💵 FinOps Cost Optimization — Cloud Spend Intelligence¶

Owner: CFO · Also: CEO · Board asks: "Where is cloud spend leaking, and what's the fix?" · Domain: Finance

Related Resources¶

• Full CLI Reference: See runbooks finops User Guide for detailed command reference, examples, and subcommands.
• Cloud Foundations: Part of the Cloud Foundations Catalog — Finance domain cost optimization.

🚀 Quick Start Guide¶

Installation & Setup¶

## PyPI Installation (Recommended)
pip install runbooks
runbooks finops --help

## Configure enterprise profiles
export BILLING_PROFILE="your-billing-readonly-profile"
export MANAGEMENT_PROFILE="your-management-readonly-profile"
# export CENTRALISED_OPS_PROFILE="your-ops-readonly-profile"

## Verify access
aws sts get-caller-identity --profile $BILLING_PROFILE

Business Scenarios - Validated Working Commands¶

## Business scenario matrix (7 working scenarios) - NEW STANDARDIZED PARAMETERS
runbooks finops --help                                                   ## View all functionality
runbooks finops --scenario workspaces --profile $BILLING_PROFILE         ## WorkSpaces optimization
runbooks finops --scenario nat-gateway --profile $BILLING_PROFILE        ## NAT Gateway optimization
runbooks finops --scenario elastic-ip --profile $BILLING_PROFILE         ## Elastic IP management
runbooks finops --scenario ebs-optimization --profile $BILLING_PROFILE   ## EBS optimization
runbooks finops --scenario rds-snapshots --profile $BILLING_PROFILE      ## RDS snapshots cleanup
runbooks finops --scenario backup-investigation --profile $BILLING_PROFILE ## Backup analysis
runbooks finops --scenario vpc-cleanup --profile $BILLING_PROFILE        ## VPC cleanup

## Multi-account Landing Zone operations - NEW PARAMETER
runbooks finops --scenario workspaces --all-profile $MANAGEMENT_PROFILE    ## Multi-account WorkSpaces
runbooks finops --scenario vpc-cleanup --all-profile $MANAGEMENT_PROFILE   ## Organization-wide VPC cleanup

## AWS Cost Explorer metrics (default: UnblendedCost — matches AWS Billing Console)
runbooks finops --profile $BILLING_PROFILE                 ## Default: UnblendedCost (actual invoice charges)
runbooks finops --unblended --profile $BILLING_PROFILE     ## Explicit: UnblendedCost (same as default)
runbooks finops --amortized --profile $BILLING_PROFILE     ## Financial: AmortizedCost (RI/SP spread over term)
runbooks finops --cost-metric blended --profile $BILLING_PROFILE  ## BlendedCost (org-wide RI/SP averaging)

Core Dashboard Commands¶

## Default: Current month analysis - STANDARDIZED PARAMETERS
runbooks finops --profile $BILLING_PROFILE

## Trend: 6-month historical analysis
runbooks finops --trend --profile $BILLING_PROFILE

## Audit: Resource optimization opportunities
runbooks finops --audit --profile $BILLING_PROFILE

## Multi-format executive reporting
runbooks finops --profile $BILLING_PROFILE --csv --markdown --json --pdf

## Multi-account trend analysis - NEW vs LEGACY
runbooks finops --audit --trend --all-profile $MANAGEMENT_PROFILE    ## NEW: Multi-account Landing Zone
runbooks finops --audit --trend --all --profile $BILLING_PROFILE     ## LEGACY: Still supported

📋 Complete Command Line Options Reference¶

Core FinOps Commands¶

Analysis & Reporting Options¶

Export Format Options¶

Display & Formatting Options¶

Cost Metric Reference¶

The default metric is UnblendedCost — the same number shown on your AWS Billing Console "Bills" page and monthly invoice.

All personas (CxO, FinOps, Architect, SRE) should use UnblendedCost for consistency — it ensures runbooks output matches what you see in the AWS Console and on invoices.

