argus-cloud-optimizer 0.6.1__tar.gz → 0.7.0__tar.gz

{argus_cloud_optimizer-0.6.1/argus_cloud_optimizer.egg-info → argus_cloud_optimizer-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argus-cloud-optimizer
-Version: 0.6.1
+Version: 0.7.0
 Summary: Argus — AI Cloud Detective for AWS, GCP, and Azure
 Author-email: Vamshi Siddarth Gaddam <vamshisiddarth02@gmail.com>
 License-Expression: MIT
@@ -19,7 +19,7 @@ Classifier: Topic :: System :: Systems Administration
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: anthropic>=0.40.0
+Requires-Dist: anthropic<3,>=0.40.0
 Requires-Dist: python-dotenv>=1.0.1
 Requires-Dist: PyYAML>=6.0.2
 Requires-Dist: pydantic>=2.9.2
@@ -40,7 +40,6 @@ Requires-Dist: azure-mgmt-costmanagement>=4.0.0
 Requires-Dist: azure-keyvault-secrets>=4.8.0
 Requires-Dist: openai>=1.55.0
 Provides-Extra: export
-Requires-Dist: weasyprint>=62.0; extra == "export"
 Requires-Dist: python-pptx>=1.0.0; extra == "export"
 Provides-Extra: chat
 Requires-Dist: rich>=13.0.0; extra == "chat"
@@ -101,16 +100,27 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.6.0
+## What's new in v0.7.0
 
-> **Breaking:** scheduled scans now create Jira tickets only when `REMEDIATION_ENABLED=true` (default `false`). If you ran v0.5.0 with Jira configured, set it to keep tickets flowing. `argus policies apply --confirm` is unaffected.
+> **A trust release.** Argus now says what it covered, fails loudly when it cannot do its job, and never presents a guess as a bill.
+
+> **Breaking:** the decision board is now the only HTML report, and PDF export is removed. Scans, local saves and the S3 / GCS / Azure Blob upload write the board, and the Slack "Full report" link opens it. `REPORT_FORMAT=pdf` writes nothing. The JSON report is the stable interface. Exit code 3 and 4 now signal a failed scan or failed preflight.
 
-- **Dry runs never touch Jira** — `DRY_RUN=true` / `--dry-run` previously still created real tickets when Jira was configured.
-- **One summary log line per remediation run**, with `error_type` on failures.
-- **`ARGUS_POLICY_DIR`** is read by both the CLI and scheduled scans (`ARGUS_POLICIES_DIR` still accepted).
+- **Honest money.** Every dollar is labelled billed, list price or model estimate. With no billed data the headline reads "unverified waste estimate" and says it is not a savings figure. Model estimates are not invoices; billed numbers need resource-level data in the payer account's Cost Explorer settings.
+- **Coverage and preflight.** Reports state resources discovered vs analysed, regions, the real metrics window and what could not be seen. AWS preflight checks Resource Explorer, tags and the scan role before any model spend.
+- **Fewer false alarms.** A missing metric is "could not judge", not idle: NAT gateways, load balancers and similar resources with no traffic data are withheld from the waste total. ElastiCache failover replicas and AMI-backed or retained snapshots are not recommended for deletion.
+- **Decision board.** Findings group into a short list of opportunities with savings ranges, evidence and check-first steps. `argus board --report FILE.json --client-safe` writes a redacted copy to show a client (read it before sending).
+- **Cost control.** Plan line and estimate before the model runs, strict stop before overspend, scan progress on stderr.
+- **Depth differs by cloud.** AWS is the proven path. GCP and Azure run the same pipeline but have no state rules, preflight or tag fallback yet.
 
 [Full changelog →](CHANGELOG.md) · [Project status →](docs/roadmap.md)
 
+### v0.6.0
+
+> **Breaking:** scheduled scans now create Jira tickets only when `REMEDIATION_ENABLED=true` (default `false`). If you ran v0.5.0 with Jira configured, set it to keep tickets flowing. `argus policies apply --confirm` is unaffected.
+
+- **Dry runs never touch Jira**, **one summary log line per remediation run**, and **`ARGUS_POLICY_DIR`** is read by the CLI and scheduled scans.
+
 ### v0.5.0
 
 > **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
@@ -120,7 +130,7 @@ Top findings
 - **Rightsizing recommendations** — `resize` and `reduce_nodes` proposals now include a specific target tier or node count derived from observed CPU% (e.g., "Recommend db.t3.small — observed CPU ~8%").
 - **Acceptance rate monitoring** — `argus policies stats` reads the append-only audit log and prints per-policy proposal counts, Jira new/update splits, and cloud breakdown.
 - **JSONL audit log** — every `apply --confirm` appends a line to `local_reports/audit.jsonl` mapping `proposal_id → jira_key → jira_url`.
-- **1756 tests** — all pass offline, no cloud credentials needed.
