From c6c714e6e37f8187c2832886e64d05cfa41e46d3 Mon Sep 17 00:00:00 2001 From: Rajat Goyal Date: Fri, 17 Jul 2026 09:38:38 -0400 Subject: [PATCH 1/2] feat: Add EOS cost analysis skill and custom agent Discovers AWS resources approaching or past End of Standard Support and calculates Extended Support cost impact across all associated accounts. Skill: eos-cost-analysis - 5-phase workflow: Scope, Discover, Classify, Calculate, Report - Supports EKS, RDS/Aurora, Lambda, ElastiCache, OpenSearch - Year 1/2/3 tiered pricing with Multi-AZ cost doubling for RDS - Works in regular Chat (ad-hoc) or as a Custom Agent (scheduled) - Defaults to scanning all associated accounts Custom Agent: eos-cost-analysis - System prompt for dedicated/scheduled runs - Slack notification support (when integration available) - Produces persisted artifacts for week-over-week tracking --- custom-agents/eos-cost-analysis/CHANGELOG.md | 12 + custom-agents/eos-cost-analysis/README.md | 71 ++++ .../eos-cost-analysis/SYSTEM_PROMPT.md | 47 +++ skills/eos-cost-analysis/CHANGELOG.md | 14 + skills/eos-cost-analysis/README.md | 77 ++++ skills/eos-cost-analysis/SKILL.md | 354 ++++++++++++++++++ 6 files changed, 575 insertions(+) create mode 100644 custom-agents/eos-cost-analysis/CHANGELOG.md create mode 100644 custom-agents/eos-cost-analysis/README.md create mode 100644 custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md create mode 100644 skills/eos-cost-analysis/CHANGELOG.md create mode 100644 skills/eos-cost-analysis/README.md create mode 100644 skills/eos-cost-analysis/SKILL.md diff --git a/custom-agents/eos-cost-analysis/CHANGELOG.md b/custom-agents/eos-cost-analysis/CHANGELOG.md new file mode 100644 index 0000000..3d0c20d --- /dev/null +++ b/custom-agents/eos-cost-analysis/CHANGELOG.md @@ -0,0 +1,12 @@ +# Changelog + +## 1.0.0 (2026-06-18) + +- Initial release +- Support for 5 services: EKS, RDS/Aurora, Lambda, ElastiCache, OpenSearch +- Extended Support cost calculation with Year 1/2/3 tiered pricing +- Single-account and organization-wide (cross-account) analysis +- EOS date and pricing validation via aws-knowledge-mcp-server +- CSV artifact generation with per-resource cost breakdown +- Upgrade recommendations with AWS documentation links +- Lambda deprecated runtime flagging (security risk, no ES cost) diff --git a/custom-agents/eos-cost-analysis/README.md b/custom-agents/eos-cost-analysis/README.md new file mode 100644 index 0000000..cf6e5b6 --- /dev/null +++ b/custom-agents/eos-cost-analysis/README.md @@ -0,0 +1,71 @@ +# EOS Cost Analysis — Custom Agent + +## Purpose + +A dedicated custom agent that discovers AWS resources approaching or past End of Standard Support and calculates the Extended Support cost impact. Use this when you want automated, scheduled EOS posture reports without manual prompting. + +> **Note:** For ad-hoc queries, you don't need this custom agent. Just upload the [eos-cost-analysis skill](../../skills/eos-cost-analysis/) and ask questions in regular Chat. This custom agent is for scheduled/automated runs. + +## Key Capabilities + +- Runs on demand or on a weekly/monthly schedule +- Discovers resources across all associated accounts automatically +- Produces a persisted artifact (report) each run for tracking over time +- Covers EKS, RDS/Aurora, Lambda, ElastiCache, and OpenSearch +- Calculates per-resource Extended Support cost with Year 1/2/3 pricing tiers + +## Prerequisites + +- An AWS DevOps Agent space +- The [eos-cost-analysis skill](../../skills/eos-cost-analysis/) uploaded to your Agent Space (choose "All agents" for Agent Type) +- `use_aws` and `verify_aws_claim` tools available in the Agent Space +- IAM permissions for resource discovery: + - `eks:ListClusters`, `eks:DescribeCluster` + - `rds:DescribeDBInstances`, `rds:DescribeDBClusters` + - `lambda:ListFunctions` + - `elasticache:DescribeCacheClusters` + - `opensearch:ListDomainNames`, `opensearch:DescribeDomains` +- For multi-account analysis: associate secondary accounts in DevOps Agent settings + +## Creating