aws-cost-calculator-cli 1.3.0__py3-none-any.whl → 1.6.0__py3-none-any.whl

{aws_cost_calculator_cli-1.3.0.dist-info → aws_cost_calculator_cli-1.6.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-cost-calculator-cli
-Version: 1.3.0
+Version: 1.6.0
 Summary: AWS Cost Calculator CLI - Calculate daily and annual AWS costs across multiple accounts
 Home-page: https://github.com/yourusername/cost-calculator
 Author: Cost Optimization Team
@@ -23,6 +23,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.0.0
 Requires-Dist: boto3>=1.26.0
+Requires-Dist: requests>=2.28.0
 Dynamic: author
 Dynamic: classifier
 Dynamic: description
@@ -48,36 +49,51 @@ pip install -e .
 
 ## Quick Start
 
-### 1. Login to AWS SSO
+### Authentication Methods
 
+The CLI supports three authentication methods:
+
+#### 1. SSO (Recommended)
 ```bash
-aws sso login --profile my_aws_profile
+# The CLI will automatically trigger SSO login if needed
+cc calculate --profile khoros --sso khoros_umbrella
 ```
 
-**Note:** You need to do this before running cost calculations. The SSO session typically lasts 8-12 hours.
-
-### 2. Initialize a profile
+#### 2. Static Credentials
+```bash
+cc calculate --profile khoros \
+  --access-key-id ASIA3D3QOXPO6EBAPXVI \
+  --secret-access-key /9ijZEUoszN/S2A8IlCrHpW+1fMZ7aUb7fPvU0dL \
+  --session-token IQoJb3JpZ2luX2VjENr...
+```
 
+#### 3. Environment Variables
 ```bash
-cc init --profile myprofile \
-  --aws-profile my_aws_profile \
-  --accounts "123456789012,234567890123,345678901234"
+# For SSO
+export AWS_PROFILE=khoros_umbrella
+cc calculate --profile khoros
+
+# For static credentials
+export AWS_ACCESS_KEY_ID=ASIA...
+export AWS_SECRET_ACCESS_KEY=...
+export AWS_SESSION_TOKEN=...
+cc calculate --profile khoros
 ```
 
-### 3. Calculate costs
+### Basic Usage
 
 ```bash
 # Default: Today minus 2 days, going back 30 days
-cc calculate --profile myprofile
+cc calculate --profile khoros --sso khoros_umbrella
 
 # Specific start date
-cc calculate --profile myprofile --start-date 2025-11-04
+cc calculate --profile khoros --sso khoros_umbrella --start-date 2025-11-04
 
 # Custom offset and window
-cc calculate --profile myprofile --offset 2 --window 30
+cc calculate --profile khoros --sso khoros_umbrella --offset 2 --window 30
 
 # JSON output
-cc calculate --profile myprofile --json-output
+cc calculate --profile khoros --sso khoros_umbrella --json-output
 ```
 
 ### 4. Analyze cost trends
@@ -241,14 +257,17 @@ The `drill` command allows you to investigate cost changes at different levels o
 3. **Drill deeper:** `cc drill --service "EC2 - Other" --account 123` → See usage types
 
 **Features:**
-- **Automatic grouping**: Shows the next level of detail based on your filters
-  - No filters → Shows services
-  - Service only → Shows accounts using that service
-  - Account only → Shows services in that account
-  - Service + Account → Shows usage types
-- **Top 10 Increases/Decreases**: For each week comparison
-- **Total rows**: Sum of top 10 changes
-- **Filters**: Only shows changes >$10 and >5%
+- **Week-over-week cost analysis**: Compare costs between consecutive weeks
+- **Month-over-month cost analysis**: Compare costs between consecutive months
+- **Drill-down analysis**: Analyze costs by service, account, or usage type
+- **Pandas aggregations**: Time series analysis with sum, avg, std across all weeks
+- **Volatility detection**: Identify services with high cost variability and outliers
+- **Trend detection**: Auto-detect increasing/decreasing cost patterns
+- **Search & filter**: Find services by pattern or cost threshold
+- **Profile management**: CRUD operations for account profiles in DynamoDB
+- **Markdown reports**: Generate formatted reports
+- **JSON output**: Machine-readable output for automation
+- **Lambda API backend**: Serverless backend with pandas/numpy support
 
 Example output:
 ```

aws_cost_calculator_cli-1.6.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+aws_cost_calculator_cli-1.6.0.dist-info/licenses/LICENSE,sha256=cYtmQZHNGGTXOtg3T7LHDRneleaH0dHXHfxFV3WR50Y,1079
+cost_calculator/__init__.py,sha256=PJeIqvWh5AYJVrJxPPkI4pJnAt37rIjasrNS0I87kaM,52
+cost_calculator/api_client.py,sha256=LUzQmveDF0X9MqAyThp9mbSzJzkOO73Pk4F7IEJjASU,2353
+cost_calculator/cli.py,sha256=sJYvzbdHCxOEcCgOjZs4o9MOogV1Yh8r7x0hJtd__K0,38639
+cost_calculator/drill.py,sha256=hGi-prLgZDvNMMICQc4fl3LenM7YaZ3To_Ei4LKwrdc,10543
+cost_calculator/executor.py,sha256=tVyyBtXIj9OPyG-xQj8CUmyFjDhb9IVK639360dUZDc,8076
+cost_calculator/monthly.py,sha256=6k9F8S7djhX1wGV3-T1MZP7CvWbbfhSTEaddwCfVu5M,7932
+cost_calculator/trends.py,sha256=k_s4ylBX50sqoiM_fwepi58HW01zz767FMJhQUPDznk,12246
+aws_cost_calculator_cli-1.6.0.dist-info/METADATA,sha256=AaLbUH-anBc1lv2o2DpdJR3v0tSavhPtDo5Sjb7VsHA,8612