Cost Optimization & Business Scenarios¶

PDCA Automation Options¶

🔄 Migration Guide: Legacy to Standardized Parameters ✅¶

Since we still haven't passed my manager's quality gate, our runbooks's finops haven't reached enterprise-grade production readiness, therefore I decided to deduct Legacy from our deliverables, and we're starting from scratch. 1. ONLY Keep NEW Standardized Parameters: (--profile by default) | New Parameter | Purpose | Use Case | |------------------|-------------|--------------| | --profile | ONLY 1 Single AWS profile for targeted analysis | Individual account cost analysis | | --profiles | ✅ | Keep --profiles for filtered/selected accounts [$BILLING_PROFILE, $TEST_PROFILE] | | --all-profile | Multi-account Landing Zone operations | Organization-wide cost optimization | 2. Simplfy Multi-Account Landing Zone Operations by Depreciated & remove --all --> Migrate to --all-profile for multi-account 3. Depreciated & remove --combine --> Migrate to --profiles for filtered/selected accounts

📚 CLI Export Format Quick Reference¶

Convenience Flags (User Friendly) ✅¶

export MY_AWS_PROFILE=$BILLING_PROFILE
# Single command export formats - UPDATED WITH NEW STANDARDIZED PARAMETERS
runbooks finops --profile $MY_AWS_PROFILE --csv   # CSV export
runbooks finops --profile $MY_AWS_PROFILE --json  # JSON export
runbooks finops --profile $MY_AWS_PROFILE --pdf   # PDF export
runbooks finops --profile $MY_AWS_PROFILE --csv --markdown --json --pdf

# Multi-account Landing Zone exports - NEW PARAMETER
runbooks finops --all-profile $MANAGEMENT_PROFILE --csv --markdown --json --pdf

# With report naming
runbooks finops --profile $MY_AWS_PROFILE --csv --report-name "monthly-costs"
runbooks finops --profile $MY_AWS_PROFILE --json --report-name "cost-analysis"

Original Method (Still Supported) ✅¶

export MY_AWS_PROFILE=$BILLING_PROFILE
# Verbose but explicit format specification - UPDATED PARAMETERS
runbooks finops --profile $MY_AWS_PROFILE --report-type csv
runbooks finops --profile $MY_AWS_PROFILE --report-type json
runbooks finops --profile $MY_AWS_PROFILE --report-type pdf
runbooks finops --profile $MY_AWS_PROFILE --report-type markdown

# Multi-account Landing Zone reporting - NEW PARAMETER
runbooks finops --all-profile $MANAGEMENT_PROFILE --report-type csv
runbooks finops --all-profile $MANAGEMENT_PROFILE --report-type json

Multi-Account Analysis ✅¶

# Multiple specific profiles - LEGACY (still supported)
runbooks finops --profiles $BILLING_PROFILE $TEST_PROFILE --combine

# Organization-wide analysis (61 accounts) - NEW vs LEGACY
runbooks finops --all-profile $MANAGEMENT_PROFILE    # NEW: Multi-account Landing Zone
runbooks finops --all --profile $BILLING_PROFILE     # LEGACY: Still supported

⚙️ Configuration Files & Automation¶

YAML Configuration Example¶

# .runbooks/finops-config.yaml
finops:
  profiles:
    billing: "aws-admin-Billing-ReadOnlyAccess"
    management: "aws-admin-ReadOnlyAccess"
    operations: "aws-centralised-ops-ReadOnlyAccess"

  default_settings:
    time_range: 30
    high_cost_threshold: 5000.0
    medium_cost_threshold: 1000.0
    enable_mcp_validation: true
    dual_metrics: true

  export_formats:
    default: ["csv", "json"]
    executive: ["pdf", "html"]
    technical: ["json", "markdown"]

  cost_optimization:
    target_reduction: 25.0
    analyze_trends: true
    include_recommendations: true

# Usage with config file
runbooks finops --config .runbooks/finops-config.yaml

TOML Configuration Example¶

# pyproject.toml or .runbooks/config.toml
[tool.runbooks.finops]
default_profile = "aws-admin-Billing-ReadOnlyAccess"
time_range = 30
high_cost_threshold = 5000.0
enable_validation = true

[tool.runbooks.finops.profiles]
billing = "aws-admin-Billing-ReadOnlyAccess"
management = "aws-admin-ReadOnlyAccess"
operations = "aws-centralised-ops-ReadOnlyAccess"