the Agent + +1. In the DevOps Agent web app, go to the "Agents" menu (on the bottom left pane) +2. Click "Create agent" (on the right side), then click "Form" (the left-most option) +3. In the "Name" field, use "eos-cost-analysis" +4. Copy the content of the `SYSTEM_PROMPT.md` file from this directory, and paste it into the "System prompt" field +5. In the "Skills" drop-down list, select the "eos-cost-analysis" skill, and click "Create agent" +6. Add the `use_aws` tool — in the custom agent's window, click "Edit", select "Chat", and type "Add the use_aws tool to this custom agent" +7. Add the `verify_aws_claim` tool — type "Also add the verify_aws_claim tool" +8. Verify both tools appear under "Tools" for this custom agent + +## Executing the Agent + +You can execute the custom agent on-demand, on schedule, or using chat. Follow the [Executing custom agents guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/custom-agents-executing-custom-agents.html) for more information. + +**On-demand prompts:** +- "Run this agent now" (uses default — full EOS analysis across all services and accounts) +- "Analyze EKS EOS only in us-east-1 and eu-west-1" +- "Check RDS extended support costs for the last quarter" + +**Scheduled runs:** +- Configure weekly or monthly execution under the agent's schedule settings +- Each run produces a new artifact version, allowing week-over-week comparison + +Once finished, the artifact is persisted on the **Artifacts** page in the DevOps Agent web app. + +## Multi-Account Setup + +For organization-wide analysis across multiple AWS accounts: + +1. In DevOps Agent, go to Settings → Cloud Sources +2. Click "Add secondary cloud source" +3. Follow the prompts to create a cross-account role in each secondary account +4. After association, the agent automatically discovers resources across all connected accounts + +No additional configuration needed in the skill or agent — DevOps Agent handles cross-account access transparently. + +## Related + +- [eos-cost-analysis skill](../../skills/eos-cost-analysis/) — the domain knowledge skill this agent uses (also works standalone in Chat) +- [aws-health-events skill](../../skills/aws-health-events/) — for correlating with Health Dashboard deprecation events +- [AWS DevOps Agent custom agents documentation](https://docs.aws.amazon.com/devopsagent/latest/userguide/working-with-devops-agent-custom-agents-index.html) diff --git a/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md b/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md new file mode 100644 index 0000000..cb2d753 --- /dev/null +++ b/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md @@ -0,0 +1,47 @@ +You are an EOS Cost Analyzer — a specialized agent that discovers AWS resources approaching or past End of Standard Support and calculates the financial impact of Extended Support charges across an AWS environment. + +## Goal + +Identify all resources incurring or approaching Extended Support charges, calculate the per-resource and organization-wide cost impact, and provide actionable upgrade recommendations with AWS documentation references. + +## Approach + +1. Read the `eos-cost-analysis` skill to load the methodology, discovery procedures, and cost calculation formulas. +2. Determine scope: which service(s), which regions. Always scan ALL associated accounts by default unless the user explicitly restricts to a specific account. +3. Discover resources using AWS service APIs via `use_aws`. +4. Validate EOS dates and Extended Support pricing against AWS documentation using available verification tools. +5. Classify each resource by EOS status and calculate its monthly Extended Support cost. +6. Generate a structured report with per-resource breakdown, urgency levels, and upgrade recommendations. +7. Produce a CSV artifact with the complete resource inventory and cost analysis. + +## Constraints + +- Read-only — do not modify, upgrade, or delete any resources. +- Never guess EOS dates or pricing. Always verify from AWS documentation. If a date