+aws_cost_calculator_cli-1.6.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+aws_cost_calculator_cli-1.6.0.dist-info/entry_points.txt,sha256=_5Qy4EcHbYVYrdgOu1E48faMHb9fLUl5VJ3djDHuJBo,47
+aws_cost_calculator_cli-1.6.0.dist-info/top_level.txt,sha256=PRwGPPlNqASfyhGHDjSfyl4SXeE7GF3OVTu1tY1Uqyc,16
+aws_cost_calculator_cli-1.6.0.dist-info/RECORD,,

{aws_cost_calculator_cli-1.3.0.dist-info → aws_cost_calculator_cli-1.6.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.7.1)
+Generator: setuptools (80.9.0)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

cost_calculator/api_client.py

@@ -0,0 +1,84 @@
+"""
+API client for calling Lambda backend.
+Falls back to local execution if API is not configured.
+"""
+import os
+import json
+import requests
+from pathlib import Path
+
+
+def get_api_config():
+    """
+    Get API configuration.
+    
+    Returns:
+        dict: API configuration with api_secret, or None if not configured
+    """
+    api_secret = os.environ.get('COST_API_SECRET', '')
+    
+    if api_secret:
+        return {'api_secret': api_secret}
+    
+    return None
+
+
+def call_lambda_api(endpoint, credentials, accounts, **kwargs):
+    """
+    Call Lambda API endpoint.
+    
+    Args:
+        endpoint: API endpoint name ('trends', 'monthly', 'drill')
+        credentials: dict with AWS credentials
+        accounts: list of account IDs
+        **kwargs: additional parameters for the specific endpoint
+    
+    Returns:
+        dict: API response data
+    
+    Raises:
+        Exception: if API call fails
+    """
+    api_config = get_api_config()
+    
+    if not api_config:
+        raise Exception("API not configured. Set COST_API_SECRET environment variable.")
+    
+    # Map endpoint names to Lambda URLs
+    endpoint_urls = {
+        'trends': 'https://pq3mqntc6vuwi4zw5flulsoleq0yiqtl.lambda-url.us-east-1.on.aws/',
+        'monthly': 'https://6aueebodw6q4zdeu3aaexb6tle0fqhhr.lambda-url.us-east-1.on.aws/',
+        'drill': 'https://3ncm2gzxrsyptrhud3ua3x5lju0akvsr.lambda-url.us-east-1.on.aws/',
+        'analyze': 'https://y6npmidtxwzg62nrqzkbacfs5q0edwgs.lambda-url.us-east-1.on.aws/',
+        'profiles': 'https://64g7jq7sjygec2zmll5lsghrpi0txrzo.lambda-url.us-east-1.on.aws/'
+    }
+    
+    url = endpoint_urls.get(endpoint)
+    
+    if not url:
+        raise Exception(f"Unknown endpoint: {endpoint}")
+    
+    # Build request payload
+    payload = {
+        'credentials': credentials,
+        'accounts': accounts
+    }
+    payload.update(kwargs)
+    
+    # Make API call
+    headers = {
+        'X-API-Secret': api_config['api_secret'],
+        'Content-Type': 'application/json'
+    }
+    
+    response = requests.post(url, headers=headers, json=payload, timeout=300)
+    
+    if response.status_code != 200:
+        raise Exception(f"API call failed: {response.status_code} - {response.text}")
+    
+    return response.json()
+
+
+def is_api_configured():
+    """Check if API is configured."""
+    return get_api_config() is not None

cost_calculator/cli.py

@@ -13,54 +13,149 @@ import boto3
 import json
 from datetime import datetime, timedelta
 from pathlib import Path
-from cost_calculator.trends import analyze_trends, format_trends_markdown
-from cost_calculator.monthly import analyze_monthly_trends, format_monthly_markdown
-from cost_calculator.drill import analyze_drill_down, format_drill_down_markdown
+from cost_calculator.trends import format_trends_markdown
+from cost_calculator.monthly import format_monthly_markdown
+from cost_calculator.drill import format_drill_down_markdown
+from cost_calculator.executor import execute_trends, execute_monthly, execute_drill
+
+
+def apply_auth_options(config, sso=None, access_key_id=None, secret_access_key=None, session_token=None):
+    """Apply authentication options to profile config
+    
+    Args:
+        config: Profile configuration dict
+        sso: AWS SSO profile name
+        access_key_id: AWS Access Key ID
+        secret_access_key: AWS Secret Access Key
+        session_token: AWS Session Token
+    
+    Returns:
+        Updated config dict
+    """
+    import subprocess
+    
+    if sso:
+        # SSO authentication - trigger login if needed
+        try:
+            # Test if SSO session is valid
+            result = subprocess.run(
+                ['aws', 'sts', 'get-caller-identity', '--profile', sso],
+                capture_output=True,
+                text=True,
+                timeout=5
+            )
+            if result.returncode != 0:
+                if 'expired' in result.stderr.lower() or 'token' in result.stderr.lower():
+                    click.echo(f"SSO session expired or not initialized. Logging in...")