[tool.runbooks.finops.export]
formats = ["csv", "json", "pdf"]
output_dir = "./exports/finops/"

Environment Variables Configuration¶

# Enterprise environment configuration
export RUNBOOKS_BILLING_PROFILE="aws-admin-Billing-ReadOnlyAccess"
export RUNBOOKS_MANAGEMENT_PROFILE="aws-admin-ReadOnlyAccess" 
export RUNBOOKS_OPERATIONS_PROFILE="aws-centralised-ops-ReadOnlyAccess"
export RUNBOOKS_HIGH_COST_THRESHOLD=5000
export RUNBOOKS_ENABLE_MCP_VALIDATION=true
export RUNBOOKS_DEFAULT_TIME_RANGE=30
export RUNBOOKS_EXPORT_DIR="./exports/finops/"

📊 Export Formats Reference¶

CSV Export Format¶

JSON Export Format¶

{
  "analysis_timestamp": "2025-01-12T10:30:00Z",
  "profile": "aws-admin-Billing-ReadOnlyAccess",
  "time_range": "2024-12-01 to 2024-12-31",
  "total_cost": 15234.67,
  "services": [
    {
      "service_name": "Amazon Elastic Compute Cloud - Compute",
      "current_cost": 1234.56,
      "previous_cost": 1100.45,
      "change_amount": 134.11,
      "change_percentage": 12.2,
      "optimization_opportunities": ["rightsizing", "reserved_instances"]
    }
  ],
  "mcp_validation": {
    "accuracy": 100.0,
    "validated_at": "2025-01-12T10:30:15Z",
    "discrepancies": []
  }
}

PDF Export Format¶

• Executive Summary: Key metrics and cost trends
• Service Breakdown: Detailed service-by-service analysis
• Optimization Recommendations: Cost reduction opportunities
• Charts & Visualizations: Cost trends and service distribution
• Compliance Documentation: Audit-ready reporting

Markdown Export Format¶

# Cost Analysis Report
**Profile**: aws-admin-Billing-ReadOnlyAccess
**Period**: December 2024
**Total Cost**: $15,234.67

## Service Breakdown
| Service | Current | Previous | Change |
|---------|---------|----------|--------|
| EC2-Instance | $1,234.56 | $1,100.45 | +12.2% |
| S3 | $567.89 | $545.32 | +4.1% |

## Optimization Opportunities
- **EC2 Rightsizing**: Potential cost reduction ($308.64/month)
- **S3 Lifecycle**: Storage optimization ($85.18/month)

🔐 AWS IAM Permissions Required¶

Billing Profile Permissions (Copy-Paste Ready)¶

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetUsageReport", 
        "ce:GetReservationCoverage",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetReservationUtilization",
        "ce:ListCostCategoryDefinitions",
        "ce:GetCostCategories",
        "ce:GetMetricValue",
        "organizations:ListAccounts",
        "organizations:DescribeOrganization",
        "budgets:ViewBudget",
        "support:DescribeTrustedAdvisorChecks"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow", 
      "Action": [
        "sts:GetCallerIdentity",
        "sts:AssumeRole"
      ],
      "Resource": "*"
    }
  ]
}

Management Profile Permissions¶

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts",
        "organizations:DescribeOrganization",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListChildren",
        "organizations:DescribeAccount",
        "organizations:ListAccountsForParent",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

Operational Profile Permissions¶

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "rds:Describe*",
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "s3:GetBucketNotification",
        "lambda:List*",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

💰 Copy-Paste CLI Examples (Real Profile Variables)¶

Quick Start Examples - UPDATED WITH STANDARDIZED PARAMETERS¶

## Set your environment variables (replace with your actual profiles)
export MY_AWS_PROFILE="aws-admin-Billing-ReadOnlyAccess"
export TEST_SRE_PROFILE="aws-shared-services-non-prod-ReadOnlyAccess"
export BILLING_PROFILE="aws-admin-Billing-ReadOnlyAccess"
export MANAGEMENT_PROFILE="aws-admin-ReadOnlyAccess"
export CENTRALISED_OPS_PROFILE="aws-centralised-ops-ReadOnlyAccess"

