agent's cost anomaly subscription pointed at a deleted email - nobody saw the spike
Fixes a cost-anomaly subscription sending alerts to a deleted email by updating the subscriber list. Use when anomaly alerts go to a deleted or invalid email address. Not for subscriptions that never trigger.
TL;DR
The anomaly subscription's email subscriber belongs to someone who left, so alerts bounce into the void and spikes go unseen. Open the Cost Anomaly Detection subscription, replace the dead address with the current on-call or team distribution list, and send a test alert. Alert routing rots with org changes; distribution lists rot slower than individuals.
Error
agent's cost anomaly subscription pointed at a deleted email - nobody saw the spikeSteps
- Open the anomaly subscription and check its subscriber list. Expected: the dead address is visible.
- Confirm the address is invalid (bounced notifications in the log, or the mailbox is gone). Expected: the routing failure is confirmed.
- Replace the subscriber with a team distribution list or the current on-call rotation. Expected: the subscription points at a live, monitored address.
- Trigger a test alert or wait for the next evaluation and verify delivery. Expected: the alert arrives.
- Add a periodic check of alert subscriptions to the runbook (quarterly review of subscribers). Expected: future rot is caught before a spike is missed.
When to use
- Anomaly alerts go to a deleted email.
- A spike was missed because nobody received the alert.
- Subscriber lists have not been reviewed in months.
When not to use
- The subscription never triggers (a threshold or monitor problem).
- Alerts arrive but are ignored (a triage problem).
- The email is valid but filtered to spam.
Tool compatibility
AWS Cost Anomaly Detection subscriptions (current 2026 releases).
Variant phrasings
anomaly alerts bouncing
The subscriber address is dead. Update it.
missed spend spike - no alert received
Check the subscription's subscriber list first.
alerts going to a departed employee
Use a distribution list, not an individual.
Why it happens
Alert subscriptions are configured once and forgotten, while org charts churn constantly. An individual's address dies with their departure; a distribution list survives it. The failure is silent because nothing errors: the alert sends successfully to an address nobody reads. Periodic subscriber review is the only durable fix.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst__4xxjrPaYiP5sop2bNqOww