+                    subprocess.run(['aws', 'sso', 'login', '--profile', sso], check=True)
+        except Exception as e:
+            click.echo(f"Warning: Could not verify SSO session: {e}")
+        
+        config['aws_profile'] = sso
+    elif access_key_id and secret_access_key:
+        # Static credentials provided via CLI
+        config['credentials'] = {
+            'aws_access_key_id': access_key_id,
+            'aws_secret_access_key': secret_access_key,
+            'region': 'us-east-1'
+        }
+        if session_token:
+            config['credentials']['aws_session_token'] = session_token
+    
+    return config
 
 
 def load_profile(profile_name):
-    """Load profile configuration from ~/.config/cost-calculator/profiles.json"""
+    """Load profile configuration from local file or DynamoDB API"""
+    import os
+    import requests
+    
     config_dir = Path.home() / '.config' / 'cost-calculator'
     config_file = config_dir / 'profiles.json'
     creds_file = config_dir / 'credentials.json'
     
-    if not config_file.exists():
+    # Try local file first
+    if config_file.exists():
+        with open(config_file) as f:
+            profiles = json.load(f)
+        
+        if profile_name in profiles:
+            profile = profiles[profile_name]
+            
+            # Load credentials if using static credentials (not SSO)
+            if 'aws_profile' not in profile:
+                if not creds_file.exists():
+                    # Try environment variables
+                    if os.environ.get('AWS_ACCESS_KEY_ID'):
+                        profile['credentials'] = {
+                            'aws_access_key_id': os.environ['AWS_ACCESS_KEY_ID'],
+                            'aws_secret_access_key': os.environ['AWS_SECRET_ACCESS_KEY'],
+                            'aws_session_token': os.environ.get('AWS_SESSION_TOKEN')
+                        }
+                        return profile
+                    
+                    raise click.ClickException(
+                        f"No credentials found for profile '{profile_name}'.\n"
+                        f"Run: cc configure --profile {profile_name}"
+                    )
+                
+                with open(creds_file) as f:
+                    creds = json.load(f)
+                
+                if profile_name not in creds:
+                    raise click.ClickException(
+                        f"No credentials found for profile '{profile_name}'.\n"
+                        f"Run: cc configure --profile {profile_name}"
+                    )
+                
+                profile['credentials'] = creds[profile_name]
+            
+            return profile
+    
+    # Profile not found locally - try DynamoDB API
+    api_secret = os.environ.get('COST_API_SECRET')
+    if not api_secret:
         raise click.ClickException(
-            f"Profile configuration not found at {config_file}\n"
+            f"Profile '{profile_name}' not found locally and COST_API_SECRET not set.\n"
             f"Run: cc init --profile {profile_name}"
         )
     
-    with open(config_file) as f:
-        profiles = json.load(f)
-    
-    if profile_name not in profiles:
-        raise click.ClickException(
-            f"Profile '{profile_name}' not found in {config_file}\n"
-            f"Available profiles: {', '.join(profiles.keys())}"
+    try:
+        response = requests.post(
+            'https://64g7jq7sjygec2zmll5lsghrpi0txrzo.lambda-url.us-east-1.on.aws/',
+            headers={'X-API-Secret': api_secret, 'Content-Type': 'application/json'},
+            json={'operation': 'get', 'profile_name': profile_name},
+            timeout=10
         )
-    
-    profile = profiles[profile_name]
-    
-    # Load credentials if using static credentials (not SSO)
-    if 'aws_profile' not in profile:
-        if not creds_file.exists():
-            raise click.ClickException(
-                f"No credentials found for profile '{profile_name}'.\n"
-                f"Run: cc configure --profile {profile_name}"
-            )
-        
-        with open(creds_file) as f:
-            creds = json.load(f)
         
-        if profile_name not in creds:
+        if response.status_code == 200:
+            response_data = response.json()
+            # API returns {"profile": {...}} wrapper
+            profile_data = response_data.get('profile', response_data)
+            profile = {'accounts': profile_data['accounts']}
+            
+            # Check for AWS_PROFILE environment variable (SSO support)
+            if os.environ.get('AWS_PROFILE'):
+                profile['aws_profile'] = os.environ['AWS_PROFILE']
+            # Use environment credentials
+            elif os.environ.get('AWS_ACCESS_KEY_ID'):
+                profile['credentials'] = {
+                    'aws_access_key_id': os.environ['AWS_ACCESS_KEY_ID'],
+                    'aws_secret_access_key': os.environ['AWS_SECRET_ACCESS_KEY'],
+                    'aws_session_token': os.environ.get('AWS_SESSION_TOKEN')
+                }
+            
+            return profile
+        else:
             raise click.ClickException(
-                f"No credentials found for profile '{profile_name}'.\n"
-                f"Run: cc configure --profile {profile_name}"
+                f"Profile '{profile_name}' not found in DynamoDB.\n"
+                f"Run: cc profile create --name {profile_name} --accounts \"...\""
             )
-        
-        profile['credentials'] = creds[profile_name]
-    
-    return profile
+    except requests.exceptions.RequestException as e:
+        raise click.ClickException(
+            f"Failed to fetch profile from API: {e}\n"
+            f"Run: cc init --profile {profile_name}"
+        )
 
 
 def calculate_costs(profile_config, accounts, start_date, offset, window):
@@ -295,12 +390,30 @@ def cli():
 @click.option('--offset', default=2, help='Days to go back from start date (default: 2)')
 @click.option('--window', default=30, help='Number of days to analyze (default: 30)')
 @click.option('--json-output', is_flag=True, help='Output as JSON')
-def calculate(profile, start_date, offset, window, json_output):
-    """Calculate AWS costs for the specified period"""
+@click.option('--sso', help='AWS SSO profile name (e.g., khoros_umbrella)')
+@click.option('--access-key-id', help='AWS Access Key ID (for static credentials)')
+@click.option('--secret-access-key', help='AWS Secret Access Key (for static credentials)')
+@click.option('--session-token', help='AWS Session Token (for static credentials)')
+def calculate(profile, start_date, offset, window, json_output, sso, access_key_id, secret_access_key, session_token):
+    """Calculate AWS costs for the specified period
+    
+    \b
+    Authentication Options:
+      1. SSO: --sso <profile_name>
+         Example: cc calculate --profile khoros --sso khoros_umbrella
+      
+      2. Static Credentials: --access-key-id, --secret-access-key, --session-token
+         Example: cc calculate --profile khoros --access-key-id ASIA... --secret-access-key ... --session-token ...
+      
+      3. Environment Variables: AWS_PROFILE or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY
+    """
     
     # Load profile configuration
     config = load_profile(profile)
     
+    # Apply authentication options
+    config = apply_auth_options(config, sso, access_key_id, secret_access_key, session_token)
+    
     # Calculate costs
     result = calculate_costs(
         profile_config=config,
@@ -546,55 +659,23 @@ def configure(profile, access_key_id, secret_access_key, session_token, region):
 @click.option('--profile', required=True, help='Profile name')
 @click.option('--weeks', default=3, help='Number of weeks to analyze (default: 3)')
 @click.option('--output', default='cost_trends.md', help='Output markdown file (default: cost_trends.md)')
-@click.option('--json-output', is_flag=True, help='Output as JSON instead of markdown')
-def trends(profile, weeks, output, json_output):
+@click.option('--json-output', is_flag=True, help='Output as JSON')
+@click.option('--sso', help='AWS SSO profile name')
+@click.option('--access-key-id', help='AWS Access Key ID')
+@click.option('--secret-access-key', help='AWS Secret Access Key')
+@click.option('--session-token', help='AWS Session Token')
+def trends(profile, weeks, output, json_output, sso, access_key_id, secret_access_key, session_token):
     """Analyze cost trends with Week-over-Week and Trailing 30-Day comparisons"""
     
     # Load profile configuration
     config = load_profile(profile)
-    
-    # Initialize boto3 client
-    try:
-        if 'aws_profile' in config:
-            aws_profile = config['aws_profile']
-            click.echo(f"AWS Profile: {aws_profile} (SSO)")
-            session = boto3.Session(profile_name=aws_profile)
-            ce_client = session.client('ce', region_name='us-east-1')
-        else:
-            creds = config['credentials']
-            click.echo(f"AWS Credentials: Static")
-            
-            session_kwargs = {
-                'aws_access_key_id': creds['aws_access_key_id'],
-                'aws_secret_access_key': creds['aws_secret_access_key'],
-                'region_name': creds.get('region', 'us-east-1')
-            }
-            
-            if 'aws_session_token' in creds:
-                session_kwargs['aws_session_token'] = creds['aws_session_token']
-            
-            session = boto3.Session(**session_kwargs)
-            ce_client = session.client('ce')
-            
-    except Exception as e:
-        if 'Token has expired' in str(e) or 'sso' in str(e).lower():
-            if 'aws_profile' in config:
-                raise click.ClickException(
-                    f"AWS SSO session expired or not initialized.\n"
-                    f"Run: aws sso login --profile {config['aws_profile']}"
-                )
-            else:
-                raise click.ClickException(
-                    f"AWS credentials expired.\n"
-                    f"Run: cc configure --profile {profile}"
-                )
-        raise
+    config = apply_auth_options(config, sso, access_key_id, secret_access_key, session_token)
     
     click.echo(f"Analyzing last {weeks} weeks...")