## Basic cost analysis - STANDARDIZED PARAMETER
runbooks finops --profile $MY_AWS_PROFILE

## Multi-format export - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --csv --json --pdf --report-name "monthly-analysis"

## Organization-wide analysis with trends - NEW vs LEGACY
runbooks finops --all-profile $MANAGEMENT_PROFILE --audit --trend --csv    ## NEW: Multi-account Landing Zone
runbooks finops --all --profile $BILLING_PROFILE --audit --trend --csv     ## LEGACY: Still supported

## MCP-validated analysis - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --validate --dual-metrics --audit

Advanced Multi-Account Examples - UPDATED WITH STANDARDIZED PARAMETERS¶

## Cross-account cost comparison - LEGACY (still supported)
runbooks finops --profiles $BILLING_PROFILE $TEST_SRE_PROFILE --combine --audit

## Multi-account Landing Zone analysis - NEW PARAMETER
runbooks finops --all-profile $MANAGEMENT_PROFILE --combine --audit

## Regional cost analysis - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --regions us-east-1,us-west-2,eu-west-1

## Cost allocation by tags - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --tag Environment=prod --tag Team=engineering

## Executive dashboard generation - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --audit --trend --pdf --report-name "executive-dashboard" --dir ./executive-reports/

Automation & CI/CD Examples - UPDATED WITH STANDARDIZED PARAMETERS¶

## Scheduled cost monitoring (for cron/automation) - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --json --report-name "daily-costs-$(date +%Y%m%d)" --high-cost-threshold 10000

## Multi-account scheduled monitoring - NEW PARAMETER
runbooks finops --all-profile $MANAGEMENT_PROFILE --json --report-name "org-costs-$(date +%Y%m%d)" --high-cost-threshold 50000

## Compliance reporting - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --audit --pdf --report-name "compliance-$(date +%Y-%m)" --validate

## Performance-optimized analysis - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --tech-focus --csv --max-services-text 20

🚀 Quick Reference Card (Print/Bookmark)¶

Essential Commands (5-Minute Setup) - UPDATED WITH STANDARDIZED PARAMETERS¶

## 1. Verify AWS access - STANDARDIZED PARAMETER
aws sts get-caller-identity --profile your-billing-profile

## 2. Basic cost dashboard - STANDARDIZED PARAMETER
runbooks finops --profile your-billing-profile

## 3. Export reports for management - STANDARDIZED PARAMETER
runbooks finops --profile your-billing-profile --csv --json --pdf

## 4. Multi-account analysis - NEW vs LEGACY
runbooks finops --all-profile your-management-profile --audit    ## NEW: Multi-account Landing Zone
runbooks finops --all --profile your-billing-profile --audit     ## LEGACY: Still supported

## 5. Validated high-accuracy analysis - STANDARDIZED PARAMETER
runbooks finops --profile your-billing-profile --validate --audit --trend

Required IAM Permissions (minimum)¶

• ce:GetCostAndUsage (Cost Explorer access)
• organizations:ListAccounts (Multi-account visibility)
• sts:GetCallerIdentity (Profile validation)

Common Profile Variables¶

export BILLING_PROFILE="your-consolidated-billing-profile"
export MANAGEMENT_PROFILE="your-management-account-profile" 
export SINGLE_AWS_PROFILE="your-single-account-profile"

Typical Outputs¶

• CSV: Service costs, trends, optimization opportunities
• JSON: Structured data for automation/integration
• PDF: Executive reports with charts and analysis
• Console: Interactive Rich CLI with real-time insights

💸 Cost Transparency & AWS API Pricing¶

AWS API Costs Per Operation¶

FinOps cost analysis operations incur minimal AWS costs:

Total Monthly Cost: ~$0.50-$3.00 for regular enterprise usage

Cost-Benefit Analysis¶

• API Costs: $0.50-$3.00/month
• Typical Savings Identified: Measurable optimization opportunities identified per account
• ROI: Substantial return on investment through automation
• Break-even: First analysis typically pays for 6-12 months of API costs

Usage Optimization Tips¶

## Minimize API calls - use cached data when possible
runbooks finops --profile $BILLING_PROFILE --time-range 30  ## vs daily calls