or rate cannot be confirmed, report it as "UNVERIFIED" or "PRICING_UNAVAILABLE". +- Extended Support pricing escalates yearly: Year 1 = base rate, Year 2 = 2×, Year 3 = 3×. Always determine which pricing year applies. +- For RDS Multi-AZ instances, Extended Support is billed on both primary and standby — multiply cost by 2. +- If cross-account role assumption fails for any account, skip it and note it in the report rather than stopping the entire analysis. +- All output is AI-generated and must be independently verified before taking action or sharing externally. + +## Output + +Produce a single artifact titled "EOS Cost Impact Report — [date]" containing: + +1. **Executive Summary** — Total monthly/annual Extended Support cost, affected resource count, top impacted accounts. +2. **Cost Breakdown by Service** — Per-service totals with resource counts. +3. **Resource Detail Table** — Every affected resource with: ARN, version, EOS status, monthly cost, urgency, recommended upgrade target. +4. **Upgrade Recommendations** — Per-version migration path with AWS documentation links. +5. **Security Risk** (if applicable) — Deprecated Lambda runtimes flagged separately (no ES cost, but security risk). + +If an EOS Cost Impact Report artifact already exists for the same scope, update it with the latest data instead of creating a new one. + +## Notifications + +After generating the report, check if a communication tool integration exists (Slack, Jira, ServiceNow, or similar). If available, send a summary notification containing: +- Total monthly Extended Support cost +- Number of CRITICAL resources currently incurring charges +- Number of HIGH urgency resources approaching EOS +- Top impacted account and service +- Link or reference to the full artifact for details + +Do not send a notification if no resources are affected (all supported). diff --git a/skills/eos-cost-analysis/CHANGELOG.md b/skills/eos-cost-analysis/CHANGELOG.md new file mode 100644 index 0000000..689a819 --- /dev/null +++ b/skills/eos-cost-analysis/CHANGELOG.md @@ -0,0 +1,14 @@ +# Changelog + +## 1.0.0 (2026-06-18) + +- Initial release +- 5-phase workflow: Scope → Discover → Classify → Calculate → Report +- Service support: EKS, RDS/Aurora, Lambda, ElastiCache, OpenSearch +- EOS status classification: IN_EXTENDED_SUPPORT, APPROACHING_EOS, PAST_EXTENDED_SUPPORT +- Cost calculation with per-vCPU (RDS), per-cluster (EKS), per-node (ElastiCache/OpenSearch) formulas +- Multi-AZ cost doubling for RDS +- Year 1/2/3 pricing escalation +- Cross-account discovery via sts:AssumeRole +- Documentation validation via aws-knowledge-mcp-server +- CSV artifact output with upgrade recommendations diff --git a/skills/eos-cost-analysis/README.md b/skills/eos-cost-analysis/README.md new file mode 100644 index 0000000..0e952b1 --- /dev/null +++ b/skills/eos-cost-analysis/README.md @@ -0,0 +1,77 @@ +# EOS Cost Analysis — Skill + +## Purpose + +Discovers AWS resources approaching or past End of Standard Support and calculates the Extended Support cost impact across your AWS environment. Covers EKS, RDS/Aurora, Lambda, ElastiCache, and OpenSearch — the services that incur Extended Support charges. + +## Key Capabilities + +- Discovers resources with deprecated versions across 5 AWS services (multi-account supported) +- Validates EOS dates and Extended Support pricing against live AWS documentation +- Calculates per-resource monthly cost with Year 1/2/3 tiered pricing escalation +- Handles RDS Multi-AZ cost doubling and instance class to vCPU mapping +- Flags deprecated Lambda runtimes as security risk (no ES charge but patching stops) +- Produces a structured report with per-resource breakdown, urgency levels, and upgrade recommendations + +## Usage Options + +### Option 1: Ad-Hoc via Regular Chat + +Upload the skill and use it directly in the built-in DevOps Agent chat for on-demand analysis. + +**Setup:** +1. Import the skill (choose "All agents" for Agent Type) +2. Go to the regular Chat interface +3. Ask any EOS-related question + +**Example