> For the complete documentation index, see [llms.txt](https://docs.itoc360.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.itoc360.com/integrations/inbound-integrations/cloud-monitoring/aws-budget-integration.md). # AWS Budget Integration ### Overview AWS Budgets lets you set spending thresholds on your AWS account and get notified when your actual or forecasted costs cross those limits. The alerts don't come directly as webhooks — they travel through Amazon SNS first, which wraps everything in an envelope and delivers it to your endpoint as an HTTP POST. The Message field inside that envelope is a plain-text notification containing the real alert details: budget name, budgeted amount, alert type, threshold, and the current amount. One thing worth knowing upfront: AWS Budgets only fires when a threshold is crossed. There's no recovery notification when spending drops back down — so alerts created by this integration will need to be closed manually in the platform after you've reviewed them. *** ### Integration Flow ``` AWS Budgets │ │ Threshold exceeded ▼ Amazon SNS Topic │ │ HTTPS subscription delivers payload ▼ Platform Webhook Endpoint │ │ SNS envelope parsed → Message text read │ Fingerprint: md5(BudgetName::AccountId) ▼ Alert Created → Priority mapped → On-Call Team Notified ``` *** ### Provider Configuration & Mapping AWS Budgets uses the same SNS envelope pattern as Amazon CloudWatch — The alert details live inside the plain-text Message field, not at the top level. The platform reads the Alert Type line from the message to determine priority. **Priority Mapping Table:** | NotificationType (inside Message) | Alert type(Inside Message) | Description | | --------------------------------- | -------------------------- | --------------------------------------------------- | | `ACTUAL` | HIGH | Real spend has crossed the threshold | | `FORECASTED` | MEDIUM | Projected spend is on track to exceed the threshold | > Alerts for the same budget and alert type are grouped into a single alert, so repeated notifications appear on its timeline instead of opening new alerts. ### Alert Payload Example #### Raised (Actual Spend — OVER\_BUDGET) This is what arrives at your webhook when actual spending crosses the threshold. The Alert Type inside Message is ACTUAL, which maps to HIGH priority. ```json { "Type": "Notification", "MessageId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "TopicArn": "arn:aws:sns:us-east-1:123456789012:oncall-budget-alerts", "Subject": "AWS Budgets: monthly-cost has exceeded your alert threshold", "Message": "AWS Budget Notification October 06, 2026\nAWS Account 123456789012\n\nDear AWS Customer,\n\nYou requested that we alert you when the ACTUAL Cost associated with your monthly-cost budget is greater than $800.00 for the current month. The ACTUAL Cost associated with this budget is $912.40. You can find additional details below and by accessing the AWS Budgets dashboard [1].\n\nBudget Name: monthly-cost\nBudget Type: Cost\nBudgeted Amount: $1,000.00\nAlert Type: ACTUAL\nAlert Threshold: > $800.00\nACTUAL Amount: $912.40\n\n[1] https://console.aws.amazon.com/costmanagement/home#/budgets\n", "Timestamp": "2026-10-06T12:15:22.413Z", "SignatureVersion": "1", "Signature": "EXAMPLE", "SigningCertURL": "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-EXAMPLE.pem", "UnsubscribeURL": "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=EXAMPLE" } ``` > Resulting alert: Priority → HIGH, Type → ALERT. The alert title shows the subject, followed by "ACTUAL: $912.40 of $1,000.00 budget". *** ### Installation & Configuration #### Step 1: Paste the ITOC360 URL Head to **Sources → Add Source**, pick **AWS Budgets** as the provider, give it a name like `AWS Budget Alerts – Production`, and hit Save. Copy the URL with your source token: `https://api.itoc360.app/functions/v1/events?token=` #### Step 2: Create an SNS Topic 1. Log in to the **AWS Management Console** and navigate to **Simple Notification Service (SNS) → Topics**. 2. Click **Create topic**, select type **Standard** (not FIFO), and give it a name like `oncall-budget-alerts`. 3. Leave everything else as default and click **Create topic**. 4. Note the **Topic ARN** on the detail page — you'll need this when setting up the budget alert.
