BudgetAction

Source: src/AWS/Budgets/BudgetAction.ts

An AWS Budgets action — runs an IAM policy attachment, SCP attachment, or SSM stop-instances document when a budget threshold is crossed, either automatically or after manual approval.

The execution role must trust budgets.amazonaws.com and carry the permissions the action needs (the AWS managed policy AWSBudgetsActionsWithAWSResourceControlAccess covers all three kinds).

Creating a Budget Action

Apply a Deny-All Policy at 100% of the Budget

import * as AWS from "alchemy/AWS";

const budget = yield* AWS.Budgets.Budget("MonthlyCost", {
  budgetLimit: { amount: "100", unit: "USD" },
});

const action = yield* AWS.Budgets.BudgetAction("FreezeSpend", {
  budgetName: budget.budgetName,
  notificationType: "ACTUAL",
  actionType: "APPLY_IAM_POLICY",
  actionThreshold: {
    actionThresholdValue: 100,
    actionThresholdType: "PERCENTAGE",
  },
  definition: {
    iamActionDefinition: {
      policyArn: "arn:aws:iam::aws:policy/AWSDenyAll",
      roles: [devRole.roleName],
    },
  },
  executionRoleArn: executionRole.roleArn,
  approvalModel: "MANUAL",
  subscribers: [{ subscriptionType: "EMAIL", address: "team@example.com" }],
});

Stop EC2 Instances Automatically

const action = yield* AWS.Budgets.BudgetAction("StopDevInstances", {
  budgetName: budget.budgetName,
  notificationType: "ACTUAL",
  actionType: "RUN_SSM_DOCUMENTS",
  actionThreshold: {
    actionThresholdValue: 100,
    actionThresholdType: "PERCENTAGE",
  },
  definition: {
    ssmActionDefinition: {
      actionSubType: "STOP_EC2_INSTANCES",
      region: "us-east-1",
      instanceIds: [instance.instanceId],
    },
  },
  executionRoleArn: executionRole.roleArn,
  approvalModel: "AUTOMATIC",
  subscribers: [{ subscriptionType: "EMAIL", address: "team@example.com" }],
});