AWS Budget Integration

Overview

AWS Budgets lets you set spending thresholds on your AWS account and get notified when your actual or forecasted costs cross those limits. The alerts don't come directly as webhooks — they travel through Amazon SNS first, which wraps everything in an envelope and delivers it to your endpoint as an HTTP POST.

The Message field inside that envelope is a plain-text notification containing the real alert details: budget name, budgeted amount, alert type, threshold, and the current amount.

One thing worth knowing upfront: AWS Budgets only fires when a threshold is crossed. There's no recovery notification when spending drops back down — so alerts created by this integration will need to be closed manually in the platform after you've reviewed them.

---

Integration Flow

AWS Budgets
│
│ Threshold exceeded
▼
Amazon SNS Topic
│
│ HTTPS subscription delivers payload
▼
Platform Webhook Endpoint
│
│ SNS envelope parsed → Message text read
│ Fingerprint: md5(BudgetName::AccountId)
▼
Alert Created → Priority mapped → On-Call Team Notified

---

Provider Configuration & Mapping

AWS Budgets uses the same SNS envelope pattern as Amazon CloudWatch — The alert details live inside the plain-text Message field, not at the top level. The platform reads the Alert Type line from the message to determine priority.

Priority Mapping Table:

NotificationType (inside Message)	Alert type(Inside Message)	Description
ACTUAL	HIGH	Real spend has crossed the threshold
FORECASTED	MEDIUM	Projected spend is on track to exceed the threshold

Alerts for the same budget and alert type are grouped into a single alert, so repeated notifications appear on its timeline instead of opening new alerts.

Alert Payload Example

Raised (Actual Spend — OVER_BUDGET)

This is what arrives at your webhook when actual spending crosses the threshold. The Alert Type inside Message is ACTUAL, which maps to HIGH priority.

{
  "Type": "Notification",
  "MessageId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
  "TopicArn": "arn:aws:sns:us-east-1:123456789012:oncall-budget-alerts",
  "Subject": "AWS Budgets: monthly-cost has exceeded your alert threshold",
  "Message": "AWS Budget Notification October 06, 2026\nAWS Account 123456789012\n\nDear AWS Customer,\n\nYou requested that we alert you when the ACTUAL Cost associated with your monthly-cost budget is greater than $800.00 for the current month. The ACTUAL Cost associated with this budget is $912.40. You can find additional details below and by accessing the AWS Budgets dashboard [1].\n\nBudget Name: monthly-cost\nBudget Type: Cost\nBudgeted Amount: $1,000.00\nAlert Type: ACTUAL\nAlert Threshold: > $800.00\nACTUAL Amount: $912.40\n\n[1] https://console.aws.amazon.com/costmanagement/home#/budgets\n",
  "Timestamp": "2026-10-06T12:15:22.413Z",
  "SignatureVersion": "1",
  "Signature": "EXAMPLE",
  "SigningCertURL": "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-EXAMPLE.pem",
  "UnsubscribeURL": "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=EXAMPLE"
}

Resulting alert: Priority → HIGH, Type → ALERT. The alert title shows the subject, followed by "ACTUAL: $912.40 of $1,000.00 budget".

---

Installation & Configuration

Step 1: Paste the ITOC360 URL

Head to Sources → Add Source, pick AWS Budgets as the provider, give it a name like AWS Budget Alerts – Production, and hit Save. Copy the URL with your source token: https://api.itoc360.app/functions/v1/events?token=<YOUR_SOURCE_TOKEN>

Step 2: Create an SNS Topic

1. Log in to the AWS Management Console and navigate to Simple Notification Service (SNS) → Topics.

2. Click Create topic, select type Standard (not FIFO), and give it a name like oncall-budget-alerts.

3. Leave everything else as default and click Create topic.

4. Note the Topic ARN on the detail page — you'll need this when setting up the budget alert.

1. Allow AWS Budgets to publish to the topic. On the topic detail page, click Edit, expand Access policy, and add this statement to the Statement array:

{
  "Sid": "AllowAWSBudgetsPublish",
  "Effect": "Allow",
  "Principal": { "Service": "budgets.amazonaws.com" },
  "Action": "SNS:Publish",
  "Resource": "<YOUR_TOPIC_ARN>",
  "Condition": { "StringEquals": { "aws:SourceAccount": "<YOUR_ACCOUNT_ID>" } }
}

Click Save changes. Without this, AWS Budgets can't deliver alerts to the topic.