     click.echo("")
     
-    # Analyze trends
-    trends_data = analyze_trends(ce_client, config['accounts'], num_weeks=weeks)
+    # Execute via API or locally
+    trends_data = execute_trends(config, weeks)
     
     if json_output:
         # Output as JSON
@@ -649,41 +730,23 @@ def trends(profile, weeks, output, json_output):
 @click.option('--profile', required=True, help='Profile name')
 @click.option('--months', default=6, help='Number of months to analyze (default: 6)')
 @click.option('--output', default='monthly_trends.md', help='Output markdown file (default: monthly_trends.md)')
-@click.option('--json-output', is_flag=True, help='Output as JSON instead of markdown')
-def monthly(profile, months, output, json_output):
+@click.option('--json-output', is_flag=True, help='Output as JSON')
+@click.option('--sso', help='AWS SSO profile name')
+@click.option('--access-key-id', help='AWS Access Key ID')
+@click.option('--secret-access-key', help='AWS Secret Access Key')
+@click.option('--session-token', help='AWS Session Token')
+def monthly(profile, months, output, json_output, sso, access_key_id, secret_access_key, session_token):
     """Analyze month-over-month cost trends at service level"""
     
-    # Load profile configuration
+    # Load profile
     config = load_profile(profile)
-    
-    # Initialize boto3 client
-    try:
-        if 'aws_profile' in config:
-            aws_profile = config['aws_profile']
-            click.echo(f"AWS Profile: {aws_profile} (SSO)")
-            session = boto3.Session(profile_name=aws_profile)
-        else:
-            # Use static credentials
-            creds = config['credentials']
-            click.echo("AWS Credentials: Static")
-            session = boto3.Session(
-                aws_access_key_id=creds['aws_access_key_id'],
-                aws_secret_access_key=creds['aws_secret_access_key'],
-                aws_session_token=creds.get('aws_session_token')
-            )
-        
-        ce_client = session.client('ce', region_name='us-east-1')
-    except Exception as e:
-        raise click.ClickException(f"Failed to initialize AWS session: {str(e)}")
-    
-    # Get account list
-    accounts = config['accounts']
+    config = apply_auth_options(config, sso, access_key_id, secret_access_key, session_token)
     
     click.echo(f"Analyzing last {months} months...")
     click.echo("")
     
-    # Analyze monthly trends
-    monthly_data = analyze_monthly_trends(ce_client, accounts, months)
+    # Execute via API or locally
+    monthly_data = execute_monthly(config, months)
     
     if json_output:
         # Output as JSON
@@ -739,35 +802,17 @@ def monthly(profile, months, output, json_output):
 @click.option('--account', help='Filter by account ID')
 @click.option('--usage-type', help='Filter by usage type')
 @click.option('--output', default='drill_down.md', help='Output markdown file (default: drill_down.md)')
-@click.option('--json-output', is_flag=True, help='Output as JSON instead of markdown')
-def drill(profile, weeks, service, account, usage_type, output, json_output):
+@click.option('--json-output', is_flag=True, help='Output as JSON')
+@click.option('--sso', help='AWS SSO profile name')
+@click.option('--access-key-id', help='AWS Access Key ID')
+@click.option('--secret-access-key', help='AWS Secret Access Key')
+@click.option('--session-token', help='AWS Session Token')
+def drill(profile, weeks, service, account, usage_type, output, json_output, sso, access_key_id, secret_access_key, session_token):
     """Drill down into cost changes by service, account, or usage type"""
     
-    # Load profile configuration
+    # Load profile
     config = load_profile(profile)
-    
-    # Initialize boto3 client
-    try:
-        if 'aws_profile' in config:
-            aws_profile = config['aws_profile']
-            click.echo(f"AWS Profile: {aws_profile} (SSO)")
-            session = boto3.Session(profile_name=aws_profile)
-        else:
-            # Use static credentials
-            creds = config['credentials']
-            click.echo("AWS Credentials: Static")
-            session = boto3.Session(
-                aws_access_key_id=creds['aws_access_key_id'],
-                aws_secret_access_key=creds['aws_secret_access_key'],
-                aws_session_token=creds.get('aws_session_token')
-            )
-        
-        ce_client = session.client('ce', region_name='us-east-1')
-    except Exception as e:
-        raise click.ClickException(f"Failed to initialize AWS session: {str(e)}")
-    
-    # Get account list
-    accounts = config['accounts']
+    config = apply_auth_options(config, sso, access_key_id, secret_access_key, session_token)
     
     # Show filters
     click.echo(f"Analyzing last {weeks} weeks...")