+- **2,700+ tests** — all pass offline, no cloud credentials needed.
 
 [Full changelog →](CHANGELOG.md)
 
@@ -133,9 +143,11 @@ Every week (or on demand), Argus:
 1. **Discovers** every resource in your cloud account using AWS Resource Explorer / GCP Asset Inventory / Azure Resource Graph
 2. **Analyzes** each candidate — CloudWatch/Cloud Monitoring/Azure Monitor metrics, Cost Explorer/BigQuery/Cost Management cost data, and CloudTrail/Audit Log/Activity Log last-activity timestamps
 3. **Reasons** about idleness using Claude (via AWS Bedrock, Anthropic API, or Vertex AI) — no hardcoded thresholds
-4. **Reports** a compact digest (Slack, Microsoft Teams, or generic webhook) with top findings and a link to a full self-contained HTML report
+4. **Reports** a compact digest (Slack, Microsoft Teams, or generic webhook) with top findings and a link to the full decision board (a self-contained HTML page)
 
-The **Full report** button links to a self-contained HTML file (S3 / GCS / Azure Blob) with a filterable/sortable table and expandable AI reasoning per finding. Works offline, no login required.
+The **Full report** button links to the decision board, a self-contained HTML file (S3 / GCS / Azure Blob) that groups findings into opportunities with savings ranges, evidence, check-first steps and Approve / Investigate / Keep. Works offline, no login required.
+
+To decide what to do about the findings, `argus board --report <scan>.json` builds a single offline page that groups them into a short list of opportunities, with savings ranges, risk and check-first steps, and Approve / Investigate / Keep buttons. See [`examples/sample-board.html`](examples/sample-board.html) and the [Decision board](docs/concepts/board-report.md) page.
 
 > **See realistic examples:** [`sample-report-aws.json`](examples/sample-report-aws.json) · [`sample-report-gcp.json`](examples/sample-report-gcp.json) · [`sample-report-azure.json`](examples/sample-report-azure.json) — 5 findings each with AI-written reasoning, metrics, and cost data.
 
@@ -253,7 +265,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.6.0
+argus --version   # argus 0.7.0
 argus --help
 ```
 
@@ -318,7 +330,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.6.0 — AI Cloud Detective
+Argus v0.7.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.
@@ -370,6 +382,7 @@ Available REPL commands: `/help`, `/scan`, `/cost`, `/clear`, `/summary`, `/quit
 ```
 argus scan [--cloud aws|gcp|azure] [options]    # full batch scan
 argus chat [--cloud aws|gcp|azure] [options]    # interactive Q&A
+argus board --report FILE.json [--out PATH]     # static decision board page (no cloud access)
 argus --run-now --cloud aws [options]           # backward compat
 
   --cloud CLOUD              Cloud provider (auto-detected from env vars if omitted)
@@ -378,11 +391,39 @@ argus --run-now --cloud aws [options]           # backward compat
   --ignore-regions REGIONS   Comma-separated regions to skip (e.g. ap-east-1,me-south-1)
   --ai-provider PROVIDER     anthropic | bedrock | vertexai | azure_openai (default: anthropic)
   --accounts PATH            Path to accounts.yaml for multi-account/project/subscription mode
-  --max-resources N          Maximum resources to analyze per scan (default: 200)
-  --lookback-days DAYS       Metrics lookback window in days (default: 90, use 14 for faster local dev)
+  --max-resources N          Maximum resources to analyze per scan (default: scaled from --llm-budget, 300 at $2.00)
+  --lookback-days DAYS       Metrics lookback window in days, applied to every metrics query and shown in the report (default: 90, use 14 for faster local dev)
   --llm-budget USD           Cost budget per scan/session (default: $2.00 scan, $1.00 chat)
+  --cost-days DAYS           Per-resource cost window in days (default: 14, the most AWS holds)
+  --activity-days DAYS       Last-activity (CloudTrail) window in days (default: 90, the most CloudTrail holds)
+  --expect-account ID        Abort (exit 4) unless the AWS credentials belong to this account
+  --strict-coverage          Fail (exit 1) if the cap or a search limit leaves resources unanalysed
+  --skip-preflight           Skip the AWS pre-scan environment checks (recorded in the report)
+  --no-progress              Do not show scan progress on stderr (also ARGUS_PROGRESS=off)
 ```
 
+### Scan progress
+
+`argus scan` reports its stages on stderr while it runs, so a long scan never looks hung. In a terminal it is one live line that updates in place, and log lines scroll above it. In a log file or a background task it is plain, throttled lines:
+
+```text
+[1/5] Discovering resources: 35 searches
+[1/5] Discovering resources: 18/35 (51%) 00:18 elapsed, about 00:17 left, region eu-central-1
+[1/5] Discovering resources: 127/211 (60%) 01:00 elapsed, about 00:40 left, eu-central-1 / lambda
+[1/5] Discovering resources: done, 211 searches in 01:28, 1,420 resources found
+[2/5] Applying rules: done in 00:09, 83 findings from rules
+[3/5] Collecting evidence: 1,337 resources
+[3/5] Collecting evidence: 340/1,337 (25%) 01:12 elapsed, about 03:36 left
+[3/5] Collecting evidence: done, 1,337 resources in 04:51
+LLM plan: 1254 residual candidates after rules (83). Budget covers all of them (estimated $1.13).
