AWS CUR Anomaly Detector

Analyzes one already-exported AWS Cost and Usage Report and ranks deterministic daily unblended-cost changes without AWS credentials or raw-row disclosure. It is built for FinOps practitioners, cloud-cost analysts, engineering teams reviewing CUR exports. The main result is structured, deterministic evidence that can be consumed from the default dataset or an Apify automation.

When to use this Actor

• Find services or regions with large day-over-baseline cost changes.
• Produce stable review evidence from legacy CUR or Data Exports CUR 2.0 CSV files.
• Run a repeatable cost-change check in a scheduled Task after each report export.

How it works

• Fetch one credential-free public HTTPS CSV or gzip-compressed CSV under strict network and size controls.
• Map exact supported CUR headers, aggregate decimal costs by day and selected dimensions, and compare one day with a bounded baseline.
• Rank threshold-matching changes deterministically and persist summary, anomaly, and diagnostics records before charging.

The Actor validates only the declared product contract. It does not infer facts outside the supplied data or claim outcomes that the source material cannot prove.

Quick start

1. Open the Actor's Input tab or create a Task from one of the public examples.
2. Paste or adapt this bounded example.
3. Click Start and inspect the default dataset plus the output links shown on the run page.

{
  "reportUrl": "https://example.com/aws-cur.csv",
  "curVariant": "auto",
  "timeGrain": "day",
  "groupBy": [
    "service"
  ],
  "baselineDays": 7,
  "minAbsoluteChangeUsd": 25,
  "minPercentChange": 50,
  "direction": "both",
  "maxFindings": 100
}

Expected result: after replacing the example URL with your credential-free public CUR CSV URL, one summary, zero or more anomaly records, and one diagnostics record.

Input

The quick-start example is intentionally small. These are the material controls; the Input tab remains authoritative for the complete current schema.

Field	Purpose and format	Default	Important bounds or interaction
reportUrl	Credential-free public HTTPS URL of one CUR CSV or gzip-compressed CSV; redirects and destination addresses remain subject to the URL safety policy.	No implicit default	See the Input tab for the current schema bound.
curVariant	Selects automatic header detection or an explicit supported legacy/CUR 2.0 layout when the caller needs a fixed parser contract.	"auto"	one of auto, legacy, cur2
timeGrain	Chooses the supported calendar aggregation grain used to form comparison and baseline buckets.	"day"	one of day
groupBy	Ordered CUR dimensions that define each cost group; changing them changes the identity and number of candidate findings.	["service"]	minimum items 1; maximum items 3
baselineDays	Number of prior represented calendar days averaged for each group before it is compared with the selected day.	7	minimum 2; maximum 30
comparisonDate	Optional YYYY-MM-DD date to evaluate; when omitted, the latest date represented in the submitted report is used.	No implicit default	See the Input tab for the current schema bound.
minAbsoluteChangeUsd	USD-only absolute-change threshold retained for compatible USD workflows; use minAbsoluteChange for an explicit report-currency threshold.	25	minimum 0; maximum 1000000
minAbsoluteChange	Absolute cost-change threshold expressed in the report's single currency and combined with the percentage threshold.	No implicit default	minimum 0; maximum 1000000
minPercentChange	Minimum percentage change required in addition to the configured absolute threshold.	50	minimum 0; maximum 10000
direction	Restricts findings to increases, decreases, or both without changing the underlying aggregation.	"both"	one of increase, decrease, both
maxFindings	Caps the ranked anomaly records returned after deterministic sorting; summary and diagnostics records remain available.	100	minimum 1; maximum 1000

Unknown top-level fields and invalid field combinations fail validation rather than being guessed.

Output

The default dataset contains typed records. The run's Output tab links the dataset and any key-value-store reports declared by the current output schema.

Field	Meaning
recordType	Identifies summary, anomaly, and diagnostics records.
rank	Current dataset field.
dimensions	Current dataset field.
comparisonCost	Current dataset field.
baselineMeanCost	Current dataset field.
absoluteChange	Current dataset field.
percentChange	Current dataset field.
direction	Current dataset field.
currency	Current dataset field.
comparisonDate	Current dataset field.
findingCount	Current dataset field.
resultSha256	Hash of the complete deterministic result for reconciliation.
sourceFileSha256	Current dataset field.
explanation	Fixed rule-based explanation of the observed threshold crossing.
algorithmVersion	Current dataset field.