@@ -779,13 +824,8 @@ def drill(profile, weeks, service, account, usage_type, output, json_output):
         click.echo(f"  Usage type filter: {usage_type}")
     click.echo("")
     
-    # Analyze with drill-down
-    drill_data = analyze_drill_down(
-        ce_client, accounts, weeks,
-        service_filter=service,
-        account_filter=account,
-        usage_type_filter=usage_type
-    )
+    # Execute via API or locally
+    drill_data = execute_drill(config, weeks, service, account, usage_type)
     
     if json_output:
         # Output as JSON
@@ -844,5 +884,119 @@ def drill(profile, weeks, service, account, usage_type, output, json_output):
             click.echo("")
 
 
+@cli.command()
+@click.option('--profile', required=True, help='Profile name')
+@click.option('--type', 'analysis_type', default='summary',
+              type=click.Choice(['summary', 'volatility', 'trends', 'search']),
+              help='Analysis type')
+@click.option('--weeks', default=12, help='Number of weeks (default: 12)')
+@click.option('--pattern', help='Service search pattern (for search type)')
+@click.option('--min-cost', type=float, help='Minimum cost filter (for search type)')
+@click.option('--json-output', is_flag=True, help='Output as JSON')
+def analyze(profile, analysis_type, weeks, pattern, min_cost, json_output):
+    """Perform pandas-based analysis (aggregations, volatility, trends, search)"""
+    
+    config = load_profile(profile)
+    
+    if not json_output:
+        click.echo(f"Running {analysis_type} analysis for {weeks} weeks...")
+    
+    from cost_calculator.executor import execute_analyze
+    result = execute_analyze(config, weeks, analysis_type, pattern, min_cost)
+    
+    if json_output:
+        import json
+        click.echo(json.dumps(result, indent=2, default=str))
+    else:
+        # Format output based on type
+        if analysis_type == 'summary':
+            click.echo(f"\n📊 Summary ({result.get('total_services', 0)} services)")
+            click.echo(f"Weeks analyzed: {result.get('weeks_analyzed', 0)}")
+            click.echo(f"\nTop 10 Services (by total change):")
+            for svc in result.get('services', [])[:10]:
+                click.echo(f"  {svc['service']}")
+                click.echo(f"    Total: ${svc['change_sum']:,.2f}")
+                click.echo(f"    Average: ${svc['change_mean']:,.2f}")
+                click.echo(f"    Volatility: {svc['volatility']:.3f}")
+        
+        elif analysis_type == 'volatility':
+            click.echo(f"\n📈 High Volatility Services:")
+            for svc in result.get('high_volatility_services', [])[:10]:
+                click.echo(f"  {svc['service']}: CV={svc['coefficient_of_variation']:.3f}")
+            
+            outliers = result.get('outliers', [])
+            if outliers:
+                click.echo(f"\n⚠️  Outliers ({len(outliers)}):")
+                for o in outliers[:5]:
+                    click.echo(f"  {o['service']} ({o['week']}): ${o['change']:,.2f} (z={o['z_score']:.2f})")
+        
+        elif analysis_type == 'trends':
+            inc = result.get('increasing_trends', [])
+            dec = result.get('decreasing_trends', [])
+            
+            click.echo(f"\n📈 Increasing Trends ({len(inc)}):")
+            for t in inc[:5]:
+                click.echo(f"  {t['service']}: ${t['avg_change']:,.2f}/week")
+            
+            click.echo(f"\n📉 Decreasing Trends ({len(dec)}):")
+            for t in dec[:5]:
+                click.echo(f"  {t['service']}: ${t['avg_change']:,.2f}/week")
+        
+        elif analysis_type == 'search':
+            matches = result.get('matches', [])
+            click.echo(f"\n🔍 Search Results ({len(matches)} matches)")
+            if pattern:
+                click.echo(f"Pattern: {pattern}")
+            if min_cost:
+                click.echo(f"Min cost: ${min_cost:,.2f}")
+            
+            for m in matches[:20]:
+                click.echo(f"  {m['service']}: ${m['curr_cost']:,.2f}")
+
+
+@cli.command()
+@click.argument('operation', type=click.Choice(['list', 'get', 'create', 'update', 'delete']))
+@click.option('--name', help='Profile name')
+@click.option('--accounts', help='Comma-separated account IDs')
+@click.option('--description', help='Profile description')
+def profile(operation, name, accounts, description):
+    """Manage profiles (CRUD operations)"""
+    
+    from cost_calculator.executor import execute_profile_operation
+    
+    # Parse accounts if provided
+    account_list = None
+    if accounts:
+        account_list = [a.strip() for a in accounts.split(',')]
+    
+    result = execute_profile_operation(
+        operation=operation,
+        profile_name=name,
+        accounts=account_list,
+        description=description
+    )
+    
+    if operation == 'list':
+        profiles = result.get('profiles', [])
+        click.echo(f"\n📋 Profiles ({len(profiles)}):")
+        for p in profiles:
+            click.echo(f"  {p['profile_name']}: {len(p.get('accounts', []))} accounts")
+            if p.get('description'):
+                click.echo(f"    {p['description']}")
+    
+    elif operation == 'get':
+        profile_data = result.get('profile', {})
+        click.echo(f"\n📋 Profile: {profile_data.get('profile_name')}")
+        click.echo(f"Accounts: {len(profile_data.get('accounts', []))}")
+        if profile_data.get('description'):
+            click.echo(f"Description: {profile_data['description']}")
+        click.echo(f"\nAccounts:")
+        for acc in profile_data.get('accounts', []):
+            click.echo(f"  {acc}")
+    
+    else:
+        click.echo(result.get('message', 'Operation completed'))
+
+
 if __name__ == '__main__':
     cli()

cost_calculator/executor.py

@@ -0,0 +1,241 @@
+"""
+Executor that routes to either API or local execution.