+[4/5] Reviewing with the model: 26 batches
+[4/5] Reviewing with the model: done, 26 batches in 06:30, $1.38 of $2.00
+[5/5] Building reports: done in 00:02
+Total time 12:14
+```
+
+Discovery counts its Resource Explorer searches. When a region returns the 1,000-result limit it is split by service, and those searches are added to the total, so the count can grow while it runs; the percentage always means "of the work known so far". stdout stays the JSON result, so `argus scan | jq` still works. Turn it off with `--no-progress` or `ARGUS_PROGRESS=off`; `ARGUS_PROGRESS=plain` forces the line output even in a terminal. Lambda, Cloud Run and Azure Function runs never show it.
+
 ---
 
 ## Deploy to AWS Lambda
@@ -539,6 +580,10 @@ Argus needs **read-only** access. The Lambda execution role requires:
 ```
 resource-explorer-2:Search
 resource-explorer-2:GetView
+resource-explorer-2:GetDefaultView
+resource-explorer-2:ListViews
+resource-explorer-2:ListIndexes
+resource-explorer-2:GetIndex
 cloudwatch:GetMetricData
 ce:GetCostAndUsage
 ce:GetCostAndUsageWithResources
@@ -616,7 +661,7 @@ Before you invest time deploying Argus, know what it **can't** do yet:
 | **Resource discovery** | All three strong | AWS covers 43 resource types via Resource Explorer. GCP covers 31 asset types via Asset Inventory. Azure discovers all types via Resource Graph with 40 having curated metric mappings. All three fall back to dynamic metric auto-discovery for unmapped types. AWS has the deepest per-type metric coverage; GCP and Azure are catching up. |
 | **Cost accuracy** | Best-effort | AWS Cost Explorer charges $0.01/API call — Argus batches aggressively (max 2 calls/scan). GCP requires BigQuery billing export enabled. Azure cost data depends on subscription-level access. Resource-level cost allocation must be enabled in AWS for per-resource costs; without it, costs show $0.00. |
 | **AI non-determinism** | By design | The AI decides what's idle — different runs may produce slightly different findings or reasoning. Set `AI_TEMPERATURE=0.0` (default) for most consistent results. |
-| **LLM cost** | Configurable | A full scan of ~200 resources costs ~$0.05–$0.50 in LLM API fees depending on provider. Use `--llm-budget` to set a hard cap (default: $2.00/scan). Large estates (1000+ resources) will hit the budget limit — increase it or use `--max-resources`. |
+| **LLM cost** | Configurable | One measured run on 1,614 resources cost about $1.4 to $1.55 (Bedrock, Sonnet-class), roughly $0.85 per 1,000 resources; your figure varies. Use `--llm-budget` to set a hard cap (default: $2.00/scan, about 300 resources). The plan line shows what fits before any model call; raise the budget for larger estates. |
 | **AWS Resource Explorer setup** | Manual step | You must enable Resource Explorer with an **aggregator index** (typically in `us-east-1`). Without this, Argus cannot discover resources. This is a one-time setup but is easy to miss. |
 | **Write actions** | None (by design) | Argus is strictly read-only. The policy engine generates Jira tickets with runbooks — a human reviews and executes. Argus never calls the runbook itself. |
 | **Multi-cloud in one scan** | Not yet | Each `argus` invocation scans one cloud. Use the merge report feature (`core/reports/multi_cloud.py`) to combine results after separate runs. |
@@ -686,7 +731,7 @@ argus/
 │   ├── aws/               # CloudFormation templates
 │   ├── gcp/               # Cloud Run + Scheduler deploy script
 │   └── azure/             # Bicep templates
-└── tests/                 # 1756 tests, all pass offline
+└── tests/                 # 2,700+ tests, all pass offline
 ```
 
 ---

{argus_cloud_optimizer-0.6.1 → argus_cloud_optimizer-0.7.0}/README.md

@@ -37,16 +37,27 @@ Top findings
 
 ---
 
-## 🆕 What's new in v0.6.0
+## What's new in v0.7.0
 
-> **Breaking:** scheduled scans now create Jira tickets only when `REMEDIATION_ENABLED=true` (default `false`). If you ran v0.5.0 with Jira configured, set it to keep tickets flowing. `argus policies apply --confirm` is unaffected.
+> **A trust release.** Argus now says what it covered, fails loudly when it cannot do its job, and never presents a guess as a bill.