Representative current-schema dataset item:

{
  "recordType": "anomaly",
  "rank": 1,
  "dimensions": {
    "service": "AmazonEC2"
  },
  "comparisonCost": "180.00",
  "baselineMeanCost": "100.00",
  "absoluteChange": "80.00",
  "percentChange": "80.00",
  "direction": "increase",
  "currency": "USD",
  "comparisonDate": "2026-09-20",
  "explanation": "Cost increased beyond the configured thresholds.",
  "algorithmVersion": "1.0.0"
}

A valid zero-anomaly run is successful and still emits summary and diagnostics records with findingCount 0.

Pricing and billing

This Actor uses PAY_PER_EVENT; platform usage is included in event prices. A charge is eligible only after the billable unit described below is durably completed. Validation failures and the non-billable failure classes in the product contract do not emit the custom completion event. Higher Store tiers use the complete tier matrix below; Platinum and Diamond match Gold under the current policy. The Apify Pricing tab is authoritative if a later approved pricing change takes effect.

Event	What triggers it	FREE	BRONZE	SILVER	GOLD	PLATINUM	DIAMOND
cur-report-analyzed	One bounded AWS CUR file successfully analyzed after all required outputs are durable.	$0.10000000	$0.09800000	$0.09600000	$0.09400000	$0.09400000	$0.09400000
apify-actor-start	Platform-managed Actor start event; the Actor never charges it manually.	$0.00005000	$0.00005000	$0.00005000	$0.00005000	$0.00005000	$0.00005000

The Actor does not have Task-specific prices: public Tasks use this same live Actor pricing. Third-party costs are not implied; see the data and security section for external services actually contacted.

Limits and bounds

• One file per run: at most 100 MiB downloaded, 500 MiB expanded, 5,000,000 rows, and 500,000 groups.
• Only exact supported legacy CUR or CUR 2.0 CSV headers are accepted; ZIP, Parquet, and multi-file reports are rejected.
• One currency is allowed; non-USD reports require minAbsoluteChange in that report currency.

These are product-facing limits, not targets. Use smaller inputs when you need faster feedback or simpler evidence.

Failure and edge-case behavior

• Unsafe URL, redirect, download, format, header, currency, baseline, row, bound, or runtime failures fail closed and do not emit cur-report-analyzed.
• A valid report with zero anomalies succeeds with summary and diagnostics output.
• Rows are never fuzzily repaired; unsupported or invalid evidence remains an explicit failure.

Operationally:

• Use comparisonDate for reproducible historical checks; omission selects the latest represented file date, not wall-clock time.
• Findings are review candidates and do not prove waste or authorize infrastructure changes.

Use with Tasks and automation

Public Tasks provide reusable saved inputs for distinct supported workflows. Start with the closest Example Task, review its visible fields and scope caveat, then save your own Task for schedules or repeated runs. Do not treat an Example Task as evidence that unsupported behavior exists.

• Analyze a synthetic AWS CUR fixture: Run the bounded deterministic preflight against a non-customer synthetic legacy CUR fixture.

Integration and API usage

Every saved Task can be started manually, through the Apify API, or from an Apify schedule. Run-completion webhooks can notify a downstream system after output is durable. Actor-to-Actor calls should consume the typed dataset/output links instead of scraping the Store page.

• Schedule a Task after a sanitized report export is available and route anomalies by dimensions and direction.
• Use resultSha256 and sourceFileSha256 to reconcile repeated processing.

No third-party integration is claimed unless it is named above and supported by the current product contract.

Data, privacy, and security

• The Actor downloads only the submitted report URL and does not send report data to models or other services.
• Output contains aggregates and hashes, never raw billing rows or AWS credentials; the source URL itself may still be sensitive.

Set Apify storage retention and access according to the sensitivity of your inputs and outputs. This documentation does not create legal, privacy, compliance, or security certification.

Support and known limitations

• The Actor does not connect to AWS or S3, forecast spend, recommend savings, or convert currencies.
• Public HTTPS delivery must be arranged by the caller and comply with the URL safety policy.

For support, use the Actor Issues page. Include the run ID, a minimal reproducible input with sensitive values removed, the failing record or error code, and what you expected. Do not post credentials, private source files, customer data, or full confidential payloads.