A company uses AWS CloudFormation to provision infrastructure in member accounts. Resources rarely change and are sized correctly. Occasionally developers create test resources and forget to delete them; most test resources remain for a few days. The company wants to automate discovery of unused resources and detect when AWS costs are increasing. The solution must identify resources that cause cost increases and automatically notify the operations team. Which approach meets these requirements?

The correct option uses AWS Cost Anomaly Detection with the "AWS services" monitor type. This service is specifically designed to identify unusual spending patterns and cost increases, which directly addresses the requirement to "identify resources that cause cost increases." Setting the monitor type to "AWS services" allows for granular detection of anomalies within specific AWS services, making it easier to pinpoint the source of unexpected costs from forgotten test resources. Configuring a subscription with a variance threshold ensures that the operations team is automatically notified when significant anomalies occur, fulfilling the notification requirement. The incorrect options involving CloudWatch alarms on total estimated charges are less effective because they react to overall spending exceeding a static or averaged threshold. They don't inherently identify which resources or services are causing the increase, making it harder to pinpoint forgotten test resources. While billing alerts are useful, they are a broader mechanism and don't offer the specific anomaly detection capabilities of AWS Cost Anomaly Detection. Using "Linked account" as a monitor type for Cost Anomaly Detection would monitor the entire account's spending, which is less precise than monitoring by "AWS services" for identifying specific resource-related cost increases.