prompts:** +- "What's my EOS cost exposure?" +- "Check which EKS clusters are in Extended Support" +- "Full EOS analysis across all services and accounts" +- "What RDS instances are approaching end of support?" + +### Option 2: Dedicated Custom Agent (Scheduled/Automated) + +Create a custom agent for scheduled runs that produce reports on a weekly or monthly cadence — no human prompt needed. + +**Setup:** +1. Import the skill (choose "All agents" for Agent Type) +2. Go to Agents → Create agent → Form +3. Name: `eos-cost-analysis` +4. System prompt: paste from [SYSTEM_PROMPT.md](../../custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md) +5. Skills: select `eos-cost-analysis` +6. Add tools: `use_aws` and `verify_aws_claim` +7. Configure a schedule (weekly or monthly) under the agent's settings + +**When to use this option:** +- You want automated, recurring EOS posture reports +- You want artifacts generated without manual prompting +- You want to track EOS cost drift over time (compare reports week over week) + +## Prerequisites + +- AWS DevOps Agent space with `use_aws` and `verify_aws_claim` tools available +- IAM permissions for resource discovery: + - `eks:ListClusters`, `eks:DescribeCluster` + - `rds:DescribeDBInstances`, `rds:DescribeDBClusters` + - `lambda:ListFunctions` + - `elasticache:DescribeCacheClusters` + - `opensearch:ListDomainNames`, `opensearch:DescribeDomains` +- For multi-account analysis: associate secondary accounts in DevOps Agent settings +- AWS Support plan: Business, Enterprise On-Ramp, or Enterprise (required for DevOps Agent) + +## Importing the Skill + +1. In the DevOps Agent web app, go to "Skills" (left sidebar) +2. Click "Import skill" +3. Upload the zip file containing `SKILL.md` +4. In "Agent Type" field: select **"All agents"** +5. Click "Import" + +## Related + +- [eos-cost-analysis custom agent](../../custom-agents/eos-cost-analysis/) — system prompt and setup guide for the dedicated agent +- [aws-health-events skill](../aws-health-events/) — for correlating with Health Dashboard deprecation notifications +- [eks-operation-review skill](../eks-operation-review/) — comprehensive EKS operational review (broader than EOS) +- [AWS EKS Version Lifecycle](https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html) +- [Amazon RDS Extended Support](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/extended-support.html) diff --git a/skills/eos-cost-analysis/SKILL.md b/skills/eos-cost-analysis/SKILL.md new file mode 100644 index 0000000..5efc210 --- /dev/null +++ b/skills/eos-cost-analysis/SKILL.md @@ -0,0 +1,354 @@ +--- +name: eos-cost-analysis +description: Discovers AWS resources approaching or past End of Standard Support and + calculates Extended Support cost impact. Use when a user asks about end of support, + extended support costs, version deprecation, EOS analysis, or upgrade planning for + EKS, RDS, Lambda, ElastiCache, or OpenSearch. This skill enumerates resources via + AWS APIs, classifies their EOS status, validates dates and pricing against AWS + documentation, and produces a cost-impact report with per-resource breakdown. +metadata: + author: rajatgoy + version: "1.0.0" + aws-devops-agent-skills.agent-types: "Chat tasks, Custom agents" + aws-devops-agent-skills.aws-services: "Amazon EKS, Amazon RDS, AWS Lambda, Amazon ElastiCache, Amazon OpenSearch Service, AWS Health" + aws-devops-agent-skills.technical-domains: "Cost Optimization, Operations" +--- + +# EOS Cost Analysis + +Discover AWS resources approaching End of Standard Support, calculate Extended +Support charges, and generate an actionable cost-impact report. + + +## When to Use This Skill + +- User asks about End of Support, Extended Support costs, or version deprecation +- User wants to know which resources are incurring or will incur Extended Support charges +- User asks for upgrade planning or EOS posture assessment +- User wants a cost-impact report for deprecated service versions +- Proactive scheduled checks for EOS posture across the organization + +## Supported Services (Phase 1 — Extended Support Charges) + +| Service | Billing Unit | Discovery API | +|---------|-------------|---------------| +| Amazon EKS | Per cluster/hour | `eks:ListClusters`, `eks:DescribeCluster` | +| Amazon RDS/Aurora | Per vCPU/hour | `rds:DescribeDBInstances`, `rds:DescribeDBClusters` | +| AWS Lambda | No direct ES charge (security risk only) | `lambda:ListFunctions` | +| Amazon ElastiCache | Per node/hour | `elasticache:DescribeCacheClusters` | +| Amazon OpenSearch | Per instance/hour | `opensearch:ListDomainNames`, `opensearch:DescribeDomains` | + +## Extended Support Pricing Tiers + +Charges escalate based on how long a resource has been past End of Standard Support: + +- **Year 1** (0–12 months past EOS): Base rate +- **Year 2** (12–24 months past EOS): 2× base rate +- **Year 3** (24–36 months past EOS): 3× base rate + +After Year 3, AWS may force-upgrade the resource. + +## Prerequisites + +- IAM permissions for service discovery APIs (see list per service above) +- For organization-wide analysis: `organizations:ListAccounts` and `sts:AssumeRole` to a read-only role in member accounts +- For EOS date and pricing validation: `aws-knowledge-mcp-server` connected to the Agent Space +- AWS Health API access (Business Support+ plan) for `health:DescribeEvents` + +## Constraints + +- NEVER guess or estimate EOS dates — always verify from AWS documentation +- NEVER fabricate pricing rates — use only values confirmed via documentation search +- If a version is not found in documentation, mark it as "UNVERIFIED — check AWS docs" +- All output is AI-generated and must be independently verified before taking action +- Read-only operations only — do not modify any resources + +--- + +## Phase 1: Scope Definition + +1. **Identify target service(s)** from the user request: + - If user specifies a service (e.g., "EKS EOS") → analyze that service only + - If user says "all services" or "full EOS analysis" → analyze all 5 supported services + - If unclear, ask: "Which service would you like me to analyze? (EKS, RDS, Lambda, ElastiCache, OpenSearch, or all)" + +2. **Determine account scope:** + - **Default: ALL associated accounts** — Always scan all accounts connected to the Agent Space unless the user explicitly restricts scope + - If user says "only this account" or specifies an account ID → limit to that account + - The agent discovers associated accounts automatically via the Agent Space configuration + +3. **Determine region scope:** + - If user specifies regions → use those + - Otherwise → scan all commercially available regions + - Optimization: first check which regions have resources for the target service using a quick `List` call in each region + +4. **Confirm scope** with the user: + - "I'll analyze [service(s)] across [N accounts] in [regions]. Shall I proceed?" + - In auto/scheduled mode: proceed without confirmation + - Default behavior: all services, all associated accounts, all regions — unless user narrows it + +--- + +## Phase 2: Resource Discovery + +For each account and region in scope, call the appropriate service APIs. + +### EKS Discovery + +``` +use_aws: eks:ListClusters (region: ) +→ For each cluster name: + use_aws: eks:DescribeCluster (name: , region: ) + → Extract: clusterName, version, arn, createdAt +``` + +**Record:** account_id, region, cluster_name, cluster_arn, kubernetes_version + +### RDS Discovery + +``` +use_aws: rds:DescribeDBInstances (region: ) +→ For each instance: + → Extract: DBInstanceIdentifier, Engine, EngineVersion, DBInstanceClass, + MultiAZ, DBInstanceArn, DBClusterIdentifier +``` + +**Filter:** Only include instances where `Engine` is `postgres`, `mysql`, or `aurora-*`. +**Record:** account_id, region, instance_id, engine, engine_version, instance_class, multi_az, arn + +**Instance class to vCPU mapping** (required for cost calculation): +- Use `aws-knowledge-mcp-server` to search: "[instance_class] vCPU count" +- Common mappings: db.t3.micro=2, db.t3.small=2, db.t3.medium=2, db.r5.large=2, db.r5.xlarge=4, db.r5.2xlarge=8, db.r5.4xlarge=16, db.r6g.large=2, db.r6g.xlarge=4, db.r6g.2xlarge=8 + +### Lambda Discovery + +``` +use_aws: lambda:ListFunctions (region: ) +→ For each function: + → Extract: FunctionName, Runtime, FunctionArn, LastModified +``` + +**Filter:** Only include functions with deprecated runtimes (python3.8, python3.7, nodejs16.x, nodejs14.x, dotnet6, java8, etc.) +**Record:** account_id, region, function_name, runtime, arn, last_modified + +### ElastiCache Discovery + +``` +use_aws: elasticache:DescribeCacheClusters (region: , ShowCacheNodeInfo: true) +→ For each cluster: + → Extract: CacheClusterId, Engine, EngineVersion, CacheNodeType, NumCacheNodes, ARN +``` + +**Filter:** Only include clusters where `Engine` = `redis` and version is deprecated. +**Record:** account_id, region, cluster_id, engine_version, node_type, num_nodes, arn + +### OpenSearch Discovery + +``` +use_aws: opensearch:ListDomainNames (region: ) +→ For each domain name: + use_aws: opensearch:DescribeDomain (DomainName: , region: ) + → Extract: DomainName, EngineVersion, ClusterConfig.InstanceType, + ClusterConfig.InstanceCount, ARN +``` + +**Record:** account_id, region, domain_name, engine_version, instance_type, instance_count, arn + +### Discovery Summary + +After discovery completes, present: +- Total resources found per service +- Unique versions detected (with counts) +- Accounts and regions with resources + +--- + +## Phase 3: EOS Classification and Pricing Validation + +### Step 3.1 — Validate EOS Dates + +For each unique version discovered, verify its End of Standard Support date: + +1. Search AWS documentation: "[service] [version] end of standard support date" +2. Search AWS documentation: "[service] version lifecycle calendar" +3. Extract: `eos_date` (end of standard support), `es_end_date` (end of extended support) + +If documentation search returns no result for a version: +- Mark as `UNVERIFIED` +- Note in the report: "EOS date could not be confirmed from AWS documentation" + +### Step 3.2 — Validate Extended Support Pricing + +For each service with affected resources: + +1. Search `aws-knowledge-mcp-server`: "[service] extended support pricing" +2. Extract: rate, billing unit, year-over-year escalation +3. Known pricing (validate against docs): + - **EKS**: $0.60 per cluster per hour (Year 1) + - **RDS**: $0.10 per vCPU per hour (Year 1) + - **ElastiCache**: Varies by node type — must look up + - **OpenSearch**: Varies by instance type — must look up + - **Lambda**: No Extended Support charge (deprecated runtimes lose security patches only) + +### Step 3.3 — Classify Each Resource + +Compare each resource's version against the validated EOS dates: + +| Status | Condition | Include in Report? | +|--------|-----------|-------------------| +| `IN_EXTENDED_SUPPORT` | EOS date is past, ES end date is future | YES — currently incurring charges | +| `APPROACHING_EOS` | EOS date is within 6 months from today | YES — will soon incur charges | +| `PAST_EXTENDED_SUPPORT` | Both EOS and ES end dates are past | YES — critical, may be force-upgraded | +| `SUPPORTED` | EOS date is more than 6 months away | NO — exclude from cost report | + +### Step 3.4 — Search Upgrade Recommendations + +For each affected version: +1. Search `aws-knowledge-mcp-server`: "[service] upgrade from [version] to latest" +2. Extract: recommended target version, key breaking changes, migration guide URL + +--- + +## Phase 4: Cost Calculation + +### Step 4.1 — Determine pricing year + +For each resource classified as `IN_EXTENDED_SUPPORT` or `PAST_EXTENDED_SUPPORT`: +- Calculate months since EOS: `(today - eos_date).months` +- Year 1: 0–12 months → multiplier = 1 +- Year 2: 12–24 months → multiplier = 2 +- Year 3: 24–36 months → multiplier = 3 + +### Step 4.2 — Calculate per-resource monthly cost + +| Service | Formula | +|---------|---------| +| EKS | `monthly_cost = $0.60 × 730 × year_multiplier` | +| RDS | `monthly_cost = vCPUs × $0.10 × 730 × year_multiplier × (2 if MultiAZ else 1)` | +| ElastiCache | `monthly_cost = num_nodes × node_rate × 730 × year_multiplier` | +| OpenSearch | `monthly_cost = instance_count × instance_rate × 730 × year_multiplier` | +| Lambda | `monthly_cost = $0` (flag as security risk only) | + +### Step 4.3 — Assign urgency + +| Urgency | Condition | +|---------|-----------| +| `CRITICAL` | `IN_EXTENDED_SUPPORT` or `PAST_EXTENDED_SUPPORT` (already incurring charges) | +| `HIGH` | `APPROACHING_EOS` within 3 months | +| `MEDIUM` | `APPROACHING_EOS` within 3–6 months | + +### Step 4.4 — Aggregate totals + +Calculate: +- **Total monthly ES cost** across all resources +- **Total annual ES cost** (monthly × 12) +- **Top 10 most impacted accounts** (by monthly cost) +- **Cost by service** breakdown +- **Cost by urgency** breakdown + +--- + +## Phase 5: Report Generation + +### Step 5.1 — Present Summary + +``` +## EOS Cost Impact Summary + +| Metric | Value | +|--------|-------| +| Total Monthly Extended Support Cost | $X,XXX | +| Total Annual Extended Support Cost | $XX,XXX | +| Affected Resources | N | +| Affected Accounts | N | +| Services Analyzed | [list] | +| Regions Scanned | N | + +### By Urgency +- CRITICAL: N resources — $X,XXX/month (currently incurring charges) +- HIGH: N resources — $X,XXX/month (entering ES within 3 months) +- MEDIUM: N resources — $X,XXX/month (entering ES within 3-6 months) + +### By Service +- EKS: N clusters — $X,XXX/month +- RDS: N instances — $X,XXX/month +- ElastiCache: N nodes — $X,XXX/month +- OpenSearch: N instances — $X,XXX/month +- Lambda: N functions — $0 (security risk, no ES charge) + +### Top Impacted Accounts +1. [account_name] ([account_id]) — $X,XXX/month +2. ... +``` + +### Step 5.2 — Generate CSV Artifact + +Produce a CSV artifact with these columns: +- `account_id` — AWS account ID +- `account_name` — Account name (if available from Organizations) +- `resource_arn` — Full ARN of the resource +- `resource_name` — Human-readable identifier (cluster name, instance ID, function name) +- `region` — AWS region +- `service` — AWS service (EKS, RDS, Lambda, ElastiCache, OpenSearch) +- `version` — Current version/engine version/runtime +- `instance_class` — Instance type (for RDS, ElastiCache, OpenSearch) or N/A +- `multi_az` — true/false (RDS only) +- `eos_date` — End of Standard Support date +- `eos_status` — IN_EXTENDED_SUPPORT / APPROACHING_EOS / PAST_EXTENDED_SUPPORT +- `es_year` — Which pricing year (1, 2, or 3) +- `monthly_es_cost` — Monthly Extended Support cost for this resource +- `annual_es_cost` — Annual Extended Support cost (monthly × 12) +- `urgency` — CRITICAL / HIGH / MEDIUM +- `recommended_target` — Recommended upgrade version +- `upgrade_guide_url` — Link to AWS migration documentation + +Sort by `monthly_es_cost` descending. + +Title the artifact: "EOS Cost Impact Report — [date]" + +### Step 5.3 — Provide Upgrade Recommendations + +For each affected version, include: +- Current version → Recommended target version +- Key considerations or breaking changes +- AWS documentation link for the upgrade path +- Estimated effort: mention sequential upgrade requirements if applicable + +### Step 5.4 — Lambda Security Risk Section (if applicable) + +If deprecated Lambda runtimes were found: +``` +## Security Risk: Deprecated Lambda Runtimes + +These functions are running on deprecated runtimes that no longer receive +security patches. While no Extended Support charge applies, they represent +a security and compliance risk. + +| Function | Runtime | Last Modified | Account | +|----------|---------|---------------|---------| +| ... | python3.8 | 2023-... | ... | +``` + +--- + +## Error Handling + +| Error | Behavior | +|-------|----------| +| Role assumption fails for a linked account | Skip that account, note in report: "Account [ID] skipped — role assumption failed" | +| Service API returns AccessDenied | Skip that service/region, note: "Insufficient permissions for [service] in [region]" | +| Documentation search returns no EOS date | Mark version as "UNVERIFIED", include in report with note | +| Documentation search returns no pricing | Set monthly_es_cost to "PRICING_UNAVAILABLE", do not estimate | +| No resources found for a service | Report: "No [service] resources found in scope" | +| Rate limiting (throttling) | Retry with exponential backoff (1s, 2s, 4s), max 3 retries | +| Timeout on large organization (1000+ accounts) | Report partial results, note which accounts were completed | + +--- + +## Tips + +- **Start with a single service** for faster results — EKS is the simplest (flat per-cluster rate) +- **RDS has the most complex pricing** due to vCPU mapping and Multi-AZ doubling +- **Lambda has no cost impact** but deprecated runtimes are a security risk worth flagging +- **Year 2 and Year 3 multipliers** significantly increase costs — resources past EOS for 2+ years may cost 2–3× more than Year 1 estimates suggest +- **Check Health Dashboard** for upcoming scheduled deprecation events that may not yet be reflected in resource versions From ce115ead2e45dcce83e367b3986d70fe850997b9 Mon Sep 17 00:00:00 2001 From: Rajat Goyal Date: Fri, 17 Jul 2026 10:02:39 -0400 Subject: [PATCH 2/2] fix: Multi-account discovery via agent associations, explicit Slack notification handling --- custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md | 13 +++++-------- skills/eos-cost-analysis/SKILL.md | 5 +++-- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md b/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md index cb2d753..020d8b7 100644 --- a/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md +++ b/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md @@ -37,11 +37,8 @@ If an EOS Cost Impact Report artifact already exists for the same scope, update ## Notifications -After generating the report, check if a communication tool integration exists (Slack, Jira, ServiceNow, or similar). If available, send a summary notification containing: -- Total monthly Extended Support cost -- Number of CRITICAL resources currently incurring charges -- Number of HIGH urgency resources approaching EOS -- Top impacted account and service -- Link or reference to the full artifact for details - -Do not send a notification if no resources are affected (all supported). +After generating the report, attempt to send a summary notification via Slack or any available communication tool: +- Try to post a message to the configured Slack channel with: total monthly ES cost, number of CRITICAL resources, top impacted account and service +- If Slack posting succeeds: note "Notification sent to Slack" in the report +- If Slack posting fails or no communication tool is available: note "Notification skipped — no communication tool available or posting failed" in the report +- Do not send a notification if no resources are affected (all supported) diff --git a/skills/eos-cost-analysis/SKILL.md b/skills/eos-cost-analysis/SKILL.md index 5efc210..97f7099 100644 --- a/skills/eos-cost-analysis/SKILL.md +++ b/skills/eos-cost-analysis/SKILL.md @@ -73,9 +73,10 @@ After Year 3, AWS may force-upgrade the resource. - If unclear, ask: "Which service would you like me to analyze? (EKS, RDS, Lambda, ElastiCache, OpenSearch, or all)" 2. **Determine account scope:** - - **Default: ALL associated accounts** — Always scan all accounts connected to the Agent Space unless the user explicitly restricts scope + - **Default: ALL associated accounts** — Scan resources in ALL AWS accounts connected to this Agent Space (primary + all secondary cloud sources) + - The agent has access to multiple accounts through its cloud source associations — discover resources in EACH account, not just the primary + - To identify available accounts: attempt resource discovery in all accounts the agent has access to. The Agent Space configuration determines which accounts are available. - If user says "only this account" or specifies an account ID → limit to that account - - The agent discovers associated accounts automatically via the Agent Space configuration 3. **Determine region scope:** - If user specifies regions → use those