Network-related spend in this account increased 34% month-over-month, concentrated in NAT Gateway data processing. Usage-type anomaly detection confirmed the movement was statistically significant (z-score 2.7). Source workload has not yet been identified: no VPC Flow Log evidence and no tag-based ownership are currently available. This report does not estimate addressable savings; remediation value depends on the traffic path and workload requirements once identified. Cost Health Score: 62/100 (D).
| # | Severity | Action | Impact | Effort |
|---|---|---|---|---|
| 1 | Critical | NAT Gateway data processing spike, network spend +34% month-over-month in account 012345678901 Enable VPC Flow Logs on the platform VPC. Reconcile the NAT Gateway ENI to subnet and workload, then re-run. | Not estimated | Medium |
| 2 | High | AWS-detected anomaly: NAT Gateway data processing, account 012345678901 Verify in the AWS Cost Anomaly Detection console; AnomalyId: AnomalyOverlap-0001; mark feedback if expected. | Not estimated | Medium |
| 3 | Medium | 14 idle EBS volumes identified Confirm the volumes are unattached and unneeded, then schedule for deletion or snapshot-and-delete. | $312/mo | Low |
Amazon EC2 is the largest cost driver at 42%. Spend is moderately diversified.
83%. Two items could not be checked: VPC Flow Log evidence and tag-based ownership resolution. See the Network Topology pack below.
| Category | Score | |
|---|---|---|
| network_spend_movement | +34.0% |
Cost Explorer service breakdown and usage-type anomaly detection point to NAT Gateway data processing rather than an across-the-board EC2 increase (z-score 2.7).
Recommended: Enable VPC Flow Logs on the platform VPC. Reconcile the NAT Gateway ENI to subnet and workload, then re-run.
| period | 2026-06-01 to 2026-06-30 |
|---|---|
| z_score | 2.7 |
| methods | Z:2.7σ, usage-type breakdown |
| could_not_check | VPC Flow Logs unavailable; tag-based ownership unresolved |
| overlap_with | cost-anomaly_aws_native-natgw012345 |
A secondary, unrelated cost movement in the same period. Included so this fixture shows more than one finding class, not folded into the NAT Gateway narrative.
Recommended: Investigate Amazon RDS cost change; no single account drives it. Compare per-account spend over the anomaly window.
| id | cost-anomaly_statistical-rds9f3a21 |
|---|---|
| period | 2026-06-01 to 2026-06-30 |
| z_score | 2.1 |
| methods | Z:2.1σ, IQR |
AWS Cost Anomaly Detection independently flagged the same NAT Gateway data-processing movement over the June 2026 period.
Recommended: Verify in the AWS Cost Anomaly Detection console; AnomalyId: AnomalyOverlap-0001; mark feedback if expected.
| source | aws_cost_anomaly_detection |
|---|---|
| aws_anomaly_id | AnomalyOverlap-0001 |
| period | 2026-06-01 to 2026-06-30 |
| overlap_with | cost-anomaly_statistical-natgw012345 |
| Category | Score | |
|---|---|---|
| idle_ebs_volumes | 14 volumes ($312/mo) |
14 unattached EBS volumes have carried no I/O for the lookback window.
Recommended: Confirm the volumes are unattached and unneeded, then schedule for deletion or snapshot-and-delete.
| id | sweep-idle_ebs_volumes-ebs14vol |
|---|
An unattached Elastic IP still bills hourly.
Recommended: Release the 3 unattached Elastic IP addresses if no longer needed.
| id | sweep-unattached_eips-eip3 |
|---|
gp3 is priced independently of provisioned IOPS and throughput, and is typically cheaper than gp2 at the same size.
Recommended: Migrate the identified gp2 volumes to gp3 during a normal maintenance window.
| id | sweep-gp2_migration_candidates-gp2six |
|---|
| Category | Score | |
|---|---|---|
| flow_log_coverage | Not enabled |
Without Flow Logs, the NAT Gateway traffic movement above cannot be attributed to a source workload.
Recommended: Enable VPC Flow Logs on the platform VPC so the next run can attribute this traffic.
| id | topo-flow_log_coverage-vpcmain |
|---|