+
+> **Breaking:** the decision board is now the only HTML report, and PDF export is removed. Scans, local saves and the S3 / GCS / Azure Blob upload write the board, and the Slack "Full report" link opens it. `REPORT_FORMAT=pdf` writes nothing. The JSON report is the stable interface. Exit code 3 and 4 now signal a failed scan or failed preflight.
 
-- **Dry runs never touch Jira** — `DRY_RUN=true` / `--dry-run` previously still created real tickets when Jira was configured.
-- **One summary log line per remediation run**, with `error_type` on failures.
-- **`ARGUS_POLICY_DIR`** is read by both the CLI and scheduled scans (`ARGUS_POLICIES_DIR` still accepted).
+- **Honest money.** Every dollar is labelled billed, list price or model estimate. With no billed data the headline reads "unverified waste estimate" and says it is not a savings figure. Model estimates are not invoices; billed numbers need resource-level data in the payer account's Cost Explorer settings.
+- **Coverage and preflight.** Reports state resources discovered vs analysed, regions, the real metrics window and what could not be seen. AWS preflight checks Resource Explorer, tags and the scan role before any model spend.
+- **Fewer false alarms.** A missing metric is "could not judge", not idle: NAT gateways, load balancers and similar resources with no traffic data are withheld from the waste total. ElastiCache failover replicas and AMI-backed or retained snapshots are not recommended for deletion.
+- **Decision board.** Findings group into a short list of opportunities with savings ranges, evidence and check-first steps. `argus board --report FILE.json --client-safe` writes a redacted copy to show a client (read it before sending).
+- **Cost control.** Plan line and estimate before the model runs, strict stop before overspend, scan progress on stderr.
+- **Depth differs by cloud.** AWS is the proven path. GCP and Azure run the same pipeline but have no state rules, preflight or tag fallback yet.
 
 [Full changelog →](CHANGELOG.md) · [Project status →](docs/roadmap.md)
 
+### v0.6.0
+
+> **Breaking:** scheduled scans now create Jira tickets only when `REMEDIATION_ENABLED=true` (default `false`). If you ran v0.5.0 with Jira configured, set it to keep tickets flowing. `argus policies apply --confirm` is unaffected.
+
+- **Dry runs never touch Jira**, **one summary log line per remediation run**, and **`ARGUS_POLICY_DIR`** is read by the CLI and scheduled scans.
+
 ### v0.5.0
 
 > **Remediation is now first-class.** Argus goes beyond reporting — it generates Jira tickets, suggests exact resize targets, and tracks acceptance rates.
@@ -56,7 +67,7 @@ Top findings
 - **Rightsizing recommendations** — `resize` and `reduce_nodes` proposals now include a specific target tier or node count derived from observed CPU% (e.g., "Recommend db.t3.small — observed CPU ~8%").
 - **Acceptance rate monitoring** — `argus policies stats` reads the append-only audit log and prints per-policy proposal counts, Jira new/update splits, and cloud breakdown.
 - **JSONL audit log** — every `apply --confirm` appends a line to `local_reports/audit.jsonl` mapping `proposal_id → jira_key → jira_url`.
-- **1756 tests** — all pass offline, no cloud credentials needed.
+- **2,700+ tests** — all pass offline, no cloud credentials needed.
 
 [Full changelog →](CHANGELOG.md)
 
@@ -69,9 +80,11 @@ Every week (or on demand), Argus:
 1. **Discovers** every resource in your cloud account using AWS Resource Explorer / GCP Asset Inventory / Azure Resource Graph
 2. **Analyzes** each candidate — CloudWatch/Cloud Monitoring/Azure Monitor metrics, Cost Explorer/BigQuery/Cost Management cost data, and CloudTrail/Audit Log/Activity Log last-activity timestamps
 3. **Reasons** about idleness using Claude (via AWS Bedrock, Anthropic API, or Vertex AI) — no hardcoded thresholds
-4. **Reports** a compact digest (Slack, Microsoft Teams, or generic webhook) with top findings and a link to a full self-contained HTML report
+4. **Reports** a compact digest (Slack, Microsoft Teams, or generic webhook) with top findings and a link to the full decision board (a self-contained HTML page)
 
-The **Full report** button links to a self-contained HTML file (S3 / GCS / Azure Blob) with a filterable/sortable table and expandable AI reasoning per finding. Works offline, no login required.
+The **Full report** button links to the decision board, a self-contained HTML file (S3 / GCS / Azure Blob) that groups findings into opportunities with savings ranges, evidence, check-first steps and Approve / Investigate / Keep. Works offline, no login required.
+
+To decide what to do about the findings, `argus board --report <scan>.json` builds a single offline page that groups them into a short list of opportunities, with savings ranges, risk and check-first steps, and Approve / Investigate / Keep buttons. See [`examples/sample-board.html`](examples/sample-board.html) and the [Decision board](docs/concepts/board-report.md) page.
