Cost-Anomaly Evidence Bundle Builder

Builds a durable, queryable record for every cost anomaly. Rather than reasoning about a cause, this pipeline reliably gathers the three inputs an investigation needs — the cost breakdown, the deploy and MR log, and the relevant infra metrics for the window — normalizes them, and writes one timestamped evidence row back to Snowflake. Later anomalies and audits can query a clean history instead of re-pulling raw APIs.

Use this as the data-collection backbone under your cost investigations, or when finance needs an auditable trail of what was happening during each spike. It is deterministic by design, so the same anomaly always produces the same bundle.

1. 1A schedule scans Snowflake for any service exceeding its cost baseline.
2. 2For each flagged service, the pipeline pulls infra metrics for the anomaly window from Datadog.
3. 3It fetches deploys and merged MRs in that window from GitLab.
4. 4It normalizes all three sources into a single structured bundle.
5. 5It writes the timestamped evidence record back to a Snowflake table for audit and downstream agents.