resources": {
    "AnomalySubscription": {
      "Type": "AWS::CE::AnomalySubscription",
      "Properties": {
        "SubscriptionName": "SubscriptionName",
        "ThresholdExpression": "{ \"Or\": [ { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_PERCENTAGE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"100\" ] } }, { \"Dimensions\": { \"Key\": \"ANOMALY_TOTAL_IMPACT_ABSOLUTE\", \"MatchOptions\": [ \"GREATER_THAN_OR_EQUAL\" ], \"Values\": [ \"200\" ] } } ] }",
        "MonitorArnList": [],
        "Subscribers": [
          {
            "Address": "abc@def.com",
            "Type": "EMAIL"
          }
        ],
        "Frequency": "DAILY"
      }
    }
  }
}

YAML


Resources:
  AnomalySubscription:
    Type: 'AWS::CE::AnomalySubscription'
    Properties:
      SubscriptionName: "SubscriptionName"
      ThresholdExpression: '{
        "Or": [
          {
            "Dimensions": {
              "Key": "ANOMALY_TOTAL_IMPACT_PERCENTAGE",
              "MatchOptions": [ "GREATER_THAN_OR_EQUAL" ],
              "Values": [ "100" ]
            }
          },
          {
            "Dimensions": {
              "Key": "ANOMALY_TOTAL_IMPACT_ABSOLUTE",
              "MatchOptions": [ "GREATER_THAN_OR_EQUAL" ],
              "Values": [ "200" ]
            }
          }
        ]
      }'
      Frequency: "DAILY"
      MonitorArnList: [ ]
      Subscribers: [
        {
          "Type": "EMAIL",
          "Address": "abc@def.com"
        }
      ]

See also