Overview
A cost review usually produces a long list nobody can rank. The instance that looks idle may be a warm standby; the tagging gap may be worth more than the idle instance. What is missing is not findings but the evidence to sort them by what fixing them is worth. Deploy it to get that ranking. You name the use cases you want run, with any scoping — regions, tag keys, thresholds — and it scans the connected account, sorting what it finds by what fixing it is worth.
For: whoever owns AWS spend in one account, on a schedule rather than during an incident.
Not for: acting on what it finds — every finding is a recommendation for someone else to carry
out.
It runs only the use cases you name. A prompt that names none gets the list back rather than a full
scan — deliberately, because a blind scan of every use case across every region is the slowest
possible way to start.
The preflight
Every run, regardless of which use cases you chose, first checks whether the account’s opt-in cost and data features are enabled — Cost Explorer, Cost and Usage Reports, VPC Flow Logs, Cost Anomaly Detection, Budgets and Compute Optimizer. This is not optional, and it is worth reading before the findings. Several use cases are blocked or degraded without those features, and a thin result is much more often a disabled feature than a clean account.Tools supported
Read-only. There is no mutating tool in its surface.
Scenario examples
In chat, or as a run’s prompt: Targeted analysesPrerequisites
Catalog ID:
aws-cost-analyzer — what the deploy API takes.
The AWS connection offers the same two authentication modes as the AWS investigator, and which you
see depends on where the agent runs:
As part of a workflow
It is a scheduled analysis rather than an incident specialist: give it a trigger, point it at one account, and let the findings accumulate where someone reviews them. Where you run it across several accounts, deploy one per account so each run’s findings carry an unambiguous owner. See Triggers & schedules and Cloud optimization.Limitations
- It finds waste; it never acts on it. There is no mutating tool in its surface, so it cannot stop an instance, delete a volume, change a tag or buy a reservation. Every finding is a recommendation for someone else to carry out.
- It is bounded by the preflight. Where an opt-in feature is disabled, the analyses that depend on it are degraded or unavailable, and it reports that rather than estimating around the gap.
- It scans one account. Run one instance per account so each finding carries an unambiguous owner.
- It runs only what you name. A prompt naming no use cases returns the list, not a full scan.
Recommended model
claude-sonnet-5 — the shipped default. The work is judgement over evidence someone else gathered,
where a weaker model produces confident-sounding conclusions that do not hold.
Next steps
Cloud optimization
The module that turns these findings into tracked work.
Triggers & schedules
Run the analysis on a schedule.
AWS Infrastructure Investigator
The same account, read for incidents rather than waste.
Agent catalog
Every catalog agent, side by side.