 
 > **See realistic examples:** [`sample-report-aws.json`](examples/sample-report-aws.json) · [`sample-report-gcp.json`](examples/sample-report-gcp.json) · [`sample-report-azure.json`](examples/sample-report-azure.json) — 5 findings each with AI-written reasoning, metrics, and cost data.
 
@@ -189,7 +202,7 @@ docker run --rm \
 
 ```bash
 pip install argus-cloud-optimizer
-argus --version   # argus 0.6.0
+argus --version   # argus 0.7.0
 argus --help
 ```
 
@@ -254,7 +267,7 @@ argus chat                                       # auto-detects cloud
 ```
 
 ```
-Argus v0.6.0 — AI Cloud Detective
+Argus v0.7.0 — AI Cloud Detective
 Cloud: AWS  |  Accounts: prod (123456789012)  |  Budget: $1.00/session
 Tip: end a line with \ to continue on the next line.
 Type your question, or /help for commands.
@@ -306,6 +319,7 @@ Available REPL commands: `/help`, `/scan`, `/cost`, `/clear`, `/summary`, `/quit
 ```
 argus scan [--cloud aws|gcp|azure] [options]    # full batch scan
 argus chat [--cloud aws|gcp|azure] [options]    # interactive Q&A
+argus board --report FILE.json [--out PATH]     # static decision board page (no cloud access)
 argus --run-now --cloud aws [options]           # backward compat
 
   --cloud CLOUD              Cloud provider (auto-detected from env vars if omitted)
@@ -314,11 +328,39 @@ argus --run-now --cloud aws [options]           # backward compat
   --ignore-regions REGIONS   Comma-separated regions to skip (e.g. ap-east-1,me-south-1)
   --ai-provider PROVIDER     anthropic | bedrock | vertexai | azure_openai (default: anthropic)
   --accounts PATH            Path to accounts.yaml for multi-account/project/subscription mode
-  --max-resources N          Maximum resources to analyze per scan (default: 200)
-  --lookback-days DAYS       Metrics lookback window in days (default: 90, use 14 for faster local dev)
+  --max-resources N          Maximum resources to analyze per scan (default: scaled from --llm-budget, 300 at $2.00)
+  --lookback-days DAYS       Metrics lookback window in days, applied to every metrics query and shown in the report (default: 90, use 14 for faster local dev)
   --llm-budget USD           Cost budget per scan/session (default: $2.00 scan, $1.00 chat)
+  --cost-days DAYS           Per-resource cost window in days (default: 14, the most AWS holds)
+  --activity-days DAYS       Last-activity (CloudTrail) window in days (default: 90, the most CloudTrail holds)
+  --expect-account ID        Abort (exit 4) unless the AWS credentials belong to this account
+  --strict-coverage          Fail (exit 1) if the cap or a search limit leaves resources unanalysed
+  --skip-preflight           Skip the AWS pre-scan environment checks (recorded in the report)
+  --no-progress              Do not show scan progress on stderr (also ARGUS_PROGRESS=off)
 ```
 
+### Scan progress
+
+`argus scan` reports its stages on stderr while it runs, so a long scan never looks hung. In a terminal it is one live line that updates in place, and log lines scroll above it. In a log file or a background task it is plain, throttled lines:
+
+```text
+[1/5] Discovering resources: 35 searches
+[1/5] Discovering resources: 18/35 (51%) 00:18 elapsed, about 00:17 left, region eu-central-1
+[1/5] Discovering resources: 127/211 (60%) 01:00 elapsed, about 00:40 left, eu-central-1 / lambda
+[1/5] Discovering resources: done, 211 searches in 01:28, 1,420 resources found
+[2/5] Applying rules: done in 00:09, 83 findings from rules
+[3/5] Collecting evidence: 1,337 resources
+[3/5] Collecting evidence: 340/1,337 (25%) 01:12 elapsed, about 03:36 left
+[3/5] Collecting evidence: done, 1,337 resources in 04:51
+LLM plan: 1254 residual candidates after rules (83). Budget covers all of them (estimated $1.13).
+[4/5] Reviewing with the model: 26 batches
+[4/5] Reviewing with the model: done, 26 batches in 06:30, $1.38 of $2.00
+[5/5] Building reports: done in 00:02
+Total time 12:14
+```
+
+Discovery counts its Resource Explorer searches. When a region returns the 1,000-result limit it is split by service, and those searches are added to the total, so the count can grow while it runs; the percentage always means "of the work known so far". stdout stays the JSON result, so `argus scan | jq` still works. Turn it off with `--no-progress` or `ARGUS_PROGRESS=off`; `ARGUS_PROGRESS=plain` forces the line output even in a terminal. Lambda, Cloud Run and Azure Function runs never show it.
