UNDER THE HOOD

How watchmy.cloud detects AWS cost spikes

A read-only IAM role. Hourly Cost Explorer data. Deterministic detection you can verify yourself. This page walks through exactly what happens between “Connect AWS” and the alert in your Slack.

Your AWS account

Read-only IAM role

Hourly fetch

Detection

Alert delivery

ACCESS

What access does watchmy.cloud get to my AWS account?

One IAM role, created by a CloudFormation stack you launch in your own account. Setup takes about two minutes and creates nothing else. The role can do exactly five things — all read-only, all billing-only.

IAM POLICY — ALLOWED ACTIONS

“Action”: [

ce:GetCostAndUsage // read cost data

ce:GetCostForecast // AWS’s own forecast

ce:GetDimensionValues // list services

ce:GetTags // cost allocation tags

cur:DescribeReportDefinitions // check report config

]

“Action”: [

ce:GetCostAndUsage // read cost data

ce:GetCostForecast // AWS’s own forecast

ce:GetDimensionValues // list services

ce:GetTags // cost allocation tags

cur:DescribeReportDefinitions // check report config

]

WHAT THE ROLE CANNOT DO

See, list, or touch any resource — no EC2, no S3, no logs, no application data.

Change anything, anywhere — there is no write permission in the policy.

Be assumed by anyone else — the trust policy pins it to one specific role in our AWS account, and every connection gets its own external ID (the standard defence against the confused-deputy attack).

Disconnecting is symmetric: delete the CloudFormation stack and access is gone that instant. There are no API keys to rotate or forget — we never hold credentials for your account, only short-lived sessions capped at 15 minutes.

DATA SOURCE

Where does the cost data come from?

From the same place you’d look yourself: AWS Cost Explorer.

On connect: we backfill 90 days of daily history, plus the most recent 14 days at hourly resolution. 14 days is AWS’s hard limit for hourly data — no tool can fetch more, whatever its marketing says.

From then on: we poll every hour, re-reading a 3-day overlap window so a missed run never leaves a gap in your data.

One honest caveat most tools skip: Cost Explorer is not real-time. AWS publishes hourly cost data with a delay — typically 12–18 hours. We show your current data lag right in the dashboard, so you always know how fresh the picture is.

AWS bills the hour

Cost Explorer publishes it (~12–18h later)

We fetch within the hour

Detection runs immediately

STORED DATA

What data does watchmy.cloud store?

Aggregated cost numbers. Nothing else. That is the whole schema — one row = account, hour, service, amount in USD.

WE STORE

Cost per service, per hour (“Amazon S3, 14:00–15:00 UTC, $1.83”)

Record type (usage, credit, tax, refund)

Your AWS account ID (the 12-digit number)

WE NEVER SEE

Resource names, ARNs, or tags on your infrastructure

Logs, metrics, or any application data

Anything readable or writable inside your account

DETECTION

How does the spike detection actually work?

Deterministically. Every alert traces back to arithmetic you can redo yourself in Cost Explorer — and the alert links you straight to the AWS console page to do it. Two self-tuning rules are on by default the moment you connect.

Hourly spike

One hour’s spend vs. your trailing 24-hour hourly average. Fires when an hour exceeds a multiple of that baseline (default 3×).

Daily anomaly

A completed day vs. your 7-day moving average. Fires above a percentage threshold (default +30%).

The baselines come from your own history, not a generic model — “normal” is whatever your account normally does. A sensitivity dial (1–5) rescales the thresholds from “near-frozen infra, flag a 5% move” to “chaotic dev account, only wake me at +100%”. On top of that you can add hard rules: a daily budget, a projected monthly cap, or a percent-increase over a custom time window.

THE ANTI-NOISE CONTRACT

A judged hour or day alerts once — the same spike never pages you twice.

Per-rule cooldowns and caps, so one flapping rule throttles itself without muting the others.

Every alert names the service and the hour, states the dollar delta, and deep-links to that service’s AWS console.

No ML black box, no “anomaly score: 0.87”. If we alert, you can check the math.

DELIVERY

What happens when a spike is found?

The alert enters a durable delivery queue — one entry per alert per channel — drained by a worker every minute. Transient failures (timeout, 5xx) are retried with backoff: 5 attempts over ~2.5 hours, and a database uniqueness constraint makes double-delivery impossible.

Alert raised

Outbox queue

Per-channel delivery with retries

Notification history log

Webhooks are signed with HMAC-SHA256 (X-Watchmycloud-Signature) over a timestamped payload, so you can verify authenticity and reject replays.

Jira and GitHub don’t get flooded: the first alert on a rule opens one issue; subsequent alerts arrive as comments on it until you close it.

SECURITY POSTURE

Security posture, in one card

We never store your password, and a dump of our database is worthless on its own — traffic is encrypted in transit, the database is encrypted at rest, and your notification-channel secrets carry a second KMS layer whose key never lives in the database and is bound to your account.

Read-only, billing-only IAM role — scoped trust policy, per-connection external ID

No stored AWS credentials — role assumption only, sessions capped at 15 minutes

No password to steal — your login is handled by Clerk; we never see, store, or hash it

Encrypted in transit — TLS from your browser through our edge to our servers; database traffic never leaves our private network

Encrypted at rest, twice over — the whole database and its backups are KMS-encrypted, and each customer’s channel secrets get a second KMS layer bound to your account

Outbound webhooks HMAC-signed and replay-protected — verify the signature scheme against the public API spec

Built to fail closed — a missing auth setting rejects every request; a missing encryption key refuses to store a secret rather than write plaintext

Public, versioned API spec — the customer-facing contract lives at /api/v1/openapi.json; read it yourself

FAQ

Questions engineers ask first

Why isn’t detection real-time?

Because the source isn’t. AWS publishes Cost Explorer data with a typical 12–18 hour delay, for every tool on the market. We poll hourly, so the moment AWS publishes an hour, detection runs on it. Your current data freshness is always visible in the dashboard.

What does this add to my AWS bill?

AWS charges $0.01 per Cost Explorer API request. Our hourly polling typically adds a few dollars per month, itemised on your bill as “AWS Cost Explorer”.

What if my account doesn’t have hourly granularity enabled?

We probe what your Cost Explorer supports when you connect. Without hourly granularity, monitoring runs on daily resolution and the day-based rules work as normal; enabling hourly in the AWS Billing console unlocks the hourly-spike rule — the app shows you exactly where to click.

Can I monitor several AWS accounts?

One AWS account per workspace today; multi-account support is on the roadmap. If you need it sooner, tell us — it moves the priority.

How do I disconnect?

Delete the CloudFormation stack in your AWS console — access is revoked the moment the role is gone. You can also remove the connection from the app.

Do you store my password?

No. Your login is handled by Clerk, a dedicated identity provider — we never see, store, or hash your password, and we keep only a user ID and your email. Sign in with Google or GitHub and there’s no password at all.

How watchmy.cloud detects AWS cost spikes