## Batch operations for multiple accounts
runbooks finops --all --profile $BILLING_PROFILE  ## vs individual profile calls

## Use appropriate time ranges
runbooks finops --profile $BILLING_PROFILE --time-range 7   ## Weekly analysis
runbooks finops --profile $BILLING_PROFILE --time-range 30  ## Monthly analysis
runbooks finops --profile $BILLING_PROFILE --time-range 90  ## Quarterly analysis

🛠️ Quick Troubleshooting¶

## Authentication issues
aws sts get-caller-identity --profile $BILLING_PROFILE
aws sso login --profile $BILLING_PROFILE

## Performance optimization
runbooks finops --profile $BILLING_PROFILE --time-range 7  ## Faster analysis
runbooks finops --profile $BILLING_PROFILE --regions us-east-1  ## Specific regions

Common Issues: IAM permissions (ce:GetCostAndUsage required) | Profile configuration (aws configure sso) | Performance optimization (reduce time-range)

💰 Enterprise Business Value & ROI Analysis¶

Combined Business Intelligence: $630K+ Annual Value + $79,922+ AWSO Savings Identified

Validated Business Scenarios with Quantified Savings¶

Enterprise Performance Benchmarks¶

• Single Account: Sub-minute execution
• Multi-Account: Efficient processing for 60+ accounts
• Export Generation: Fast multi-format output
• MCP Validation: Cross-validated vs AWS Cost Explorer API
• Memory Usage: <500MB enterprise-scale operations

Strategic Business Applications¶

• C-Suite: Monthly board reporting with PDF executive summaries
• FinOps Teams: Daily multi-account cost monitoring and optimization
• Technical Teams: DevOps automation with cost impact analysis
• Compliance: Automated audit documentation for regulatory requirements

Ready-to-Execute High ROI Commands - UPDATED WITH STANDARDIZED PARAMETERS¶

## Immediate value: NAT Gateway analysis - STANDARDIZED PARAMETER
runbooks finops --optimize-nat-gateways --profile $BILLING_PROFILE --audit

## Multi-account NAT Gateway optimization - NEW PARAMETER
runbooks finops --optimize-nat-gateways --all-profile $MANAGEMENT_PROFILE --audit

## RDS snapshot cleanup analysis (validated savings) - STANDARDIZED PARAMETER
runbooks operate rds --snapshots --analysis manual --profile $CENTRALISED_OPS_PROFILE

## Executive reporting with quantified opportunities - STANDARDIZED PARAMETER
runbooks finops --profile $BILLING_PROFILE --audit --trend --pdf --csv

Strategic Priority: WorkSpaces integration development required for highest ROI opportunity ($12,518).

📚 Essential Documentation¶

• Business Case Analysis - Manager's quantified AWSO opportunities ($79,922+)
• Technical Implementation - Deep-dive technical details
• VPC Integration - Network cost optimization patterns
• Security Integration - Compliance cost considerations
• Performance Reports - Validation evidence

Contributing¶

We welcome contributions! Please see our Contributing Guide for details on: - Adding new cost analysis capabilities - Contributing optimization algorithms - Enhancing executive reporting features - Following our enterprise development practices

License¶

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

🗺️ Architecture (high level)¶

flowchart LR
  subgraph Observe
    CUR[(AWS CUR)]
    CAD[Cost Anomaly Detection]
    Telemetry[APM/SLOs]
  end
  subgraph Decide
    CO[Compute Optimizer]
    Recs[Rightsizing & Commit Ladders]
    NetPath[NAT/Endpoint Plans]
    Karpenter[Karpenter Consolidation]
  end
  subgraph Act
    RunbooksCLI[runbooks CLI]
    TF[Terraform]
    SSM[AWS SSM Automation]
  end
  subgraph Audit
    PRs[PRs & Change Windows]
    Drift[Drift Watch]
    KPIs[Unit Economics & Coverage]
  end
  MCP[AWS MCP Servers]
  PlaywrightMCP[Playwright MCP]
  Agent[Claude-Code / Amazon Q CLI]