+"""
+import boto3
+import click
+from cost_calculator.api_client import is_api_configured, call_lambda_api
+
+
+def get_credentials_dict(config):
+    """
+    Extract credentials from config in format needed for API.
+    
+    Returns:
+        dict with access_key, secret_key, session_token, or None if profile is 'dummy'
+    """
+    if 'aws_profile' in config:
+        # Skip credential loading for dummy profile (API-only mode)
+        if config['aws_profile'] == 'dummy':
+            return None
+        
+        # Get temporary credentials from SSO session
+        try:
+            session = boto3.Session(profile_name=config['aws_profile'])
+            credentials = session.get_credentials()
+            frozen_creds = credentials.get_frozen_credentials()
+            
+            return {
+                'access_key': frozen_creds.access_key,
+                'secret_key': frozen_creds.secret_key,
+                'session_token': frozen_creds.token
+            }
+        except Exception:
+            # If profile not found, return None (API will handle)
+            return None
+    else:
+        # Use static credentials
+        creds = config.get('credentials', {})
+        if not creds:
+            return None
+        
+        result = {
+            'access_key': creds['aws_access_key_id'],
+            'secret_key': creds['aws_secret_access_key']
+        }
+        if 'aws_session_token' in creds:
+            result['session_token'] = creds['aws_session_token']
+        return result
+
+
+def execute_trends(config, weeks):
+    """
+    Execute trends analysis via API or locally.
+    
+    Returns:
+        dict: trends data
+    """
+    accounts = config['accounts']
+    
+    if is_api_configured():
+        # Use API
+        click.echo("Using Lambda API...")
+        credentials = get_credentials_dict(config)
+        return call_lambda_api('trends', credentials, accounts, weeks=weeks)
+    else:
+        # Use local execution
+        click.echo("Using local execution...")
+        from cost_calculator.trends import analyze_trends
+        
+        # Initialize boto3 client
+        if 'aws_profile' in config:
+            session = boto3.Session(profile_name=config['aws_profile'])
+        else:
+            creds = config['credentials']
+            session_kwargs = {
+                'aws_access_key_id': creds['aws_access_key_id'],
+                'aws_secret_access_key': creds['aws_secret_access_key'],
+                'region_name': creds.get('region', 'us-east-1')
+            }
+            if 'aws_session_token' in creds:
+                session_kwargs['aws_session_token'] = creds['aws_session_token']
+            session = boto3.Session(**session_kwargs)
+        
+        ce_client = session.client('ce', region_name='us-east-1')
+        return analyze_trends(ce_client, accounts, weeks)
+
+
+def execute_monthly(config, months):
+    """
+    Execute monthly analysis via API or locally.
+    
+    Returns:
+        dict: monthly data
+    """
+    accounts = config['accounts']
+    
+    if is_api_configured():
+        # Use API
+        click.echo("Using Lambda API...")
+        credentials = get_credentials_dict(config)
+        return call_lambda_api('monthly', credentials, accounts, months=months)
+    else:
+        # Use local execution
+        click.echo("Using local execution...")
+        from cost_calculator.monthly import analyze_monthly_trends
+        
+        # Initialize boto3 client
+        if 'aws_profile' in config:
+            session = boto3.Session(profile_name=config['aws_profile'])
+        else:
+            creds = config['credentials']
+            session_kwargs = {
+                'aws_access_key_id': creds['aws_access_key_id'],
+                'aws_secret_access_key': creds['aws_secret_access_key'],
+                'region_name': creds.get('region', 'us-east-1')
+            }
+            if 'aws_session_token' in creds:
+                session_kwargs['aws_session_token'] = creds['aws_session_token']
+            session = boto3.Session(**session_kwargs)
+        
+        ce_client = session.client('ce', region_name='us-east-1')
+        return analyze_monthly_trends(ce_client, accounts, months)
+
+
+def execute_drill(config, weeks, service_filter=None, account_filter=None, usage_type_filter=None):
+    """
+    Execute drill-down analysis via API or locally.
+    
+    Returns:
+        dict: drill data
+    """
+    accounts = config['accounts']
+    
+    if is_api_configured():
+        # Use API
+        click.echo("Using Lambda API...")
+        credentials = get_credentials_dict(config)
+        kwargs = {'weeks': weeks}
+        if service_filter:
+            kwargs['service'] = service_filter
+        if account_filter:
+            kwargs['account'] = account_filter
+        if usage_type_filter:
+            kwargs['usage_type'] = usage_type_filter
+        return call_lambda_api('drill', credentials, accounts, **kwargs)
+    else:
+        # Use local execution
+        click.echo("Using local execution...")