5. **Allow AWS Budgets to publish to the topic.** On the topic detail page, click **Edit**, expand **Access policy**, and add this statement to the `Statement` array: ```json { "Sid": "AllowAWSBudgetsPublish", "Effect": "Allow", "Principal": { "Service": "budgets.amazonaws.com" }, "Action": "SNS:Publish", "Resource": "", "Condition": { "StringEquals": { "aws:SourceAccount": "" } } } ``` Click **Save changes**. Without this, AWS Budgets can't deliver alerts to the topic. #### Step 3: Subscribe the Webhook to the SNS Topic 1. On the topic detail page, go to the **Subscriptions** tab and click **Create subscription**. 2. Protocol: **HTTPS** 3. Endpoint: Paste the URL. 4. **Enable raw message delivery:** Leave this **unchecked**. The full SNS envelope needs to reach the platform intact. 5. Click **Create subscription**.
The subscription will show **Pending confirmation** for a few seconds. ITOC360 confirms it automatically; refresh the page and the status changes to **Confirmed**.
> **Heads up:** The confirmation URL expires in about 3 minutes. If you see `Invalid token`, go to the Subscriptions tab, delete the pending one, and create a fresh subscription. *** #### Step 4: Create a Budget and Link It to the SNS Topic 1. Navigate to **AWS Billing → Budgets → Create budget**.
2. Select **Customize (advanced)** — the simplified template doesn't expose SNS alert options.
3. Set your **Budget name**, **Period** (Monthly), and **Budget amount**.
1. In the **Alerts** section: * Threshold: your desired percentage (e.g., `80%`) * Trigger: `Actual` or `Forecasted` * SNS alert: paste the Topic ARN from Step 2. If you see "Your SNS topic is not in a valid format", re-enter the ARN without leading or trailing spaces.
2. Click **Next → Next → Create budget**.
> AWS Budgets evaluates spending a few times a day, so the first notification can take several hours. Each threshold notifies once per budget period. #### Step 5: Test the Integration Real budget alerts only fire when a threshold is actually crossed, which can take days. Instead, use SNS Publish to send a test payload right now. 1. Go to **SNS → Topics → `oncall-budget-alerts`** and click **Publish message**. 2. **Subject:** `AWS Budgets Notification` 3. **Message body:** ```json AWS Budget Notification AWS Account 123456789012 Budget Name: test-oncall-budget Budget Type: Cost Budgeted Amount: $1.00 Alert Type: ACTUAL Alert Threshold: > $0.80 ACTUAL Amount: $0.85 ``` 4. Click **Publish message** and check your webhook endpoint. *** ### Verification Checklist * The SNS subscription shows **Confirmed**. * An alert was created in ITOC360 with status **ALERT**. * The alert title shows the subject and a line like "ACTUAL: $0.85 of $1.00 budget". * Priority mapped correctly: ACTUAL → HIGH, FORECASTED → MEDIUM. *** ### Troubleshooting | Issue | Possible Cause | Resolution | | ------------------------------------------- | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Subscription stuck on `PendingConfirmation` | Confirmation URL expired or endpoint unreachable | Check that the endpoint URL includes your source token, then select the subscription and click **Request confirmation**. | | No alerts received after budget creation | Threshold not yet crossed | Use SNS Publish with a test message body to validate without waiting for a real breach.Also check that the topic access policy allows `budgets.amazonaws.com` (Step 2). | | `Invalid payload` error | Raw message delivery is enabled | Disable **Enable raw message delivery** on the SNS subscription. The full SNS envelope is required. | | Priority always maps to MEDIUM | `NotificationType` not parsed correctly | Make sure the alert was sent by AWS Budgets or that your test message contains an `Alert Type: ACTUAL` line. | | Alerts not closing automatically | AWS Budgets does not send recovery events | This is an AWS limitation. Close budget alerts manually in the platform after investigation. | | Duplicate alerts for the same budget | Multiple SNS subscriptions for the same endpoint | Remove duplicate subscriptions from the SNS topic. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.itoc360.com/integrations/inbound-integrations/cloud-monitoring/aws-budget-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.