<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Cost Anomaly Detection — API Reference

## AWS Cost Explorer API

```bash
aws ce get-anomalies --date-interval '{"StartDate":"DATE","EndDate":"DATE"}'
aws ce get-anomaly-monitors --output json
aws ce create-anomaly-monitor --anomaly-monitor SPEC
aws ce get-cost-and-usage --time-period Start=DATE,End=DATE \
  --granularity DAILY --metrics BlendedCost --group-by Type=DIMENSION,Key=SERVICE
```

## Cryptomining Indicators

| Signal | Service | Description |
|--------|---------|-------------|
| GPU instances | EC2 | p3/p4/g4dn/g5 types |
| High compute | EC2/ECS | Sudden CPU cost spike |
| New regions | Any | Resources in unused regions |
| Lambda spikes | Lambda | Concurrent execution surge |

## GCP Billing API

```bash
gcloud billing budgets list --billing-account=ACCOUNT
gcloud billing budgets create --billing-account=ACCOUNT --display-name=NAME
```
