# Triage Cloud Cost Spike

> Identify the primary drivers of a sudden cloud cost increase and implement safe mitigations.

- Skill: `bregman-arie/triage-cloud-cost-spike` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bregman-arie/triage-cloud-cost-spike`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bregman-arie/triage-cloud-cost-spike/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: bregman-arie (https://skillmd.com/u/bregman-arie)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/bregman-arie/triage-cloud-cost-spike

---


## When to use

Use when daily cost increases significantly versus baseline.

## Preconditions

- You can access billing/cost breakdown and recent change/deploy history.

## Procedure

1. Confirm the spike magnitude and when it started.
2. Break down by service, region, and top resources/tags.
3. Identify the change driver: deploy, scaling, traffic, misconfiguration, abuse.
4. Validate whether spend is expected (planned test) or unexpected.
5. Choose the safest mitigation: pause non-critical workloads, cap scaling, fix loops.

## Decision points

- Compute spike: check autoscaling, instance sizes, and runaway jobs.
- Network spike: check egress, NAT, CDN settings, cross-region traffic.
- Storage spike: check log retention, snapshots, object lifecycle policies.

## Verification

- Cost trend returns toward baseline within the next billing window.
- The change driver is addressed (scaling capped, job stopped, retention fixed).

## Rollback / undo

- Revert cost mitigation that impacts critical reliability.
- Restore paused workloads in a controlled manner.

## Escalation

- FinOps/cloud owners for billing anomalies or reserved commitment adjustments.
- Security team if spike may be caused by abuse/compromise.

## Examples

```text
Start with a service-by-service cost breakdown, then drill into the top 1-3 line items.
```