{"product_id":"n8n-workflow-detect-aws-gcp-cost-anomalies-slack-alerts","title":"n8n Workflow: Detect AWS \u0026 GCP Cost Anomalies + Slack Alerts","description":"\u003ch3\u003eCatch AWS \u0026amp; GCP cost spikes automatically—and explain them in plain English in Slack\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow runs daily to detect AWS (and optional GCP) cost anomalies, enriches AWS findings with CloudTrail context, generates an OpenAI-based explanation, and posts actionable Slack alerts. It also logs anomalies and supports “approve\/ignore for 7 days” decisions via one-time Google Sheets webhook links.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns daily (9 AM IST)\u003c\/strong\u003e and loads threshold\/config values plus the existing anomaly log from \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003ePulls recent daily spend\u003c\/strong\u003e from \u003cstrong\u003eAWS Cost Explorer\u003c\/strong\u003e by \u003cem\u003eservice and region\u003c\/em\u003e, and normalizes results into a shared structure (optionally includes \u003cstrong\u003eGCP\u003c\/strong\u003e costs from a \u003cstrong\u003eBigQuery billing export\u003c\/strong\u003e).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eDetects cost anomalies\u003c\/strong\u003e using configurable thresholds for \u003cstrong\u003edollar\u003c\/strong\u003e, \u003cstrong\u003epercent\u003c\/strong\u003e, and \u003cstrong\u003ez-score\u003c\/strong\u003e, while skipping anomalies already recorded or suppressed by prior \u003cstrong\u003eignore\u003c\/strong\u003e decisions.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003ePosts a one-message run summary\u003c\/strong\u003e to \u003cstrong\u003eSlack\u003c\/strong\u003e listing the anomalies detected in that execution.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eEnriches each AWS anomaly (when available)\u003c\/strong\u003e by fetching recent \u003cstrong\u003eAWS CloudTrail write events\u003c\/strong\u003e for the impacted region.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eGenerates an AI explanation\u003c\/strong\u003e using \u003cstrong\u003eOpenAI (gpt-4o-mini)\u003c\/strong\u003e to provide a probable root cause and suggested actions.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSends Slack alert(s)\u003c\/strong\u003e with key metrics, the AI explanation, and buttons to \u003cstrong\u003eapprove\u003c\/strong\u003e as expected or \u003cstrong\u003eignore\u003c\/strong\u003e for \u003cstrong\u003e7 days\u003c\/strong\u003e; then records the anomaly in \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eHandles button clicks securely\u003c\/strong\u003e via a webhook that validates a one-time token, updates anomaly status (Approved\/Ignored with suppression date), returns a confirmation\/error page, and posts the decision back to Slack.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eSaaS teams monitoring daily AWS spend by service\/region to catch sudden spikes early.\u003c\/li\u003e\n  \u003cli\u003eAutomation engineers building cost governance with AI-assisted triage and Slack approvals.\u003c\/li\u003e\n  \u003cli\u003eTeams needing optional GCP anomaly detection alongside AWS within the same operational workflow.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003en8n nodes\/logic:\u003c\/strong\u003e if, code, slack, webhook, sticky note, http request.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eIntegrations:\u003c\/strong\u003e AWS Cost Explorer, AWS CloudTrail, OpenAI (gpt-4o-mini), Google Sheets (via one-time webhook links), Slack, and optional GCP via BigQuery billing export.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":46206014292147,"sku":"N8N-20793","price":8.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/ephZGu5SdZM-HJARwErLw_87657MEC.png?v=1791795833","url":"https:\/\/buyflowscripts.com\/products\/n8n-workflow-detect-aws-gcp-cost-anomalies-slack-alerts","provider":"N8N Commerce","version":"1.0","type":"link"}