## TL;DR
A 100% threshold on forecasted spend will always fire early in the month, because the forecast projects the full month. Put the 100% alert on actual spend, and use forecasted spend only for an early-warning budget at a lower threshold like 80%.

```text
agent set the budget alert on forecasted spend, the 100% alert fired on the 3rd of the month
```

## Use this when
- A budget alert fires within the first days of the month while spend looks normal.
- The budget's cost type is set to forecasted rather than actual.
- The team has started ignoring the alert because it "always fires."

## Not for this skill when
- The alert tracks actual spend and still fires early. That is a real overspend or a bad baseline.
- You want a forecast warning on purpose. That needs a separate budget with a lower threshold.

## Steps
1. Open the budget and check the cost filter: forecasted vs actual. Verify: it says forecasted.
2. Change the 100% budget to actual spend: `aws budgets update-budget` with `CostTypes` set to actual, or edit in the console.
3. Create a second budget for the forecast: same amount, threshold at 80% of forecasted spend, alert labeled clearly as "early warning."
4. Point the two alerts at different severities: actual-100% pages, forecast-80% sends a low-priority note.
5. Note the forecast lag: the forecast needs a few days of data each month to calibrate, so expect a noisy first week.

## Variant phrasings
### aws budget forecast alert fired on day 3
Symptom-level search.
### forecasted vs actual spend budget alert
The configuration question behind it.
### budget alert always fires at start of month
How teams describe it after muting it twice.

Compatibility: AWS Budgets; forecast data requires enough historical spend for the model to train on.

## Why it happens
Forecasted spend for the month is projected from partial data and then compared against the full-month budget. On day 3 the model often extrapolates noise, so "100% of forecasted" trips while actual spend sits at 10%. Agents pick "forecasted" because it sounds smarter; it just fires sooner.

## Edge cases / pitfalls
- Do not delete the forecast budget. An 80% early warning is genuinely useful when it is labeled as one.
- Forecast accuracy is worst for spiky workloads. If the early-warning budget is noisy, raise it to 90% rather than deleting it.
- Actual-spend budgets have evaluation lag too. A 100% actual alert still lands hours after the breach, not instantly.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Dc3Tc1KxQabSflvXwwm67g