How BMW Group detects cost anomalies across 14,000 cloud accounts

BMW Group has turned cloud cost tracking into a daily anomaly hunt. Its in-house FinOps system, Cloud Efficiency Analytics, or CLEA, watches more than 14,000 cloud accounts across the company’s estate and sends email when spending breaks from its normal pattern.

The setup started as dashboards in Amazon Quick Sight. Useful, but passive. Someone had to open them. So BMW Group and Reply built a daily detection pipeline instead, feeding billing data from AWS Cost and Usage Reports and similar exports from the other cloud providers in the estate. That means roughly 3 billion rows and 500 columns a month get reduced to one question per account-service pair: is today’s spend behaving the way history says it should?

CLEA uses Prophet, Meta’s open source forecasting library, to build baselines from 365 days of daily history for each account-service combination. AWS Step Functions kicks off the run, a Lambda function finds the active accounts, and a Distributed Map fans the work out across as many as 500 concurrent Lambdas. The whole 14,000-account run finishes in about 20 minutes. Forecasting is treated as a pluggable layer, so BMW Group can swap the model later without rewriting the detection and alerting parts that owners rely on.

The interesting part is not the forecast. It is the filtering. A raw deviation only becomes an alert if it clears a stack of rules: services below $0.10 over the last 3 days are ignored, low-history services are dropped, the spend has to deviate by at least 40%, and the minimum dollar impact depends on the account’s spend cluster. Some services, including AWS Glue, Amazon Athena, and Amazon EC2, get a 60% threshold because normal workloads there are noisier than the standard rule allows. Volatile teams can be put on reduced sensitivity, where alerts need to clear three times the usual bar.

When an alert does fire, owners get more than a nudge. The email includes the account, owners, department hierarchy, affected service, date range, expected versus actual spend, and the impact. They can then open a Quick Sight dashboard and drill into the spike by operation and usage type, which BMW says usually gets them to the root cause fast. The entire serverless setup costs around $50 per month in compute. That is the kind of number that makes old-school monitoring budgets look a bit embarrassed.