aws-cost-optimize

AWS Cost Optimize

This workflow analyzes Infrastructure-as-Code (IaC) files and AWS resources to generate cost optimization recommendations. It creates individual GitHub issues for each optimization opportunity plus one EPIC issue to coordinate implementation, enabling efficient tracking and execution of cost savings initiatives.

Prerequisites

• AWS CLI configured and authenticated (aws sts get-caller-identity succeeds)
• GitHub MCP server configured and authenticated
• Target GitHub repository identified
• AWS resources deployed (IaC files optional but helpful)

Required IAM Permissions

This skill requires the following IAM actions. Apply the policy below to a dedicated IAM role or user before invocation. No write permissions to AWS resources are required.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CostOptimizeReadOnly",
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "ec2:DescribeInstances",
        "ec2:DescribeNatGateways",
        "ec2:DescribeVolumes",
        "ec2:DescribeAddresses",
        "rds:DescribeDBInstances",
        "lambda:ListFunctions",
        "ecs:ListClusters",
        "ecs:ListServices",
        "ecs:DescribeClusters",
        "ecs:DescribeServices",
        "s3:ListAllMyBuckets",
        "s3:GetBucketLifecycleConfiguration",
        "elasticache:DescribeCacheClusters",
        "elasticloadbalancing:DescribeLoadBalancers",
        "cloudwatch:GetMetricStatistics",
        "ce:GetCostAndUsage"
      ],
      "Resource": "*"
    }
  ]
}

Workflow Steps

Step 1: Load Cost Optimization Heuristics

Action: Apply built-in cost optimization heuristics (no live fetch required) Process:

The following heuristics are embedded directly in this skill to avoid supply-chain risk from floating external URLs. They reflect AWS Well-Architected Cost Optimization pillar guidance as of the skill's publication date.

Core heuristics applied in Step 4:

• Right-size compute: instances with <20% average CPU over 7 days are candidates for downsizing
• Migrate On-Demand EC2/Fargate to Savings Plans where usage is predictable (>30-day horizon)
• Graviton/ARM migration reduces EC2 and Lambda costs ~20–40% for compatible runtimes
• S3 lifecycle: Standard → Standard-IA at 30 days → Glacier Instant Retrieval at 90 days
• gp2 → gp3 EBS: same baseline performance, ~20% lower cost
• NAT Gateway consolidation: non-production environments rarely need per-AZ NAT Gateways
• VPC endpoints for S3 and DynamoDB eliminate NAT Gateway data processing charges for those services
• RDS: Single-AZ is appropriate for non-production; Aurora Serverless v2 suits variable-load workloads
• DynamoDB: On-Demand mode is cost-effective for unpredictable or spiky traffic patterns
• Unattached EBS volumes and unused Elastic IPs accrue cost with zero value; delete them

Step 2: Discover AWS Infrastructure

Action: Dynamically discover and analyze AWS resources and configurations Tools: AWS CLI + Local file system access Process:

1. Account & Region Discovery:

   • Execute aws sts get-caller-identity to confirm account
   • Execute aws configure get region to determine default region

2. Resource Discovery (per region):

   • EC2 instances: aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,Tags]'
   • RDS instances: aws rds describe-db-instances --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceClass,Engine,MultiAZ]'
   • Lambda functions: aws lambda list-functions --query 'Functions[].[FunctionName,Runtime,MemorySize,Architectures]'
   • ECS clusters/services: aws ecs list-clusters then aws ecs describe-services
   • S3 buckets: aws s3api list-buckets --query 'Buckets[].Name'
   • ElastiCache clusters: aws elasticache describe-cache-clusters
   • NAT Gateways: aws ec2 describe-nat-gateways
   • Load Balancers: aws elbv2 describe-load-balancers

