AWS Cost Optimization skill for Codex

Done well means: every recommendation traces to a line in the bill, savings are estimated in dollars per month with the assumption shown, the cheap safe wins ship first, nothing is deleted or purchased without explicit approval, and the change is visible in Cost Explorer the following week.

Hard rules

• Analysis is read-only. Deleting resources, stopping instances, changing storage classes, and buying Savings Plans or Reserved Instances all require the user’s explicit confirmation after they have seen the list and the estimate.
• Commitment purchases are a business decision with a 1- or 3-year term. Present coverage, utilization and break-even; the user (or their finance owner) decides. Do not frame it as financial advice.
• Quote prices as “us-east-1 list price at time of writing” and tell the user to confirm current regional pricing; prices change and vary by region.
• Cost Explorer API calls are billed per request (about $0.01 each). Batch queries rather than looping per day per service.

Workflow

• Get the shape of the bill: top services, last 3 months, monthly
• Drill into the top 3 services by usage type to find the real driver
• Run the quick-win sweep (orphans and defaults)
• Check architecture-level drivers (NAT, data transfer, logs, over-provisioning)
• Check commitment coverage last, after waste is removed
• Present findings ranked by monthly savings and risk; get approval per action
• Apply approved changes through IaC where the resource is managed by IaC
• Re-check Cost Explorer after 7 days

1. Shape of the bill (needs network and credentials)

aws ce get-cost-and-usage \
  --time-period Start=2026-07-01,End=2026-10-01 --granularity MONTHLY \
  --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE \
  --output json > cost-by-service.json
# Amounts are strings; sort them in Python or jq, not in a JMESPath filter
python3 -c "import json;d=json.load(open('cost-by-service.json'))
for m in d['ResultsByTime']:
    rows=sorted(((float(g['Metrics']['UnblendedCost']['Amount']),g['Keys'][0]) for g in m['Groups']),reverse=True)
    print(m['TimePeriod']['Start'],*[f'{s}: {a:,.0f}' for a,s in rows[:8]],sep='\n  ')"

# Drill into one service by usage type, the dimension that names the actual meter
aws ce get-cost-and-usage \
  --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY \
  --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Elastic Compute Cloud - Compute"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE

Usage types tell the story: NatGateway-Bytes (NAT processing), DataTransfer-Regional-Bytes (cross-AZ), TimedStorage-ByteHrs (S3 storage), EBS:VolumeUsage.gp2, PublicIPv4:InUseAddress, DataProcessing-Bytes under CloudWatch (log ingestion).

For organizations with many accounts, group by LINKED_ACCOUNT first. For line-item analysis at scale, query a CUR 2.0 Data Export with Athena instead of Cost Explorer.

If the user exported a CSV from the billing console, analyse it locally with Python or DuckDB; that needs no network or credentials.

2. Quick-win sweep

Run per region (--region), since most of these are regional.

# Unattached EBS volumes
aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].[VolumeId,Size,VolumeType,CreateTime]' --output table
# gp2 volumes to migrate to gp3 (cheaper per GB, baseline 3,000 IOPS, online change)
aws ec2 describe-volumes --filters Name=volume-type,Values=gp2 --query 'length(Volumes)'
# Elastic IPs not associated (all public IPv4 addresses are billed hourly)
aws ec2 describe-addresses --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId]'
# Snapshots owned by this account, oldest first
aws ec2 describe-snapshots --owner-ids self \
  --query 'sort_by(Snapshots,&StartTime)[:30].[SnapshotId,VolumeSize,StartTime,Description]'
# Log groups that never expire
aws logs describe-log-groups --query 'logGroups[?retentionInDays==null].[logGroupName,storedBytes]'
# Load balancers: check RequestCount / ActiveConnectionCount in CloudWatch for zero traffic
aws elbv2 describe-load-balancers --query 'LoadBalancers[].[LoadBalancerName,Type,CreatedTime]'

Before proposing a deletion, check tags, IaC ownership and whether a snapshot is the only backup of something. Prefer “snapshot, then delete” for volumes, and list the exact IDs in the approval request.

3. Architecture-level drivers

Finding	Typical fix
High NatGateway-Bytes	S3 and DynamoDB gateway VPC endpoints (free); interface endpoints for ECR, Logs, STS when traffic justifies their hourly cost
High cross-AZ transfer	Keep chatty services and their caches in the same AZ where safe; check load balancer cross-zone settings; avoid Multi-AZ for dev
CloudWatch Logs ingestion	Lower log level, drop health-check logs, sample debug logs, set retention; Infrequent Access log class for logs you rarely query
Instances under 20% CPU for weeks	Right-size from Compute Optimizer; move to Graviton (m7g, c7g, r7g and newer) when the stack supports arm64
Non-production running 24/7	Schedule stop outside working hours (Instance Scheduler, EventBridge Scheduler)
RDS on old engine version	Upgrade before Extended Support charges start
S3 growth	Lifecycle rules, Intelligent-Tiering, abort incomplete multipart uploads, expire noncurrent versions
Lambda cost	Right-size memory, arm64, cut init time
EKS/ECS idle capacity	Right-size requests, Spot for interruptible workloads

Deep checklists per service, with the commands and the trade-off for each fix, are in references/service-checklists.md. Read the section for a service only when it is in the top five of the bill.

4. Commitments, last

Remove waste first; committing to wasted capacity locks the waste in for years.

aws ce get-savings-plans-coverage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY
aws ce get-savings-plans-utilization --time-period Start=2026-09-01,End=2026-10-01
aws ce get-savings-plans-purchase-recommendation \
  --savings-plans-type COMPUTE_SP --term-in-years ONE_YEAR \
  --payment-option NO_UPFRONT --lookback-period-in-days THIRTY_DAYS

Commitment	Covers	Flexibility
Compute Savings Plan	EC2, Fargate, Lambda, any region, family, OS	Highest; good default
EC2 Instance Savings Plan	One instance family in one region	Bigger discount, less flexible
Reserved Instances	RDS, ElastiCache, OpenSearch, Redshift	Required for these services

Present: current on-demand baseline (the steady floor, not the average), proposed hourly commitment, expected utilization, estimated savings, and the risk if usage drops. Leave the purchase decision and the click to the user.

Prevention

• Cost allocation tags (team, service, env) activated in the billing console; enforce tagging in IaC.
• AWS Budgets with alerts at 80% and 100% of forecast per account or team.
• Cost Anomaly Detection monitors on services and linked accounts.
• A monthly review using this workflow, with savings tracked against the previous month.

Gotchas

• Unblended vs amortized cost: with upfront commitments, amortized shows the real monthly cost. Use the same metric when comparing months.
• Credits and refunds hide real usage. Filter RECORD_TYPE to Usage when analysing.
• Stopping an EC2 instance still bills its EBS volumes and Elastic IPs.
• Deleting a snapshot that an AMI references fails; deregistering the AMI first is a destructive step that needs confirmation.
• Moving data out of Glacier or IA early incurs minimum-duration and retrieval charges.
• A savings estimate from a single month can be skewed by one-off events; check 3 months.

Output

## AWS cost review: <account or org>, <period>
**Total:** $X/month (trend: +Y% over 3 months). Top drivers: <service: $, usage type>

| # | Finding | Evidence | Action | Est. saving/month | Risk | Needs approval |
|---|---|---|---|---|---|---|
| 1 | 14 unattached gp2 volumes, 3.2 TB | describe-volumes, us-east-1 | Snapshot then delete | ~$260 | Low | Yes |

**Commitments:** coverage X%, utilization Y%; recommendation summary for the user to decide.
**Not checked:** <regions, accounts, services skipped>
**Prices:** us-east-1 list prices at time of writing; confirm current pricing.