  CUR --> Agent
  CAD --> Agent
  Telemetry --> Agent
  Agent --> MCP
  Agent --> PlaywrightMCP
  Agent --> Decide
  Decide --> Act
  Act --> Audit

Why this matters

• Anomaly-first triage (AWS Cost Anomaly Detection) + native rightsizing (Cost Explorer / Compute Optimizer) keeps actions explainable and safe. (Amazon Web Services, Inc.)
• NAT/egress is tamed using Gateway Endpoints (S3/DynamoDB) and targeted PrivateLink — a classic high-leverage save. (AWS Documentation)
• EKS is tuned with Karpenter consolidation for steady waste reduction. (Karpenter)
• MCP servers expose AWS resources safely to agents; Playwright MCP enables UI smoke/UAT without bespoke glue. (Amazon Web Services, Inc.)

✅ Feature Matrix¶

🚀 Quickstart¶

2) Wire MCP servers (examples)¶

• AWS MCP (Billing/Cost & EKS) for agent access to spend and clusters.
• Playwright MCP for console/UIs (browser automation & accessibility snapshots).

# mcp_servers.yaml (example manifest)
servers:
  aws-billing:
    type: mcp
    endpoint: https://mcp.aws/billing
    auth: { method: "env", vars: ["AWS_PROFILE"] }
  aws-eks:
    type: mcp
    endpoint: https://mcp.aws/eks
    auth: { method: "env", vars: ["AWS_PROFILE"] }
  playwright:
    type: mcp
    endpoint: http://localhost:3333
    args: ["--headless"]

Connect this manifest from your agent client (Claude-Code, Amazon Q CLI, Cursor/Windsurf) to expose tools safely.

3) Initialize FinOps¶

## Billing lake & anomaly monitors
runbooks finops bootstrap --payer-profile billing
runbooks finops enable-anomaly-detection --notify sns://finops-alerts

(Uses AWS Cost Anomaly Detection to learn baselines & alert on spend spikes.)

4) First savings (safe previews)¶

## NAT/egress plan (no changes): expect gateway endpoints proposals (S3/DynamoDB)
runbooks vpc optimize-nat --all-accounts --plan

## Compute rightsizing preview: EC2/ASG recommendations
runbooks finops rightsize --sources compute-optimizer,cost-explorer --dry-run

## EKS consolidation: show which nodes can be safely merged
runbooks eks consolidate --cluster prod-eks --dry-run

• NAT/endpoint design aligns to Well-Architected guidance (Gateway endpoints free; PrivateLink adds hourly/GB cost).
• Rightsizing sources use Cost Explorer/Compute Optimizer methods.
• Karpenter consolidation removes under-utilized nodes predictably.

5) Apply with gates (change windows)¶

## Small batches; PR-gated; with rollback and SLO/security checks
runbooks vpc optimize-nat --execute --change-window "Sat 22:00-23:00"
runbooks finops commit-ladder --target-coverage 75 --ladder "1yr compute + 3yr steady"
runbooks eks consolidate --cluster prod-eks --execute --canary 10%

🧭 Scenario Catalog → Runbooks Mapping¶

The DevOpsCommunity scenarios document real-world spikes & fixes: idle load-test farms, orphaned EBS/snapshots, uncompressed S3 logs, mis-scaled ASGs; plus shell & Terraform examples for cleanup, tagging enforcement, lifecycle policies.

The scenario set also covers tag enforcement, ASG mixed-instances policies, S3 lifecycle, DynamoDB autoscaling, and NAT cleanup, which we codify into the runbooks above. (interview.devopscommunity.in)

🤖 AI Agents (Agile SDLC)¶

Squad Roster (RACI-style):

• SpendSense (Observe) — reads CUR & Cost Anomaly Detection, raises incidents with top-drivers. (Amazon Web Services, Inc.)
• RightSizer (Decide) — merges Compute Optimizer + Cost Explorer rightsizing into a plan file w/ savings & perf risk. (AWS Documentation)
• NetPath (Decide) — proposes Gateway Endpoints / PrivateLink placements to minimize NAT & egress. (AWS Documentation)
• KarpenterOps (Decide) — computes consolidation actions & PDB-safe drain plans. (Karpenter)
• CommitPlanner (Decide) — Savings Plans/RI laddering for baseline/steady state. (Uses Cost Explorer + forecast from CUR.) (AWS Documentation)
• ExecGuard (Act) — executes runbooks in approved windows; auto-rollback if error-budget burn worsens.
• PolicyGate (Audit) — SCP/tag conformance; drift watch; PR approvals. (interview.devopscommunity.in)
• UATBot (QA) — Playwright MCP browser checks (console/UI smoke) before/after changes. (GitHub)