3. IaC Detection:

   • Scan for IaC files using specific patterns within the repository root. The filesystem tool's excluded-patterns (defined in the skill manifest) prevent reading sensitive files regardless of the patterns used here.
   • Patterns: **/*.tf (Terraform), **/*.yaml, **/*.yml (CloudFormation/SAM), **/*.json (CloudFormation), **/cdk.json, lib/**/*.ts (CDK), **/serverless.yml, **/serverless.yaml (Serverless Framework)
   • Parse resource definitions to understand intended configurations
   • Do NOT use application code files — only IaC files as the source of truth
   • If no IaC files found: proceed with the analysis based on discovered live AWS resources and note in the final report that recommendations could not be mapped to source code files

Step 3: Collect Usage Metrics & Validate Current Costs

Action: Gather utilization data and verify actual resource costs Tools: AWS CLI (CloudWatch, Cost Explorer) Process:

1. CloudWatch Metrics (last 7 days):

   Security Note: Resource identifiers retrieved from AWS APIs must be validated against expected formats before use in shell commands. Never interpolate raw API output directly into a command string. Always assign to a named variable, validate the format, and use double-quoted expansion.

   # EC2 CPU utilization — safe interpolation via validated shell variable
   INSTANCE_ID=$(aws ec2 describe-instances \
     --query 'Reservations[0].Instances[0].InstanceId' \
     --output text | head -1)
   # Validate format before use (EC2 instance IDs: i- followed by 8-17 hex chars)
   if [[ ! "${INSTANCE_ID}" =~ ^i-[0-9a-f]{8,17}$ ]]; then
     echo "SKIP: unexpected instance ID format: ${INSTANCE_ID}" >&2
   else
     aws cloudwatch get-metric-statistics \
       --namespace AWS/EC2 --metric-name CPUUtilization \
       --dimensions "Name=InstanceId,Value=${INSTANCE_ID}" \
       --start-time "$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
       --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
       --period 3600 --statistics Average
   fi
   
   # Lambda duration — safe interpolation via validated shell variable
   FUNCTION_NAME=$(aws lambda list-functions \
     --query 'Functions[0].FunctionName' \
     --output text | head -1)
   # Validate format before use (Lambda function names: alphanumeric, hyphens, underscores, 1-64 chars)
   if [[ ! "${FUNCTION_NAME}" =~ ^[a-zA-Z0-9_-]{1,64}$ ]]; then
     echo "SKIP: unexpected function name format: ${FUNCTION_NAME}" >&2
   else
     aws cloudwatch get-metric-statistics \
       --namespace AWS/Lambda --metric-name Duration \
       --dimensions "Name=FunctionName,Value=${FUNCTION_NAME}" \
       --start-time "$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
       --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
       --period 86400 --statistics Average,Maximum
   fi

   When iterating over multiple resources (the typical case), loop over a jq-filtered array and apply the same per-element validation before each invocation. The head -1 prevents newline injection from multi-line API output.

2. AWS Cost Explorer:

   aws ce get-cost-and-usage \
     --time-period Start=$(date -u -d '30 days ago' +%Y-%m-%d),End=$(date -u +%Y-%m-%d) \
     --granularity MONTHLY --metrics BlendedCost \
     --group-by Type=DIMENSION,Key=SERVICE

3. Calculate Baseline Metrics: CPU/Memory averages, Lambda invocation rates, data transfer patterns, and a realistic current monthly total.

Step 4: Generate Cost Optimization Recommendations

Action: Analyze resources to identify optimization opportunities Process:

1. Apply Optimization Patterns:

   Compute:

   • EC2: Right-size based on CPU/memory (<20% average → downsize), convert On-Demand to Savings Plans, migrate to Graviton/ARM (up to 40% cheaper)
   • Lambda: Reduce memory for idle functions, switch to arm64 (20% cheaper)
   • ECS/EKS: Use Fargate Spot for dev/batch workloads

   Database:

   • RDS: Right-size instance class, convert single-AZ for dev, use Aurora Serverless v2 for variable load
   • DynamoDB: Switch Provisioned → On-Demand for unpredictable traffic
   • ElastiCache: Right-size node type based on memory utilization

   Storage:

   • S3: Lifecycle policies (Standard → Standard-IA after 30d → Glacier after 90d), enable Intelligent-Tiering
   • EBS: Delete unattached volumes, convert gp2 → gp3 (same performance, 20% cheaper)