+
 ---
 
 ## Deploy to AWS Lambda
@@ -475,6 +517,10 @@ Argus needs **read-only** access. The Lambda execution role requires:
 ```
 resource-explorer-2:Search
 resource-explorer-2:GetView
+resource-explorer-2:GetDefaultView
+resource-explorer-2:ListViews
+resource-explorer-2:ListIndexes
+resource-explorer-2:GetIndex
 cloudwatch:GetMetricData
 ce:GetCostAndUsage
 ce:GetCostAndUsageWithResources
@@ -552,7 +598,7 @@ Before you invest time deploying Argus, know what it **can't** do yet:
 | **Resource discovery** | All three strong | AWS covers 43 resource types via Resource Explorer. GCP covers 31 asset types via Asset Inventory. Azure discovers all types via Resource Graph with 40 having curated metric mappings. All three fall back to dynamic metric auto-discovery for unmapped types. AWS has the deepest per-type metric coverage; GCP and Azure are catching up. |
 | **Cost accuracy** | Best-effort | AWS Cost Explorer charges $0.01/API call — Argus batches aggressively (max 2 calls/scan). GCP requires BigQuery billing export enabled. Azure cost data depends on subscription-level access. Resource-level cost allocation must be enabled in AWS for per-resource costs; without it, costs show $0.00. |
 | **AI non-determinism** | By design | The AI decides what's idle — different runs may produce slightly different findings or reasoning. Set `AI_TEMPERATURE=0.0` (default) for most consistent results. |
-| **LLM cost** | Configurable | A full scan of ~200 resources costs ~$0.05–$0.50 in LLM API fees depending on provider. Use `--llm-budget` to set a hard cap (default: $2.00/scan). Large estates (1000+ resources) will hit the budget limit — increase it or use `--max-resources`. |
+| **LLM cost** | Configurable | One measured run on 1,614 resources cost about $1.4 to $1.55 (Bedrock, Sonnet-class), roughly $0.85 per 1,000 resources; your figure varies. Use `--llm-budget` to set a hard cap (default: $2.00/scan, about 300 resources). The plan line shows what fits before any model call; raise the budget for larger estates. |
 | **AWS Resource Explorer setup** | Manual step | You must enable Resource Explorer with an **aggregator index** (typically in `us-east-1`). Without this, Argus cannot discover resources. This is a one-time setup but is easy to miss. |
 | **Write actions** | None (by design) | Argus is strictly read-only. The policy engine generates Jira tickets with runbooks — a human reviews and executes. Argus never calls the runbook itself. |
 | **Multi-cloud in one scan** | Not yet | Each `argus` invocation scans one cloud. Use the merge report feature (`core/reports/multi_cloud.py`) to combine results after separate runs. |
@@ -622,7 +668,7 @@ argus/
 │   ├── aws/               # CloudFormation templates
 │   ├── gcp/               # Cloud Run + Scheduler deploy script
 │   └── azure/             # Bicep templates
-└── tests/                 # 1756 tests, all pass offline
+└── tests/                 # 2,700+ tests, all pass offline
 ```
 
 ---

{argus_cloud_optimizer-0.6.1 → argus_cloud_optimizer-0.7.0}/adapters/aws/adapter.py

@@ -5,8 +5,19 @@ from datetime import datetime
 
 import boto3
 
-from adapters.aws import auth, cloudtrail, cloudwatch, cost_explorer, resource_explorer
+from adapters.aws import (
+    auth,
+    cloudtrail,
+    cloudwatch,
+    cost_explorer,
+    logs_activity,
+    resource_explorer,
+)
+from adapters.aws.preflight import run_preflight
+from adapters.aws.state import collect_state
+from adapters.aws.tags import fetch_tags
 from adapters.base import CloudAdapter, MetricSummary, Resource
+from core.models.preflight import PreflightResult
 
 
 class AWSAdapter(CloudAdapter):
@@ -20,24 +31,60 @@ class AWSAdapter(CloudAdapter):
         adapter = AWSAdapter(session)
     """
 
+    # GetCostAndUsageWithResources only holds the last 14 days
+    max_cost_days: int | None = 14
+
     def __init__(
         self,
         session: boto3.Session,
         aggregator_region: str | None = None,
     ) -> None:
         self._session = session
+        self.discovery_complete: bool | None = None
+        self.filtered_by_type: dict[str, int] = {}
+        # Where the tags came from: "resource_explorer", "tagging_api", "unavailable"
+        self.tags_source: str | None = None
         self._aggregator_region: str = (
             aggregator_region
             or os.environ.get("RESOURCE_EXPLORER_REGION")
             or "us-east-1"
         )
 
+    def preflight(self, account_id: str | None = None) -> PreflightResult:
+        """Read-only environment checks to run before spending any LLM budget."""
