AWS CUR Anomaly Detector

Analyze one already-exported AWS Cost and Usage Report without AWS credentials. The Actor accepts a public HTTPS CSV or single gzip-compressed CSV, maps exact legacy CUR or Data Exports CUR 2.0 headers, and ranks daily unblended-cost changes using deterministic decimal arithmetic.

It does not connect to AWS or S3, monitor continuously, forecast spend, recommend savings, convert currencies, or send report rows to a model. Findings are review candidates, not proof of waste or authorization to change infrastructure.

Input

reportUrl is required. The remaining fields default to a 7-day baseline, latest represented date, service grouping, USD 25 absolute threshold, 50 percent threshold, both directions, and 100 findings. Add region, usageType, operation, or linkedAccount to groupBy only when the exact corresponding column exists. Non-USD reports require minAbsoluteChange in the report currency.

The file is limited to 100 MiB downloaded, 500 MiB expanded, 5,000,000 rows, 500,000 groups, and one currency. ZIP, Parquet, multi-file reports, live AWS access, and fuzzy header matching are rejected.

Output and billing

The default dataset contains one summary, zero or more ranked anomaly records, and one diagnostics record. OUTPUT.json contains the identical ordered records and SUMMARY.json contains the summary. Output contains aggregates and hashes, never raw billing rows or account credentials.

Under pay-per-event pricing, one cur-report-analyzed event is charged only after all three durable output surfaces succeed. Validation, download, format, baseline, bound, runtime, and zero-capacity failures are non-billable. A durable semantic ledger prevents repeat charging after retries or interrupted charge acknowledgement.

Local verification

npm install
npm test
npm run build
npm run schema:check
python ../../tools/store-qa-gate/store_qa_gate.py --schema-only .

Tests use only synthetic dates, services, regions, and costs. The Store prefill uses the stable public synthetic fixture; no Actor cloud run or paid action is part of local QA.