   Network:

   • Consolidate NAT Gateways for non-production environments
   • Use VPC endpoints for S3/DynamoDB to avoid NAT Gateway charges

2. Calculate Priority Score:

   Priority Score = (Value Score × Monthly Savings) / (Risk Score × Implementation Days)
   High: Score > 20 | Medium: Score 5-20 | Low: Score < 5

Step 5: User Confirmation

Action: Present summary and get approval before creating GitHub issues

🎯 AWS Cost Optimization Summary

📊 Analysis Results:
• Total Resources Analyzed: X
• Current Monthly Cost: $X
• Potential Monthly Savings: $Y
• Optimization Opportunities: Z
• High Priority Items: N

🏆 Recommendations:
1. [Resource]: [Current] → [Target] = $X/month savings - [Risk] | [Effort]
...

💡 This will create Y individual GitHub issues + 1 EPIC issue.

⚠️ **Privacy Warning**: GitHub issues created by this skill will contain resource types, counts, and cost estimates. Confirm that the target repository is an appropriate location for this information. If the repository is public or accessible to parties outside your organization, consider using a private repository.

Optional: Include detailed infrastructure diagram in EPIC issue? (y/n — defaults to n)

❓ Proceed with creating GitHub issues? (y/n)

Wait for user confirmation before proceeding.

Step 6: Create Individual Optimization Issues

Action: Create separate GitHub issues for each optimization. Label with "cost-optimization" (green) and "aws" (orange).

Title: [COST-OPT] [Resource Type] - [Brief Description] - $X/month savings

Body:

## 💰 Cost Optimization: [Brief Title]

**Monthly Savings**: $X | **Risk Level**: [Low/Medium/High] | **Effort**: X days

### 📋 Description
[Clear explanation of the optimization and why it's needed]

### 🔧 Implementation

**IaC Files Detected**: [Yes/No]

```bash
# IaC modification (preferred) or AWS CLI fallback
```

### 📊 Evidence
- Resource Type: [e.g., EC2 instance, Lambda function]
- Resource Count Affected: [N]
- Observed Utilization Pattern: [e.g., "average CPU < 5% over 7 days"]
- Cost Impact: $X/month → $Y/month (estimated)

### ✅ Validation Steps
- [ ] Test in non-production environment
- [ ] Verify no performance degradation via CloudWatch
- [ ] Confirm cost reduction in AWS Cost Explorer

### ⚠️ Risks & Considerations
- [Risk and mitigation]

**Priority Score**: X | **Value**: X/10 | **Risk**: X/10

Step 7: Create EPIC Coordinating Issue

Action: Create master tracking issue. Label with "cost-optimization" (green), "aws" (orange), "epic" (purple).

Title: [EPIC] AWS Cost Optimization Initiative - $X/month potential savings

Body: Executive summary with AWS account alias (not account ID) and region, prioritized checklist linking all individual issues (High → Medium → Low), progress tracking table (issue title + estimated savings + status), and success criteria (>80% of estimated savings realized, no performance degradation).

Architecture diagram: Only included if the user explicitly opted in at Step 5. If included, add a collapsible <details> block with the label "⚠️ Infrastructure topology — confirm this issue is in a private repository before expanding" and generate the Mermaid diagram inside it.

Error Handling

• AWS Authentication Failure: Guide through aws configure
• No Resources Found: Create informational issue about AWS resource deployment
• Insufficient Permissions: The required IAM actions are listed in the Required IAM Permissions section above. Provide that policy document to the account administrator.
• GitHub Creation Failure: Output formatted recommendations to console
• Cost Explorer Not Enabled: Guide user to enable in AWS Console

Success Criteria

• ✅ All cost estimates verified against actual configurations and AWS pricing
• ✅ Individual GitHub issues created for each optimization
• ✅ EPIC issue provides comprehensive coordination and tracking
• ✅ All recommendations include specific AWS CLI or IaC commands
• ✅ User confirmation obtained before creating issues