Certain aspects of the present disclosure provide techniques for detecting and preventing web service usage anomalies. Embodiments include forecasting, based on a model, a number of resource instances for one or more web services for a time period. Embodiments include receiving, after the time period has elapsed, a detected number of resource instances for the one or more web services for the time period. Embodiments include comparing the detected number of resource instances to the forecasted number of resource instances. Embodiments include determining, based on the comparing, a usage anomaly. Embodiments include determining an impact of the usage anomaly. Embodiments include outputting an indication of the usage anomaly and the impact of the usage anomaly.