Network-related spend in this account increased 34% month-over-month, concentrated in NAT Gateway data processing. Usage-type anomaly detection confirmed the movement was statistically significant (z-score 2.7). Source workload has not yet been identified: no VPC Flow Log evidence and no tag-based ownership are currently available. This report does not estimate addressable savings; remediation value depends on the traffic path and workload requirements once identified. Cost Health Score: 62/100 (C).
| # | Severity | Action | Impact | Effort |
|---|---|---|---|---|
| 1 | Critical | NAT Gateway data processing spike, network spend +34% month-over-month in account 012345678901 Enable VPC Flow Logs on the platform VPC. Reconcile the NAT Gateway ENI to subnet and workload, then re-run. | Not estimated | Medium |
| 2 | High | AWS-detected anomaly: NAT Gateway data processing, account 012345678901 Verify in the AWS Cost Anomaly Detection console; AnomalyId: AnomalyOverlap-0001; mark feedback if expected. | Not estimated | Medium |
| 3 | Medium | 14 idle EBS volumes identified Confirm the volumes are unattached and unneeded, then schedule for deletion or snapshot-and-delete. | $312/mo | Low |
Amazon EC2 is the largest cost driver at 42%. Spend is moderately diversified.
83%. Two items could not be checked: VPC Flow Log evidence and tag-based ownership resolution. See the Network Topology pack below.
| Category | Score | |
|---|---|---|
| network_spend_movement | +34.0% |
Cost Explorer service breakdown and usage-type anomaly detection point to NAT Gateway data processing rather than an across-the-board EC2 increase (z-score 2.7).
Recommended: Enable VPC Flow Logs on the platform VPC. Reconcile the NAT Gateway ENI to subnet and workload, then re-run.
| period | 2026-06-01 to 2026-06-30 |
|---|---|
| z_score | 2.7 |
| methods | Z:2.7σ, usage-type breakdown |
| could_not_check | VPC Flow Logs unavailable; tag-based ownership unresolved |
| overlap_with | cost-anomaly_aws_native-natgw012345 |
AWS Cost Anomaly Detection independently flagged the same NAT Gateway data-processing movement over the June 2026 period.
Recommended: Verify in the AWS Cost Anomaly Detection console; AnomalyId: AnomalyOverlap-0001; mark feedback if expected.
| source | aws_cost_anomaly_detection |
|---|---|
| aws_anomaly_id | AnomalyOverlap-0001 |
| period | 2026-06-01 to 2026-06-30 |
| overlap_with | cost-anomaly_statistical-natgw012345 |
| Category | Score | |
|---|---|---|
| idle_ebs_volumes | 14 volumes ($312/mo) |
| Category | Score | |
|---|---|---|
| flow_log_coverage | Not enabled |