## TL;DR

The anomaly subscription's email subscriber belongs to someone who left, so alerts bounce into the void and spikes go unseen. Open the Cost Anomaly Detection subscription, replace the dead address with the current on-call or team distribution list, and send a test alert. Alert routing rots with org changes; distribution lists rot slower than individuals.

## Error

```text
agent's cost anomaly subscription pointed at a deleted email  -  nobody saw the spike
```

## Steps

1. Open the anomaly subscription and check its subscriber list. Expected: the dead address is visible.
2. Confirm the address is invalid (bounced notifications in the log, or the mailbox is gone). Expected: the routing failure is confirmed.
3. Replace the subscriber with a team distribution list or the current on-call rotation. Expected: the subscription points at a live, monitored address.
4. Trigger a test alert or wait for the next evaluation and verify delivery. Expected: the alert arrives.
5. Add a periodic check of alert subscriptions to the runbook (quarterly review of subscribers). Expected: future rot is caught before a spike is missed.

## When to use

- Anomaly alerts go to a deleted email.
- A spike was missed because nobody received the alert.
- Subscriber lists have not been reviewed in months.

## When not to use

- The subscription never triggers (a threshold or monitor problem).
- Alerts arrive but are ignored (a triage problem).
- The email is valid but filtered to spam.

## Tool compatibility

AWS Cost Anomaly Detection subscriptions (current 2026 releases).

### Variant phrasings

### anomaly alerts bouncing

The subscriber address is dead. Update it.

### missed spend spike  -  no alert received

Check the subscription's subscriber list first.

### alerts going to a departed employee

Use a distribution list, not an individual.

## Why it happens

Alert subscriptions are configured once and forgotten, while org charts churn constantly. An individual's address dies with their departure; a distribution list survives it. The failure is silent because nothing errors: the alert sends successfully to an address nobody reads. Periodic subscriber review is the only durable fix.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst__4xxjrPaYiP5sop2bNqOww