Synthetic sample report
This report uses fixture data only. No customer data, no real AWS account IDs, and no live AWS environment were used. It was written by hand in the shape of Kulshan 0.6.2 output; it was not emitted by the tool.

Kulshan Report

Account: 012345678901 (synthetic)
Period: 2026-06-01 to 2026-06-30
2026-06-30 12:00:00 UTC

Executive Summary

Network-related spend in this account increased 34% month-over-month, concentrated in NAT Gateway data processing. Usage-type anomaly detection confirmed the movement was statistically significant (z-score 2.7). Source workload has not yet been identified: no VPC Flow Log evidence and no tag-based ownership are currently available. This report does not estimate addressable savings; remediation value depends on the traffic path and workload requirements once identified.

Evidence Contract (analyst interpretation)

Written by the analyst from the findings below. Kulshan supplies findings and provenance; it does not decide what contradicts a conclusion or what evidence is missing.

Question or hypothesis
Why did network-related spend increase 34% month over month in the platform account? Working hypothesis: NAT Gateway data processing is the main contributor.
Supporting evidence
The Cost Explorer service and usage-type breakdown isolates the increase to NAT Gateway data processing (NatGateway-Bytes), not an across-the-board EC2 increase. Kulshan's statistical anomaly check flags the movement (z-score 2.7), and AWS Cost Anomaly Detection independently flags the same movement (AnomalyOverlap-0001).
Contradicting evidence
None identified within the evidence reviewed: the Cost Explorer breakdown, the cost, sweep and topo findings, and AWS Cost Anomaly Detection for June 2026. The concurrent Amazon RDS movement (z-score 2.1) was checked and does not weaken the hypothesis, because it is in a different service, not network spend. The review did not include flow logs or workload data, so it could not surface every kind of counter-evidence.
Missing evidence
No VPC Flow Logs for the platform VPC, so the source workload, the destination, and whether the path is intra-region or cross-AZ are unknown. No tag-based ownership for the NAT Gateway ENI. No confirmation from the platform owner on whether the transfer was expected.
Confidence and limits
Strong for the cost driver: two independent detections point to NAT Gateway processing. Low for cause and ownership: the evidence does not establish which workload generated the traffic or whether it is avoidable. Untested alternative explanations include S3 or DynamoDB traffic routed through NAT without gateway endpoints, cross-AZ routing, a new or changed workload, and expected growth. No savings estimate is made.
Recommended next decision
Hold the network architecture review decision until the traffic is attributed. Enable VPC Flow Logs on the platform VPC, reconcile the NAT Gateway ENI to subnet and workload, then re-run and test the alternatives above.

What To Do Next

#SeverityActionImpactEffort
1Critical
NAT Gateway data processing spike, network spend +34% month-over-month in account 012345678901
Enable VPC Flow Logs on the platform VPC. Reconcile the NAT Gateway ENI to subnet and workload, then re-run.
Not estimatedMedium
2High
AWS-detected anomaly: NAT Gateway data processing, account 012345678901
Verify in the AWS Cost Anomaly Detection console; AnomalyId: AnomalyOverlap-0001; mark feedback if expected.
Not estimatedMedium
3Medium
14 idle EBS volumes identified
Confirm the volumes are unattached and unneeded, then schedule for deletion or snapshot-and-delete.
$312/moLow

Commitment Health

Committed: 35%On-Demand: 60%Spot: 5%

Spend Concentration

Amazon EC2
42%
Amazon RDS
22%
Amazon S3
14%
AWS Lambda
8%
Amazon CloudWatch
6%

Amazon EC2 is the largest cost driver at 42%. Spend is moderately diversified.

Spend Trend

Daily average: $412Trend: Increasing (+2.0%/day)
$320$500

Detailed Breakdown

💰Cost AnalyzerD62/100
CategoryScore
network_spend_movement+34.0%
AWS Cost Anomaly Detection: ok · 1 anomaly · 90-day lookback
1 confirmed by Kulshan0 Kulshan-only0 AWS-only

Kulshan statistical anomalies

CriticalNot estimatedz-score 2.7
NAT Gateway data processing spike, network spend +34% month-over-month in account 012345678901
Account
012345678901
Service
Amazon VPC (NAT Gateway)
Usage type
NatGateway-Bytes

Cost Explorer service breakdown and usage-type anomaly detection point to NAT Gateway data processing rather than an across-the-board EC2 increase (z-score 2.7).

Recommended: Enable VPC Flow Logs on the platform VPC. Reconcile the NAT Gateway ENI to subnet and workload, then re-run.

Evidence
period2026-06-01 to 2026-06-30
z_score2.7
methodsZ:2.7σ, usage-type breakdown
could_not_checkVPC Flow Logs unavailable; tag-based ownership unresolved
overlap_withcost-anomaly_aws_native-natgw012345

Other cost movement

MediumNot estimatedz-score 2.1
Amazon RDS spend movement, no single account concentration
Account
all accounts
Service
Amazon Relational Database Service

A secondary, unrelated cost movement in the same period. Included so this fixture shows more than one finding class, not folded into the NAT Gateway narrative.

Recommended: Investigate Amazon RDS cost change; no single account drives it. Compare per-account spend over the anomaly window.

Evidence
idcost-anomaly_statistical-rds9f3a21
period2026-06-01 to 2026-06-30
z_score2.1
methodsZ:2.1σ, IQR

AWS-native Cost Anomaly Detection

HighNot estimatedconfirmed
AWS-detected anomaly: NAT Gateway data processing, account 012345678901
Account
012345678901
Service
Amazon VPC (NAT Gateway)
Usage type
NatGateway-Bytes

AWS Cost Anomaly Detection independently flagged the same NAT Gateway data-processing movement over the June 2026 period.

Recommended: Verify in the AWS Cost Anomaly Detection console; AnomalyId: AnomalyOverlap-0001; mark feedback if expected.

Evidence
sourceaws_cost_anomaly_detection
aws_anomaly_idAnomalyOverlap-0001
period2026-06-01 to 2026-06-30
overlap_withcost-anomaly_statistical-natgw012345
🧹Waste DetectorB+88/100
CategoryScore
idle_ebs_volumes14 volumes ($312/mo)
Medium$312/mo
14 idle EBS volumes identified

14 unattached EBS volumes have carried no I/O for the lookback window.

Recommended: Confirm the volumes are unattached and unneeded, then schedule for deletion or snapshot-and-delete.

Evidence
idsweep-idle_ebs_volumes-ebs14vol
Low$10.80/mo
3 unattached Elastic IP addresses

An unattached Elastic IP still bills hourly.

Recommended: Release the 3 unattached Elastic IP addresses if no longer needed.

Evidence
idsweep-unattached_eips-eip3
Low$22.40/mo
6 gp2 volumes are gp3 migration candidates

gp3 is priced independently of provisioned IOPS and throughput, and is typically cheaper than gp2 at the same size.

Recommended: Migrate the identified gp2 volumes to gp3 during a normal maintenance window.

Evidence
idsweep-gp2_migration_candidates-gp2six
🌐Network TopologyC+77/100
CategoryScore
flow_log_coverageNot enabled
Medium
VPC Flow Logs not enabled on the platform VPC

Without Flow Logs, the NAT Gateway traffic movement above cannot be attributed to a source workload.

Recommended: Enable VPC Flow Logs on the platform VPC so the next run can attribute this traffic.

Evidence
idtopo-flow_log_coverage-vpcmain