+        from cost_calculator.drill import analyze_drill_down
+        
+        # Initialize boto3 client
+        if 'aws_profile' in config:
+            session = boto3.Session(profile_name=config['aws_profile'])
+        else:
+            creds = config['credentials']
+            session_kwargs = {
+                'aws_access_key_id': creds['aws_access_key_id'],
+                'aws_secret_access_key': creds['aws_secret_access_key'],
+                'region_name': creds.get('region', 'us-east-1')
+            }
+            if 'aws_session_token' in creds:
+                session_kwargs['aws_session_token'] = creds['aws_session_token']
+            session = boto3.Session(**session_kwargs)
+        
+        ce_client = session.client('ce', region_name='us-east-1')
+        return analyze_drill_down(
+            ce_client, accounts, weeks,
+            service_filter=service_filter,
+            account_filter=account_filter,
+            usage_type_filter=usage_type_filter
+        )
+
+
+def execute_analyze(config, weeks, analysis_type, pattern=None, min_cost=None):
+    """
+    Execute pandas-based analysis via API.
+    Note: This only works via API (requires pandas layer).
+    
+    Returns:
+        dict: analysis results
+    """
+    accounts = config['accounts']
+    
+    if not is_api_configured():
+        raise click.ClickException(
+            "Analyze command requires API configuration.\n"
+            "Set COST_API_SECRET environment variable."
+        )
+    
+    credentials = get_credentials_dict(config)
+    kwargs = {'weeks': weeks, 'type': analysis_type}
+    
+    if pattern:
+        kwargs['pattern'] = pattern
+    if min_cost:
+        kwargs['min_cost'] = min_cost
+    
+    return call_lambda_api('analyze', credentials, accounts, **kwargs)
+
+
+def execute_profile_operation(operation, profile_name=None, accounts=None, description=None):
+    """
+    Execute profile CRUD operations via API.
+    
+    Returns:
+        dict: operation result
+    """
+    if not is_api_configured():
+        raise click.ClickException(
+            "Profile commands require API configuration.\n"
+            "Set COST_API_SECRET environment variable."
+        )
+    
+    # Profile operations don't need AWS credentials, just API secret
+    import os
+    import requests
+    import json
+    
+    api_secret = os.environ.get('COST_API_SECRET', '')
+    
+    # Use profiles endpoint (hardcoded URL)
+    url = 'https://64g7jq7sjygec2zmll5lsghrpi0txrzo.lambda-url.us-east-1.on.aws/'
+    
+    payload = {'operation': operation}
+    if profile_name:
+        payload['profile_name'] = profile_name
+    if accounts:
+        payload['accounts'] = accounts
+    if description:
+        payload['description'] = description
+    
+    headers = {
+        'X-API-Secret': api_secret,
+        'Content-Type': 'application/json'
+    }
+    
+    response = requests.post(url, headers=headers, json=payload, timeout=60)
+    
+    if response.status_code != 200:
+        raise Exception(f"API call failed: {response.status_code} - {response.text}")
+    
+    return response.json()

aws_cost_calculator_cli-1.3.0.dist-info/RECORD

@@ -1,11 +0,0 @@
-aws_cost_calculator_cli-1.3.0.dist-info/licenses/LICENSE,sha256=cYtmQZHNGGTXOtg3T7LHDRneleaH0dHXHfxFV3WR50Y,1079
-cost_calculator/__init__.py,sha256=PJeIqvWh5AYJVrJxPPkI4pJnAt37rIjasrNS0I87kaM,52
-cost_calculator/cli.py,sha256=YJOWA-uWSMEZc4QHof8DF_An6VpKmTsxh0X_G31y1SM,31018
-cost_calculator/drill.py,sha256=hGi-prLgZDvNMMICQc4fl3LenM7YaZ3To_Ei4LKwrdc,10543
-cost_calculator/monthly.py,sha256=6k9F8S7djhX1wGV3-T1MZP7CvWbbfhSTEaddwCfVu5M,7932
-cost_calculator/trends.py,sha256=k_s4ylBX50sqoiM_fwepi58HW01zz767FMJhQUPDznk,12246
-aws_cost_calculator_cli-1.3.0.dist-info/METADATA,sha256=jZYbRF46p0qvjkw4Dqwja-4cnOJv59i7zTzmFXxfCsw,7761
-aws_cost_calculator_cli-1.3.0.dist-info/WHEEL,sha256=Nw36Djuh_5VDukK0H78QzOX-_FQEo6V37m3nkm96gtU,91
-aws_cost_calculator_cli-1.3.0.dist-info/entry_points.txt,sha256=_5Qy4EcHbYVYrdgOu1E48faMHb9fLUl5VJ3djDHuJBo,47
-aws_cost_calculator_cli-1.3.0.dist-info/top_level.txt,sha256=PRwGPPlNqASfyhGHDjSfyl4SXeE7GF3OVTu1tY1Uqyc,16
-aws_cost_calculator_cli-1.3.0.dist-info/RECORD,,