Sprint cadence:

• Weekly: anomaly triage → plan → micro-batches → post-change KPI export.
• Monthly: commitment rebalancing (coverage/utilization), EKS consolidation review.
• Quarterly: Well-Architected Cost pillar review, NAT/endpoint topology re-assessment.

🧰 Runbooks CLI (examples)¶

# Orphan detection (EBS snapshots, stopped >7d, unassoc EIPs)
runbooks finops detect-orphans --profile $AWS_PROFILE

# NAT/Endpoint plan (AZ-local, S3/DDB gateway endpoints, PL decisions)
runbooks vpc optimize-nat --all-accounts --plan

# Rightsizing (combine CO + CE recommendations)
runbooks finops rightsize --lookback 14d --risk low --approve-threshold 70

# Commit ladder (blended 1-yr compute + 3-yr steady)
runbooks finops commit-ladder --target-coverage 70:80

# EKS consolidation (Karpenter)
runbooks eks consolidate --cluster prod-eks --pdb-aware --canary 10%

🔐 Safety & Governance¶

• Pre-checks: latency P95/P99, error-budget burn, KMS/encryption required, IAM least-privilege diff, AZ locality for endpoints.
• Controls: SCPs deny untagged creates; required tags for Owner/CostCenter/Environment/Project; lifecycle rules on S3 & EBS. (Patterns mirror scenario IAM/tag policies.)
• Change management: PRs with change windows; automatic rollback if SLOs degrade; audit trail + drift alarms.

📊 KPIs (Exec & Engineering)¶

🧪 CI/CD + MCP hooks¶

GitHub Actions (skeleton):

name: finops-weekly
on:
  schedule: [{cron: "0 21 * * 5"}]  # Fri 21:00 UTC
jobs:
  nat_and_rightsize_plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install "runbooks>=1.1.4"
      - run: runbooks finops rightsize --dry-run --out plan/rightsizing.json
      - run: runbooks vpc optimize-nat --plan --out plan/nat.json
      - run: git add plan && git commit -m "weekly finops plans" && git push
  eks_consolidation:
    runs-on: ubuntu-latest
    steps:
      - run: runbooks eks consolidate --cluster prod-eks --dry-run --out plan/eks.json

Agent UAT (Playwright MCP):

• Post-plan, UATBot executes login/console sanity flows and dashboards checks (e.g., billing console pages, EKS nodes views) to ensure no regressions.

🔄 How this aligns with the DevOpsCommunity scenarios¶

• We keep their clear incident narratives (e.g., idle GPU labs, orphaned volumes, NAT gateways, mis-scaled ASGs) and practical fix patterns (bash/Terraform, tag enforcement, lifecycle).
• We add an agentic loop + MCP integration so findings → changes are continuous and governed, not one-offs.

🤝 Contributing¶

• Add a scenario with: What Happened → Diagnosis → Root Cause → Fix/Workaround → Governance → Runbook.
• Include pre-checks (SLO/security) & post-checks (KPIs, anomaly delta).
• PRs require: plan artifacts + UATBot run + rollback notes.

🧭 Roadmap¶

• FinOps + AI MCP pack: pre-built tools for commitment ladders, NAT topology diffs, S3 tiering, Karpenter health.
• Multi-cloud adapters (Azure Advisor/GCP Recommender) normalized into the agent loop.
• Executive dashboards for unit economics & error-budget overlays.

1. Detect with Anomaly Detection → 2) Decide with native recommenders → 3) Execute via runbooks (gated) → 4) Audit via PRs/KPIs — all agent-operated over MCP with Playwright sanity checks. This is how we turn ad-hoc cost firefighting into durable, safe, autonomous FinOps.