n8n Workflow: Detect AWS & GCP Cost Anomalies + Slack Alerts

Catch AWS & GCP cost spikes automatically—and explain them in plain English in Slack

This n8n workflow runs daily to detect AWS (and optional GCP) cost anomalies, enriches AWS findings with CloudTrail context, generates an OpenAI-based explanation, and posts actionable Slack alerts. It also logs anomalies and supports “approve/ignore for 7 days” decisions via one-time Google Sheets webhook links.

What this workflow does

• Runs daily (9 AM IST) and loads threshold/config values plus the existing anomaly log from Google Sheets.
• Pulls recent daily spend from AWS Cost Explorer by service and region, and normalizes results into a shared structure (optionally includes GCP costs from a BigQuery billing export).
• Detects cost anomalies using configurable thresholds for dollar, percent, and z-score, while skipping anomalies already recorded or suppressed by prior ignore decisions.
• Posts a one-message run summary to Slack listing the anomalies detected in that execution.
• Enriches each AWS anomaly (when available) by fetching recent AWS CloudTrail write events for the impacted region.
• Generates an AI explanation using OpenAI (gpt-4o-mini) to provide a probable root cause and suggested actions.
• Sends Slack alert(s) with key metrics, the AI explanation, and buttons to approve as expected or ignore for 7 days; then records the anomaly in Google Sheets.
• Handles button clicks securely via a webhook that validates a one-time token, updates anomaly status (Approved/Ignored with suppression date), returns a confirmation/error page, and posts the decision back to Slack.

Use cases

• SaaS teams monitoring daily AWS spend by service/region to catch sudden spikes early.
• Automation engineers building cost governance with AI-assisted triage and Slack approvals.
• Teams needing optional GCP anomaly detection alongside AWS within the same operational workflow.

Technical details

• n8n nodes/logic: if, code, slack, webhook, sticky note, http request.
• Integrations: AWS Cost Explorer, AWS CloudTrail, OpenAI (gpt-4o-mini), Google Sheets (via one-time webhook links), Slack, and optional GCP via BigQuery billing export.