+        return run_preflight(self._session, self._aggregator_region, account_id)
+
     def list_resources(self, ignore_regions: list[str] | None = None) -> list[Resource]:
-        return resource_explorer.list_resources(
+        found = resource_explorer.discover(
             session=self._session,
             ignore_regions=ignore_regions,
             aggregator_region=self._aggregator_region,
         )
+        self.discovery_complete = found.complete
+        self.filtered_by_type = found.filtered_by_type
+        self._fill_missing_tags(found.resources)
+        return found.resources
+
+    def _fill_missing_tags(self, resources: list[Resource]) -> None:
+        """If Resource Explorer gave no tags at all, ask the Tagging API."""
+        if not resources:
+            return
+        if any(r.tags for r in resources):
+            self.tags_source = "resource_explorer"
+            return
+        fetched = fetch_tags(self._session, resources, self._aggregator_region)
+        if fetched is None:
+            self.tags_source = "unavailable"
+            return
+        self.tags_source = "tagging_api"
+        for r in resources:
+            tags = fetched.get(r.resource_id)
+            if tags:
+                r.tags = tags
+                r.name = r.name or tags.get("Name")
+
+    def collect_state(self, resources: list[Resource]) -> dict[str, dict]:
+        return collect_state(self._session, resources)
 
     def get_metrics(
         self,
@@ -68,6 +115,8 @@ class AWSAdapter(CloudAdapter):
         resource_id: str,
         resource_type: str,
     ) -> datetime | None:
+        if logs_activity.is_log_group(resource_type):
+            return logs_activity.get_last_event(self._session, resource_id)
         return cloudtrail.get_last_activity(
             session=self._session,
             resource_id=resource_id,

{argus_cloud_optimizer-0.6.1 → argus_cloud_optimizer-0.7.0}/adapters/aws/cloudtrail.py

@@ -8,6 +8,7 @@ from botocore.exceptions import ClientError
 
 from adapters.aws.config import BOTO_TIMEOUT_CONFIG
 from adapters.aws.retry import retry_on_transient
+from core.config import get_settings
 
 logger = structlog.get_logger(__name__)
 
@@ -21,7 +22,8 @@ def get_last_activity(
 ) -> datetime | None:
     """
     Return the timestamp of the most recent CloudTrail event for a resource.
-    Returns None if no activity was found in the last 90 days.
+    Returns None if no activity was found in the configured window (default 90
+    days, the most CloudTrail LookupEvents can see).
 
     Uses the resource name (extracted from ARN) as the lookup attribute
     since CloudTrail indexes by resource name, not full ARN.
@@ -33,7 +35,8 @@ def get_last_activity(
     )
 
     end_time = datetime.now(tz=timezone.utc)
-    start_time = end_time - timedelta(days=_LOOKBACK_DAYS)
+    window = min(get_settings().scan.activity_lookback_days, _LOOKBACK_DAYS)
+    start_time = end_time - timedelta(days=window)
 
     try:
         response = retry_on_transient(

{argus_cloud_optimizer-0.6.1 → argus_cloud_optimizer-0.7.0}/adapters/aws/cloudwatch.py

@@ -1,6 +1,9 @@
 from __future__ import annotations
 
 import os as _os
+import threading
+import weakref
+from collections.abc import Iterator
 from datetime import datetime, timedelta, timezone
 from typing import Any
 
@@ -291,7 +294,14 @@ def get_metrics(
     """
     metric_defs = _metrics_for(resource_type)
     if not metric_defs:
-        metric_defs = _discover_metrics(session, resource_id, resource_type)
+        try:
+            metric_defs = _discover_metrics(session, resource_id, resource_type)
+        except ClientError as exc:
+            logger.warning(
+                "cloudwatch_list_metrics_failed",
+                extra={"resource_id": resource_id, "error": str(exc)},
+            )
+            return _error_summary(resource_id, resource_type, days, exc)
     if not metric_defs:
         return MetricSummary(
             resource_id=resource_id,
@@ -339,13 +349,7 @@ def get_metrics(
             "cloudwatch_get_metric_data_failed",
             extra={"resource_id": resource_id, "error": str(exc)},
         )
-        return MetricSummary(
-            resource_id=resource_id,
-            resource_type=resource_type,
-            period_days=days,
-            metrics={},
-            has_data=False,
-        )
+        return _error_summary(resource_id, resource_type, days, exc)
 
     summary = _parse_results(
         results=response.get("MetricDataResults", []),
@@ -362,6 +366,21 @@ def get_metrics(
     return summary
 
 
+def _error_summary(
+    resource_id: str, resource_type: str, days: int, exc: ClientError
+) -> MetricSummary:
+    code = exc.response.get("Error", {}).get("Code", "ClientError")
+    return MetricSummary(
+        resource_id=resource_id,
+        resource_type=resource_type,
+        period_days=days,
+        metrics={},
+        has_data=False,
+        status="error",
+        error=f"{code}: {exc.response.get('Error', {}).get('Message', '')}".strip(),
+    )
+
+
 def _enrich_instance_details(
     session: boto3.Session,
     resource_id: str,
@@ -579,59 +598,90 @@ def _parse_results(
 _FALLBACK_METRIC_LIMIT = 5  # max metrics to auto-discover per unknown resource
 
 
+class _RegionListing:
+    """One region's ListMetrics result, fetched at most once per session."""