Step 3: Subscribe the Webhook to the SNS Topic

1. On the topic detail page, go to the Subscriptions tab and click Create subscription.

2. Protocol: HTTPS

3. Endpoint: Paste the https://api.itoc360.app/functions/v1/events URL.

4. Enable raw message delivery: Leave this unchecked. The full SNS envelope needs to reach the platform intact.

5. Click Create subscription.

The subscription will show Pending confirmation for a few seconds. ITOC360 confirms it automatically; refresh the page and the status changes to Confirmed.

Heads up: The confirmation URL expires in about 3 minutes. If you see Invalid token, go to the Subscriptions tab, delete the pending one, and create a fresh subscription.

---

Step 4: Create a Budget and Link It to the SNS Topic

1. Navigate to AWS Billing → Budgets → Create budget.

   
2. Select Customize (advanced) — the simplified template doesn't expose SNS alert options.

   
3. Set your Budget name, Period (Monthly), and Budget amount.

1. In the Alerts section:

   • Threshold: your desired percentage (e.g., 80%)

   • Trigger: Actual or Forecasted

   • SNS alert: paste the Topic ARN from Step 2. If you see "Your SNS topic is not in a valid format", re-enter the ARN without leading or trailing spaces.

     

     
2. Click Next → Next → Create budget.

AWS Budgets evaluates spending a few times a day, so the first notification can take several hours. Each threshold notifies once per budget period.

Step 5: Test the Integration

Real budget alerts only fire when a threshold is actually crossed, which can take days. Instead, use SNS Publish to send a test payload right now.

1. Go to SNS → Topics → oncall-budget-alerts and click Publish message.

2. Subject: AWS Budgets Notification

3. Message body:

AWS Budget Notification
AWS Account 123456789012

Budget Name: test-oncall-budget
Budget Type: Cost
Budgeted Amount: $1.00
Alert Type: ACTUAL
Alert Threshold: > $0.80
ACTUAL Amount: $0.85

1. Click Publish message and check your webhook endpoint.

---

Verification Checklist

• The SNS subscription shows Confirmed.

• An alert was created in ITOC360 with status ALERT.

• The alert title shows the subject and a line like "ACTUAL: $0.85 of $1.00 budget".

• Priority mapped correctly: ACTUAL → HIGH, FORECASTED → MEDIUM.

---

Troubleshooting

Issue	Possible Cause	Resolution
Subscription stuck on PendingConfirmation	Confirmation URL expired or endpoint unreachable	Check that the endpoint URL includes your source token, then select the subscription and click Request confirmation.
No alerts received after budget creation	Threshold not yet crossed	Use SNS Publish with a test message body to validate without waiting for a real breach.Also check that the topic access policy allows budgets.amazonaws.com (Step 2).
Invalid payload error	Raw message delivery is enabled	Disable Enable raw message delivery on the SNS subscription. The full SNS envelope is required.
Priority always maps to MEDIUM	NotificationType not parsed correctly	Make sure the alert was sent by AWS Budgets or that your test message contains an Alert Type: ACTUAL line.
Alerts not closing automatically	AWS Budgets does not send recovery events	This is an AWS limitation. Close budget alerts manually in the platform after investigation.
Duplicate alerts for the same budget	Multiple SNS subscriptions for the same endpoint	Remove duplicate subscriptions from the SNS topic.