+
+    def __init__(self) -> None:
+        self.lock = threading.Lock()
+        self.done = False
+        self.index: dict[str, list[tuple[str, str, str]]] = {}
+        self.error: ClientError | None = None
+
+
+_LISTINGS: weakref.WeakKeyDictionary[Any, dict[str, _RegionListing]] = (
+    weakref.WeakKeyDictionary()
+)
+_LISTINGS_LOCK = threading.Lock()
+
+
+def _region_listing(session: boto3.Session, region: str) -> _RegionListing:
+    with _LISTINGS_LOCK:
+        per_session = _LISTINGS.setdefault(session, {})
+        listing = per_session.get(region)
+        if listing is None:
+            listing = per_session[region] = _RegionListing()
+    if listing.done:
+        return listing
+    with listing.lock:
+        if not listing.done:
+            client = session.client(
+                "cloudwatch", region_name=region, config=BOTO_TIMEOUT_CONFIG
+            )
+            try:
+                for page in _list_metrics_pages(client):
+                    for m in page.get("Metrics", []):
+                        for dim in m.get("Dimensions", []):
+                            listing.index.setdefault(dim.get("Value"), []).append(
+                                (m["MetricName"], m["Namespace"], dim["Name"])
+                            )
+            except ClientError as exc:
+                listing.index = {}
+                listing.error = exc
+            listing.done = True
+    return listing
+
+
+def _stat_for(metric_name: str) -> str:
+    # Sum for count/bytes-sounding names, Average otherwise.
+    counting = ("count", "bytes", "records", "invocations", "requests")
+    return "Sum" if any(kw in metric_name.lower() for kw in counting) else "Average"
+
+
 def _discover_metrics(
     session: boto3.Session,
     resource_id: str,
     resource_type: str,
 ) -> list[tuple[str, str, str, str]]:
     """
-    For resource types not in _METRICS, ask CloudWatch what metrics exist
-    for this resource and return up to _FALLBACK_METRIC_LIMIT definitions.
+    For resource types not in _METRICS, look up which metrics exist for this
+    resource in the region's metric list (fetched once per session and region)
+    and return up to _FALLBACK_METRIC_LIMIT definitions.
     Uses the ARN as a dimension value where possible.
+    Raises the ClientError that ended the listing, if it failed.
     """
-    region = _region_from_arn(resource_id)
-    client = session.client(
-        "cloudwatch", region_name=region, config=BOTO_TIMEOUT_CONFIG
-    )
+    listing = _region_listing(session, _region_from_arn(resource_id))
+    if listing.error is not None:
+        raise listing.error
 
-    # Try to find metrics that reference this resource by ARN or last-segment name.
     dim_value = _dimension_value(resource_id, resource_type)
-    discovered: list[tuple[str, str, str, str]] = []
+    keys = [resource_id] if dim_value == resource_id else [resource_id, dim_value]
+    found = [e for k in keys for e in listing.index.get(k, [])]
+    return [
+        (name, namespace, _stat_for(name), dim_key)
+        for name, namespace, dim_key in found[:_FALLBACK_METRIC_LIMIT]
+    ]
 
-    try:
-        paginator = client.get_paginator("list_metrics")
-        for page in paginator.paginate():
-            for m in page.get("Metrics", []):
-                for dim in m.get("Dimensions", []):
-                    if dim.get("Value") in (resource_id, dim_value):
-                        metric_name: str = m["MetricName"]
-                        namespace: str = m["Namespace"]
-                        dim_key: str = dim["Name"]
-                        # Use Sum for count/bytes-sounding names, Average otherwise.
-                        stat = (
-                            "Sum"
-                            if any(
-                                kw in metric_name.lower()
-                                for kw in (
-                                    "count",
-                                    "bytes",
-                                    "records",
-                                    "invocations",
-                                    "requests",
-                                )
-                            )
-                            else "Average"
-                        )
-                        discovered.append((metric_name, namespace, stat, dim_key))
-                        if len(discovered) >= _FALLBACK_METRIC_LIMIT:
-                            return discovered
-    except ClientError as exc:
-        logger.warning(
-            "cloudwatch_list_metrics_failed",
-            extra={"resource_id": resource_id, "error": str(exc)},
-        )
 
-    return discovered
+def _list_metrics_pages(client: Any) -> Iterator[dict[str, Any]]:
+    """Yield ListMetrics pages, retrying each call on throttling."""
+    kwargs: dict[str, Any] = {}
+    while True:
+        page = retry_on_transient(client.list_metrics, **kwargs)
+        yield page
+        token = page.get("NextToken")
+        if not token:
+            return
+        kwargs["NextToken"] = token
 
 
 def _region_from_arn(arn: str) -> str: