aws-cost-calculator-cli 1.8.2__py3-none-any.whl → 1.11.0__py3-none-any.whl

{aws_cost_calculator_cli-1.8.2.dist-info → aws_cost_calculator_cli-1.11.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-cost-calculator-cli
-Version: 1.8.2
+Version: 1.11.0
 Summary: AWS Cost Calculator CLI - Calculate daily and annual AWS costs across multiple accounts
 Home-page: https://github.com/trilogy-group/aws-cost-calculator
 Author: Cost Optimization Team

aws_cost_calculator_cli-1.11.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+aws_cost_calculator_cli-1.11.0.dist-info/licenses/LICENSE,sha256=cYtmQZHNGGTXOtg3T7LHDRneleaH0dHXHfxFV3WR50Y,1079
+cost_calculator/__init__.py,sha256=PJeIqvWh5AYJVrJxPPkI4pJnAt37rIjasrNS0I87kaM,52
+cost_calculator/api_client.py,sha256=4ZI2XcGIN3FBeQqb7xOxQ91kCoeM43-rExiOELXoKBQ,2485
+cost_calculator/cli.py,sha256=UclTm6G5kZyk0Dw2Ot7IkVhKIJK96VSvKe8D4oCSk1Q,76053
+cost_calculator/cur.py,sha256=QaZ_nyDSw5_cti-h5Ho6eYLbqzY5TWoub24DpyzIiSs,9502
+cost_calculator/drill.py,sha256=hGi-prLgZDvNMMICQc4fl3LenM7YaZ3To_Ei4LKwrdc,10543
+cost_calculator/executor.py,sha256=yZTCUgJc1OpB892O3mq9ZA0Yekc7N-HvaW8xLFyrXjo,8681
+cost_calculator/forensics.py,sha256=uhRo3I_zOeMEaBENHfgq65URga31W0Z4vzS2UN6VmTY,12819
+cost_calculator/monthly.py,sha256=6k9F8S7djhX1wGV3-T1MZP7CvWbbfhSTEaddwCfVu5M,7932
+cost_calculator/trends.py,sha256=k_s4ylBX50sqoiM_fwepi58HW01zz767FMJhQUPDznk,12246
+aws_cost_calculator_cli-1.11.0.dist-info/METADATA,sha256=M_I1zl12wIBb6fdmzxeAa7CNBc3gWOggYdzqpYLZNTw,11979
+aws_cost_calculator_cli-1.11.0.dist-info/WHEEL,sha256=Nw36Djuh_5VDukK0H78QzOX-_FQEo6V37m3nkm96gtU,91
+aws_cost_calculator_cli-1.11.0.dist-info/entry_points.txt,sha256=_5Qy4EcHbYVYrdgOu1E48faMHb9fLUl5VJ3djDHuJBo,47
+aws_cost_calculator_cli-1.11.0.dist-info/top_level.txt,sha256=PRwGPPlNqASfyhGHDjSfyl4SXeE7GF3OVTu1tY1Uqyc,16
+aws_cost_calculator_cli-1.11.0.dist-info/RECORD,,

cost_calculator/cli.py

@@ -68,7 +68,7 @@ def apply_auth_options(config, sso=None, access_key_id=None, secret_access_key=N
 
 
 def load_profile(profile_name):
-    """Load profile configuration from local file or DynamoDB API"""
+    """Load profile configuration from DynamoDB API or local file as fallback"""
     import os
     import requests
     
@@ -76,7 +76,76 @@ def load_profile(profile_name):
     config_file = config_dir / 'profiles.json'
     creds_file = config_dir / 'credentials.json'
     
-    # Try local file first
+    # Try DynamoDB API first if COST_API_SECRET is set
+    api_secret = os.environ.get('COST_API_SECRET')
+    if api_secret:
+        try:
+            response = requests.post(
+                'https://64g7jq7sjygec2zmll5lsghrpi0txrzo.lambda-url.us-east-1.on.aws/',
+                headers={'X-API-Secret': api_secret, 'Content-Type': 'application/json'},
+                json={'operation': 'get', 'profile_name': profile_name},
+                timeout=10
+            )
+            
+            if response.status_code == 200:
+                response_data = response.json()
+                # API returns {"profile": {...}} wrapper
+                profile_data = response_data.get('profile', response_data)
+                profile = {'accounts': profile_data['accounts']}
+                
+                # If profile has aws_profile field, use it
+                if 'aws_profile' in profile_data:
+                    profile['aws_profile'] = profile_data['aws_profile']
+                # Check for AWS_PROFILE environment variable (SSO support)
+                elif os.environ.get('AWS_PROFILE'):
+                    profile['aws_profile'] = os.environ['AWS_PROFILE']
+                # Use environment credentials
+                elif os.environ.get('AWS_ACCESS_KEY_ID'):
+                    profile['credentials'] = {
+                        'aws_access_key_id': os.environ['AWS_ACCESS_KEY_ID'],
+                        'aws_secret_access_key': os.environ['AWS_SECRET_ACCESS_KEY'],
+                        'aws_session_token': os.environ.get('AWS_SESSION_TOKEN')
+                    }
+                else:
+                    # Try to find a matching AWS profile by name
+                    # This allows "khoros" profile to work with "khoros_umbrella" AWS profile
+                    import subprocess
+                    try:
+                        result = subprocess.run(
+                            ['aws', 'configure', 'list-profiles'],
+                            capture_output=True,
+                            text=True,
+                            timeout=5
+                        )
+                        if result.returncode == 0:
+                            available_profiles = result.stdout.strip().split('\n')
+                            # Try exact match first
+                            if profile_name in available_profiles:
+                                profile['aws_profile'] = profile_name
+                            # Try with common suffixes
+                            elif f"{profile_name}_umbrella" in available_profiles:
+                                profile['aws_profile'] = f"{profile_name}_umbrella"
+                            elif f"{profile_name}-umbrella" in available_profiles:
+                                profile['aws_profile'] = f"{profile_name}-umbrella"
+                            elif f"{profile_name}_prod" in available_profiles:
+                                profile['aws_profile'] = f"{profile_name}_prod"
+                            # If no match found, leave it unset - user must provide --sso
+                    except:
+                        # If we can't list profiles, leave it unset - user must provide --sso
+                        pass
+                
+                return profile
+            else:
+                raise click.ClickException(
+                    f"Profile '{profile_name}' not found in DynamoDB.\n"
+                    f"Run: cc profile create --name {profile_name} --accounts \"...\""
+                )
+        except requests.exceptions.RequestException as e:
+            raise click.ClickException(
+                f"Failed to fetch profile from API: {e}\n"
+            )
+    
+    # Fallback to local file if no API secret
     if config_file.exists():
         with open(config_file) as f:
             profiles = json.load(f)
@@ -114,50 +183,11 @@ def load_profile(profile_name):
             
             return profile
     
-    # Profile not found locally - try DynamoDB API
-    api_secret = os.environ.get('COST_API_SECRET')
-    if not api_secret:
-        raise click.ClickException(
-            f"Profile '{profile_name}' not found locally and COST_API_SECRET not set.\n"
-            f"Run: cc init --profile {profile_name}"
-        )
-    
-    try:
-        response = requests.post(
-            'https://64g7jq7sjygec2zmll5lsghrpi0txrzo.lambda-url.us-east-1.on.aws/',
-            headers={'X-API-Secret': api_secret, 'Content-Type': 'application/json'},
-            json={'operation': 'get', 'profile_name': profile_name},
-            timeout=10
-        )
-        
-        if response.status_code == 200:
-            response_data = response.json()
-            # API returns {"profile": {...}} wrapper
-            profile_data = response_data.get('profile', response_data)
-            profile = {'accounts': profile_data['accounts']}
-            
-            # Check for AWS_PROFILE environment variable (SSO support)
-            if os.environ.get('AWS_PROFILE'):
-                profile['aws_profile'] = os.environ['AWS_PROFILE']
-            # Use environment credentials
-            elif os.environ.get('AWS_ACCESS_KEY_ID'):
-                profile['credentials'] = {
-                    'aws_access_key_id': os.environ['AWS_ACCESS_KEY_ID'],
-                    'aws_secret_access_key': os.environ['AWS_SECRET_ACCESS_KEY'],
-                    'aws_session_token': os.environ.get('AWS_SESSION_TOKEN')
-                }
-            
-            return profile
-        else:
-            raise click.ClickException(
-                f"Profile '{profile_name}' not found in DynamoDB.\n"
-                f"Run: cc profile create --name {profile_name} --accounts \"...\""
-            )
-    except requests.exceptions.RequestException as e:
-        raise click.ClickException(
-            f"Failed to fetch profile from API: {e}\n"
-            f"Run: cc init --profile {profile_name}"
-        )
+    # Profile not found anywhere
+    raise click.ClickException(
+        f"Profile '{profile_name}' not found.\n"
+        f"Run: cc profile create --name {profile_name} --accounts \"...\""
+    )
 
 
 def calculate_costs(profile_config, accounts, start_date, offset, window):
@@ -1175,6 +1205,27 @@ def investigate(profile, sso, weeks, account, service, no_cloudtrail, output):
     if sso:
         config['aws_profile'] = sso
     
+    # Validate that we have a way to get credentials
+    if 'aws_profile' not in config and 'credentials' not in config:
+        import subprocess
+        try:
+            result = subprocess.run(
+                ['aws', 'configure', 'list-profiles'],
+                capture_output=True,
+                text=True,
+                timeout=5
+            )
+            available = result.stdout.strip().split('\n') if result.returncode == 0 else []
+            suggestion = f"\nAvailable AWS profiles: {', '.join(available[:5])}" if available else ""
+        except:
+            suggestion = ""
+        
+        raise click.ClickException(
+            f"Profile '{profile}' has no AWS authentication configured.\n"
+            f"Use --sso flag to specify your AWS SSO profile:\n"
+            f"  cc investigate --profile {profile} --sso YOUR_AWS_PROFILE{suggestion}"
+        )
+    
     # Step 1: Cost Analysis
     click.echo("Step 1/3: Analyzing cost trends...")
     try:
@@ -1218,27 +1269,23 @@ def investigate(profile, sso, weeks, account, service, no_cloudtrail, output):
             click.echo(f"    ⚠️  No credentials available for account")
             continue
         
-        # Inventory resources via backend API
+        # Inventory resources via backend API only
+        if not is_api_configured():
+            click.echo(f"    ✗ API not configured. Set COST_API_SECRET environment variable.")
+            continue
+        
         try:
             regions = ['us-west-2', 'us-east-1', 'eu-west-1']
             for region in regions:
                 try:
-                    if is_api_configured():
-                        inv = call_lambda_api(
-                            'forensics',
-                            account_creds,
-                            [],  # accounts not needed for forensics
-                            operation='inventory',
-                            account_id=acc_id,
-                            region=region
-                        )
-                    else:
-                        # Fallback to local execution
-                        from cost_calculator.forensics import inventory_resources
-                        acc_profile = find_account_profile(acc_id)
-                        if not acc_profile:
-                            raise Exception("No SSO profile found and API not configured")
-                        inv = inventory_resources(acc_id, acc_profile, region)
+                    inv = call_lambda_api(
+                        'forensics',
+                        account_creds,
+                        [],  # accounts not needed for forensics
+                        operation='inventory',
+                        account_id=acc_id,
+                        region=region
+                    )
                     
                     if not inv.get('error'):
                         inventories.append(inv)
@@ -1252,13 +1299,15 @@ def investigate(profile, sso, weeks, account, service, no_cloudtrail, output):
         except Exception as e:
             click.echo(f"    ✗ Inventory error: {str(e)}")
         
-        # CloudTrail analysis via backend API
+        # CloudTrail analysis via backend API only
         if not no_cloudtrail:
-            try:
-                start_date = (datetime.now() - timedelta(days=weeks * 7)).isoformat() + 'Z'
-                end_date = datetime.now().isoformat() + 'Z'
-                
-                if is_api_configured():
+            if not is_api_configured():
+                click.echo(f"    ✗ CloudTrail skipped: API not configured")
+            else:
+                try:
+                    start_date = (datetime.now() - timedelta(days=weeks * 7)).isoformat() + 'Z'
+                    end_date = datetime.now().isoformat() + 'Z'
+                    
                     ct_analysis = call_lambda_api(
                         'forensics',
                         account_creds,
@@ -1269,26 +1318,17 @@ def investigate(profile, sso, weeks, account, service, no_cloudtrail, output):
                         end_date=end_date,
                         region='us-west-2'
                     )
-                else:
-                    # Fallback to local execution
-                    from cost_calculator.forensics import analyze_cloudtrail
-                    acc_profile = find_account_profile(acc_id)
-                    if not acc_profile:
-                        raise Exception("No SSO profile found and API not configured")
-                    start_dt = datetime.now() - timedelta(days=weeks * 7)
-                    end_dt = datetime.now()
-                    ct_analysis = analyze_cloudtrail(acc_id, acc_profile, start_dt, end_dt)
-                
-                cloudtrail_analyses.append(ct_analysis)
-                
-                if ct_analysis.get('error'):
-                    click.echo(f"    ⚠️  CloudTrail: {ct_analysis['error']}")
-                else:
-                    click.echo(f"    ✓ CloudTrail analysis complete")
-                    click.echo(f"      - {len(ct_analysis['event_summary'])} event types")
-                    click.echo(f"      - {len(ct_analysis['write_events'])} resource changes")
-            except Exception as e:
-                click.echo(f"    ✗ CloudTrail error: {str(e)}")
+                    
+                    cloudtrail_analyses.append(ct_analysis)
+                    
+                    if ct_analysis.get('error'):
+                        click.echo(f"    ⚠️  CloudTrail: {ct_analysis['error']}")
+                    else:
+                        click.echo(f"    ✓ CloudTrail analysis complete")
+                        click.echo(f"      - {len(ct_analysis['event_summary'])} event types")
+                        click.echo(f"      - {len(ct_analysis['write_events'])} resource changes")
+                except Exception as e:
+                    click.echo(f"    ✗ CloudTrail error: {str(e)}")
     
     # Generate report
     click.echo(f"\nGenerating report...")
@@ -1340,5 +1380,596 @@ def find_account_profile(account_id):
         return None
 
 
+@cli.command()
+@click.option('--profile', required=True, help='Profile name')
+@click.option('--start-date', help='Start date (YYYY-MM-DD)')
+@click.option('--end-date', help='End date (YYYY-MM-DD)')
+@click.option('--days', type=int, default=10, help='Number of days to analyze (default: 10)')
+@click.option('--service', help='Filter by service name')
+@click.option('--account', help='Filter by account ID')
+@click.option('--sso', help='AWS SSO profile name')
+@click.option('--json', 'output_json', is_flag=True, help='Output as JSON')
+def daily(profile, start_date, end_date, days, service, account, sso, output_json):
+    """
+    Get daily cost breakdown with granular detail
+    
+    Example:
+        cc daily --profile khoros --days 10 --service AmazonCloudWatch --account 820054669588
+    """
+    # Load profile
+    config = load_profile(profile)
+    
+    # Apply SSO if provided
+    if sso:
+        config['aws_profile'] = sso
+    
+    # Calculate date range
+    if end_date:
+        end = datetime.strptime(end_date, '%Y-%m-%d')
+    else:
+        end = datetime.now()
+    
+    if start_date:
+        start = datetime.strptime(start_date, '%Y-%m-%d')
+    else:
+        start = end - timedelta(days=days)
+    
+    click.echo(f"Daily breakdown: {start.strftime('%Y-%m-%d')} to {end.strftime('%Y-%m-%d')}")
+    if service:
+        click.echo(f"Service filter: {service}")
+    if account:
+        click.echo(f"Account filter: {account}")
+    click.echo("")
+    
+    # Get credentials
+    try:
+        if 'aws_profile' in config:
+            session = boto3.Session(profile_name=config['aws_profile'])
+        else:
+            creds = config['credentials']
+            session = boto3.Session(
+                aws_access_key_id=creds['aws_access_key_id'],
+                aws_secret_access_key=creds['aws_secret_access_key'],
+                aws_session_token=creds.get('aws_session_token')
+            )
+        
+        ce_client = session.client('ce', region_name='us-east-1')
+        
+        # Build filter
+        filter_parts = []
+        
+        # Account filter
+        if account:
+            filter_parts.append({
+                "Dimensions": {
+                    "Key": "LINKED_ACCOUNT",
+                    "Values": [account]
+                }
+            })
+        else:
+            filter_parts.append({
+                "Dimensions": {
+                    "Key": "LINKED_ACCOUNT",
+                    "Values": config['accounts']
+                }
+            })
+        
+        # Service filter
+        if service:
+            filter_parts.append({
+                "Dimensions": {
+                    "Key": "SERVICE",
+                    "Values": [service]
+                }
+            })
+        
+        # Exclude support and tax
+        filter_parts.append({
+            "Not": {
+                "Dimensions": {
+                    "Key": "RECORD_TYPE",
+                    "Values": ["Tax", "Support"]
+                }
+            }
+        })
+        
+        cost_filter = {"And": filter_parts} if len(filter_parts) > 1 else filter_parts[0]
+        
+        # Get daily costs
+        response = ce_client.get_cost_and_usage(
+            TimePeriod={
+                'Start': start.strftime('%Y-%m-%d'),
+                'End': (end + timedelta(days=1)).strftime('%Y-%m-%d')
+            },
+            Granularity='DAILY',
+            Metrics=['UnblendedCost'],
+            Filter=cost_filter
+        )
+        
+        # Collect results
+        daily_costs = []
+        total = 0
+        for day in response['ResultsByTime']:
+            date = day['TimePeriod']['Start']
+            cost = float(day['Total']['UnblendedCost']['Amount'])
+            total += cost
+            daily_costs.append({'date': date, 'cost': cost})
+        
+        num_days = len(response['ResultsByTime'])
+        daily_avg = total / num_days if num_days > 0 else 0
+        annual = daily_avg * 365
+        
+        # Output results
+        if output_json:
+            import json
+            result = {
+                'period': {
+                    'start': start.strftime('%Y-%m-%d'),
+                    'end': end.strftime('%Y-%m-%d'),
+                    'days': num_days
+                },
+                'filters': {
+                    'service': service,
+                    'account': account
+                },
+                'daily_costs': daily_costs,
+                'summary': {
+                    'total': total,
+                    'daily_avg': daily_avg,
+                    'annual_projection': annual
+                }
+            }
+            click.echo(json.dumps(result, indent=2))
+        else:
+            click.echo("Date       | Cost")
+            click.echo("-----------|-----------")
+            for item in daily_costs:
+                click.echo(f"{item['date']} | ${item['cost']:,.2f}")
+            click.echo("-----------|-----------")
+            click.echo(f"Total      | ${total:,.2f}")
+            click.echo(f"Daily Avg  | ${daily_avg:,.2f}")
+            click.echo(f"Annual     | ${annual:,.0f}")
+        
+    except Exception as e:
+        raise click.ClickException(f"Failed to get daily costs: {e}")
+
+
+@cli.command()
+@click.option('--profile', required=True, help='Profile name')
+@click.option('--account', help='Account ID to compare')
+@click.option('--service', help='Service to compare')
+@click.option('--before', required=True, help='Before period (YYYY-MM-DD:YYYY-MM-DD)')
+@click.option('--after', required=True, help='After period (YYYY-MM-DD:YYYY-MM-DD)')
+@click.option('--expected-reduction', type=float, help='Expected reduction percentage')
+@click.option('--sso', help='AWS SSO profile name')
+@click.option('--json', 'output_json', is_flag=True, help='Output as JSON')
+def compare(profile, account, service, before, after, expected_reduction, sso, output_json):
+    """
+    Compare costs between two periods
+    
+    Example:
+        cc compare --profile khoros --account 180770971501 --service AmazonCloudWatch \
+          --before "2025-10-28:2025-11-06" --after "2025-11-17:2025-11-26" --expected-reduction 50
+    """
+    # Load profile
+    config = load_profile(profile)
+    
+    # Apply SSO if provided
+    if sso:
+        config['aws_profile'] = sso
+    
+    # Parse periods
+    try:
+        before_start, before_end = before.split(':')
+        after_start, after_end = after.split(':')
+    except ValueError:
+        raise click.ClickException("Period format must be 'YYYY-MM-DD:YYYY-MM-DD'")
+    
+    if not output_json:
+        click.echo(f"Comparing periods:")
+        click.echo(f"  Before: {before_start} to {before_end}")
+        click.echo(f"  After:  {after_start} to {after_end}")
+        if service:
+            click.echo(f"  Service: {service}")
+        if account:
+            click.echo(f"  Account: {account}")
+        click.echo("")
+    
+    # Get credentials
+    try:
+        if 'aws_profile' in config:
+            session = boto3.Session(profile_name=config['aws_profile'])
+        else:
+            creds = config['credentials']
+            session = boto3.Session(
+                aws_access_key_id=creds['aws_access_key_id'],
+                aws_secret_access_key=creds['aws_secret_access_key'],
+                aws_session_token=creds.get('aws_session_token')
+            )
+        
+        ce_client = session.client('ce', region_name='us-east-1')
+        
+        # Build filter
+        def build_filter():
+            filter_parts = []
+            
+            if account:
+                filter_parts.append({
+                    "Dimensions": {
+                        "Key": "LINKED_ACCOUNT",
+                        "Values": [account]
+                    }
+                })
+            else:
+                filter_parts.append({
+                    "Dimensions": {
+                        "Key": "LINKED_ACCOUNT",
+                        "Values": config['accounts']
+                    }
+                })
+            
+            if service:
+                filter_parts.append({
+                    "Dimensions": {
+                        "Key": "SERVICE",
+                        "Values": [service]
+                    }
+                })
+            
+            filter_parts.append({
+                "Not": {
+                    "Dimensions": {
+                        "Key": "RECORD_TYPE",
+                        "Values": ["Tax", "Support"]
+                    }
+                }
+            })
+            
+            return {"And": filter_parts} if len(filter_parts) > 1 else filter_parts[0]
+        
+        cost_filter = build_filter()
+        
+        # Get before period costs
+        before_response = ce_client.get_cost_and_usage(
+            TimePeriod={
+                'Start': before_start,
+                'End': (datetime.strptime(before_end, '%Y-%m-%d') + timedelta(days=1)).strftime('%Y-%m-%d')
+            },
+            Granularity='DAILY',
+            Metrics=['UnblendedCost'],
+            Filter=cost_filter
+        )
+        
+        # Get after period costs
+        after_response = ce_client.get_cost_and_usage(
+            TimePeriod={
+                'Start': after_start,
+                'End': (datetime.strptime(after_end, '%Y-%m-%d') + timedelta(days=1)).strftime('%Y-%m-%d')
+            },
+            Granularity='DAILY',
+            Metrics=['UnblendedCost'],
+            Filter=cost_filter
+        )
+        
+        # Calculate totals
+        before_total = sum(float(day['Total']['UnblendedCost']['Amount']) for day in before_response['ResultsByTime'])
+        after_total = sum(float(day['Total']['UnblendedCost']['Amount']) for day in after_response['ResultsByTime'])
+        
+        before_days = len(before_response['ResultsByTime'])
+        after_days = len(after_response['ResultsByTime'])
+        
+        before_daily = before_total / before_days if before_days > 0 else 0
+        after_daily = after_total / after_days if after_days > 0 else 0
+        
+        reduction = before_daily - after_daily
+        reduction_pct = (reduction / before_daily * 100) if before_daily > 0 else 0
+        annual_savings = reduction * 365
+        
+        # Output results
+        if output_json:
+            import json
+            result = {
+                'before': {
+                    'period': {'start': before_start, 'end': before_end},
+                    'total': before_total,
+                    'daily_avg': before_daily,
+                    'days': before_days
+                },
+                'after': {
+                    'period': {'start': after_start, 'end': after_end},
+                    'total': after_total,
+                    'daily_avg': after_daily,
+                    'days': after_days
+                },
+                'comparison': {
+                    'daily_reduction': reduction,
+                    'reduction_pct': reduction_pct,
+                    'annual_savings': annual_savings
+                }
+            }
+            
+            if expected_reduction is not None:
+                result['comparison']['expected_reduction_pct'] = expected_reduction
+                result['comparison']['met_expectation'] = reduction_pct >= expected_reduction
+            
+            click.echo(json.dumps(result, indent=2))
+        else:
+            click.echo("Before Period:")
+            click.echo(f"  Total: ${before_total:,.2f}")
+            click.echo(f"  Daily Avg: ${before_daily:,.2f}")
+            click.echo(f"  Days: {before_days}")
+            click.echo("")
+            click.echo("After Period:")
+            click.echo(f"  Total: ${after_total:,.2f}")
+            click.echo(f"  Daily Avg: ${after_daily:,.2f}")
+            click.echo(f"  Days: {after_days}")
+            click.echo("")
+            click.echo("Comparison:")
+            click.echo(f"  Daily Reduction: ${reduction:,.2f}")
+            click.echo(f"  Reduction %: {reduction_pct:.1f}%")
+            click.echo(f"  Annual Savings: ${annual_savings:,.0f}")
+            
+            if expected_reduction is not None:
+                click.echo("")
+                if reduction_pct >= expected_reduction:
+                    click.echo(f"✅ Savings achieved: {reduction_pct:.1f}% (expected {expected_reduction}%)")
+                else:
+                    click.echo(f"⚠️  Below target: {reduction_pct:.1f}% (expected {expected_reduction}%)")
+        
+    except Exception as e:
+        raise click.ClickException(f"Comparison failed: {e}")
+
+
+@cli.command()
+@click.option('--profile', required=True, help='Profile name')
+@click.option('--tag-key', required=True, help='Tag key to filter by')
+@click.option('--tag-value', help='Tag value to filter by (optional)')
+@click.option('--start-date', help='Start date (YYYY-MM-DD)')
+@click.option('--end-date', help='End date (YYYY-MM-DD)')
+@click.option('--days', type=int, default=30, help='Number of days to analyze (default: 30)')
+@click.option('--sso', help='AWS SSO profile name')
+@click.option('--json', 'output_json', is_flag=True, help='Output as JSON')
+def tags(profile, tag_key, tag_value, start_date, end_date, days, sso, output_json):
+    """
+    Analyze costs by resource tags
+    
+    Example:
+        cc tags --profile khoros --tag-key "datadog:org" --days 30
+        cc tags --profile khoros --tag-key "Environment" --tag-value "Production"
+    """
+    # Load profile
+    config = load_profile(profile)
+    
+    # Apply SSO if provided
+    if sso:
+        config['aws_profile'] = sso
+    
+    # Calculate date range
+    if end_date:
+        end = datetime.strptime(end_date, '%Y-%m-%d')
+    else:
+        end = datetime.now()
+    
+    if start_date:
+        start = datetime.strptime(start_date, '%Y-%m-%d')
+    else:
+        start = end - timedelta(days=days)
+    
+    if not output_json:
+        click.echo(f"Tag-based cost analysis: {start.strftime('%Y-%m-%d')} to {end.strftime('%Y-%m-%d')}")
+        click.echo(f"Tag key: {tag_key}")
+        if tag_value:
+            click.echo(f"Tag value: {tag_value}")
+        click.echo("")
+    
+    # Get credentials
+    try:
+        if 'aws_profile' in config:
+            session = boto3.Session(profile_name=config['aws_profile'])
+        else:
+            creds = config['credentials']
+            session = boto3.Session(
+                aws_access_key_id=creds['aws_access_key_id'],
+                aws_secret_access_key=creds['aws_secret_access_key'],
+                aws_session_token=creds.get('aws_session_token')
+            )
+        
+        ce_client = session.client('ce', region_name='us-east-1')
+        
+        # Build filter
+        filter_parts = [
+            {
+                "Dimensions": {
+                    "Key": "LINKED_ACCOUNT",
+                    "Values": config['accounts']
+                }
+            },
+            {
+                "Not": {
+                    "Dimensions": {
+                        "Key": "RECORD_TYPE",
+                        "Values": ["Tax", "Support"]
+                    }
+                }
+            }
+        ]
+        
+        # Add tag filter if value specified
+        if tag_value:
+            filter_parts.append({
+                "Tags": {
+                    "Key": tag_key,
+                    "Values": [tag_value]
+                }
+            })
+        
+        cost_filter = {"And": filter_parts}
+        
+        # Get costs grouped by tag values
+        response = ce_client.get_cost_and_usage(
+            TimePeriod={
+                'Start': start.strftime('%Y-%m-%d'),
+                'End': (end + timedelta(days=1)).strftime('%Y-%m-%d')
+            },
+            Granularity='MONTHLY',
+            Metrics=['UnblendedCost'],
+            GroupBy=[{
+                'Type': 'TAG',
+                'Key': tag_key
+            }],
+            Filter=cost_filter
+        )
+        
+        # Collect results
+        tag_costs = {}
+        for period in response['ResultsByTime']:
+            for group in period['Groups']:
+                tag_val = group['Keys'][0].split('$')[1] if '$' in group['Keys'][0] else group['Keys'][0]
+                cost = float(group['Metrics']['UnblendedCost']['Amount'])
+                tag_costs[tag_val] = tag_costs.get(tag_val, 0) + cost
+        
+        # Sort by cost
+        sorted_tags = sorted(tag_costs.items(), key=lambda x: x[1], reverse=True)
+        
+        total = sum(tag_costs.values())
+        num_days = (end - start).days
+        daily_avg = total / num_days if num_days > 0 else 0
+        
+        # Output results
+        if output_json:
+            import json
+            result = {
+                'period': {
+                    'start': start.strftime('%Y-%m-%d'),
+                    'end': end.strftime('%Y-%m-%d'),
+                    'days': num_days
+                },
+                'tag_key': tag_key,
+                'tag_value_filter': tag_value,
+                'tag_costs': [{'tag_value': k, 'cost': v, 'percentage': (v/total*100) if total > 0 else 0} for k, v in sorted_tags],
+                'summary': {
+                    'total': total,
+                    'daily_avg': daily_avg,
+                    'annual_projection': daily_avg * 365
+                }
+            }
+            click.echo(json.dumps(result, indent=2))
+        else:
+            click.echo(f"Tag Value{' '*(30-len('Tag Value'))} | Cost       | %")
+            click.echo("-" * 60)
+            for tag_val, cost in sorted_tags:
+                pct = (cost / total * 100) if total > 0 else 0
+                tag_display = tag_val[:30].ljust(30)
+                click.echo(f"{tag_display} | ${cost:>9,.2f} | {pct:>5.1f}%")
+            click.echo("-" * 60)
+            click.echo(f"{'Total'.ljust(30)} | ${total:>9,.2f} | 100.0%")
+            click.echo("")
+            click.echo(f"Daily Avg: ${daily_avg:,.2f}")
+            click.echo(f"Annual Projection: ${daily_avg * 365:,.0f}")
+        
+    except Exception as e:
+        raise click.ClickException(f"Tag analysis failed: {e}")
+
+
+@cli.command()
+@click.option('--profile', required=True, help='Profile name')
+@click.option('--query', required=True, help='SQL query to execute')
+@click.option('--database', default='athenacurcfn_cloud_intelligence_dashboard', help='Athena database name')
+@click.option('--output-bucket', help='S3 bucket for query results (default: from profile)')
+@click.option('--sso', help='AWS SSO profile name')
+def query(profile, query, database, output_bucket, sso):
+    """
+    Execute custom Athena SQL query on CUR data
+    
+    Example:
+        cc query --profile khoros --query "SELECT line_item_usage_account_id, SUM(line_item_unblended_cost) as cost FROM cloud_intelligence_dashboard WHERE line_item_usage_start_date >= DATE '2025-11-01' GROUP BY 1 ORDER BY 2 DESC LIMIT 10"
+    """
+    # Load profile
+    config = load_profile(profile)
+    
+    # Apply SSO if provided
+    if sso:
+        config['aws_profile'] = sso
+    
+    # Get credentials
+    try:
+        if 'aws_profile' in config:
+            session = boto3.Session(profile_name=config['aws_profile'])
+        else:
+            creds = config['credentials']
+            session = boto3.Session(
+                aws_access_key_id=creds['aws_access_key_id'],
+                aws_secret_access_key=creds['aws_secret_access_key'],
+                aws_session_token=creds.get('aws_session_token')
+            )
+        
+        athena_client = session.client('athena', region_name='us-east-1')
+        
+        # Default output location
+        if not output_bucket:
+            output_bucket = 's3://khoros-finops-athena/athena/'
+        
+        click.echo(f"Executing query on database: {database}")
+        click.echo(f"Output location: {output_bucket}")
+        click.echo("")
+        
+        # Execute query
+        response = athena_client.start_query_execution(
+            QueryString=query,
+            QueryExecutionContext={'Database': database},
+            ResultConfiguration={'OutputLocation': output_bucket}
+        )
+        
+        query_id = response['QueryExecutionId']
+        click.echo(f"Query ID: {query_id}")
+        click.echo("Waiting for query to complete...")
+        
+        # Wait for completion
+        import time
+        max_wait = 60
+        waited = 0
+        while waited < max_wait:
+            status_response = athena_client.get_query_execution(QueryExecutionId=query_id)
+            status = status_response['QueryExecution']['Status']['State']
+            
+            if status == 'SUCCEEDED':
+                click.echo("✓ Query completed successfully")
+                break
+            elif status in ['FAILED', 'CANCELLED']:
+                reason = status_response['QueryExecution']['Status'].get('StateChangeReason', 'Unknown')
+                raise click.ClickException(f"Query {status}: {reason}")
+            
+            time.sleep(2)
+            waited += 2
+        
+        if waited >= max_wait:
+            raise click.ClickException(f"Query timeout after {max_wait}s. Check query ID: {query_id}")
+        
+        # Get results
+        results = athena_client.get_query_results(QueryExecutionId=query_id)
+        
+        # Display results
+        rows = results['ResultSet']['Rows']
+        if not rows:
+            click.echo("No results returned")
+            return
+        
+        # Header
+        headers = [col['VarCharValue'] for col in rows[0]['Data']]
+        click.echo(" | ".join(headers))
+        click.echo("-" * (len(" | ".join(headers))))
+        
+        # Data rows
+        for row in rows[1:]:
+            values = [col.get('VarCharValue', '') for col in row['Data']]
+            click.echo(" | ".join(values))
+        
+        click.echo("")
+        click.echo(f"Returned {len(rows)-1} rows")
+        
+    except Exception as e:
+        raise click.ClickException(f"Query failed: {e}")
+
+
 if __name__ == '__main__':
     cli()

cost_calculator/executor.py

@@ -3,6 +3,7 @@ Executor that routes to either API or local execution.
 """
 import boto3
 import click
+from pathlib import Path
 from cost_calculator.api_client import is_api_configured, call_lambda_api
 
 
@@ -22,6 +23,13 @@ def get_credentials_dict(config):
         try:
             session = boto3.Session(profile_name=config['aws_profile'])
             credentials = session.get_credentials()
+            
+            if credentials is None:
+                raise Exception(
+                    f"Could not get credentials for profile '{config['aws_profile']}'.\n"
+                    f"Run: aws sso login --profile {config['aws_profile']}"
+                )
+            
             frozen_creds = credentials.get_frozen_credentials()
             
             return {
@@ -29,9 +37,44 @@ def get_credentials_dict(config):
                 'secret_key': frozen_creds.secret_key,
                 'session_token': frozen_creds.token
             }
-        except Exception:
-            # If profile not found, return None (API will handle)
-            return None
+        except Exception as e:
+            # Show the actual error instead of silently returning None
+            error_msg = str(e)
+            
+            # If it's an SSO token error, provide better guidance
+            if 'SSO Token' in error_msg or 'sso' in error_msg.lower():
+                # Try to detect if using sso_session format
+                import subprocess
+                try:
+                    result = subprocess.run(
+                        ['grep', '-A', '3', f'profile {config["aws_profile"]}', 
+                         str(Path.home() / '.aws' / 'config')],
+                        capture_output=True,
+                        text=True,
+                        timeout=2
+                    )
+                    if 'sso_session' in result.stdout:
+                        # Extract session name
+                        for line in result.stdout.split('\n'):
+                            if 'sso_session' in line:
+                                session_name = line.split('=')[1].strip()
+                                raise Exception(
+                                    f"Failed to get AWS credentials for profile '{config['aws_profile']}'.\n"
+                                    f"Error: {error_msg}\n\n"
+                                    f"Your profile uses SSO session '{session_name}'.\n"
+                                    f"Try: aws sso login --sso-session {session_name}\n"
+                                    f"(Requires AWS CLI v2.9.0+)\n\n"
+                                    f"Or: aws sso login --profile {config['aws_profile']}\n"
+                                    f"(If using older AWS CLI)"
+                                )
+                except:
+                    pass
+            
+            raise Exception(
+                f"Failed to get AWS credentials for profile '{config['aws_profile']}'.\n"
+                f"Error: {error_msg}\n"
+                f"Try: aws sso login --profile {config['aws_profile']}"
+            )
     else:
         # Use static credentials
         creds = config.get('credentials', {})
@@ -56,32 +99,18 @@ def execute_trends(config, weeks):
     """
     accounts = config['accounts']
     
-    if is_api_configured():
-        # Use API
-        click.echo("Using Lambda API...")
-        credentials = get_credentials_dict(config)
-        return call_lambda_api('trends', credentials, accounts, weeks=weeks)
-    else:
-        # Use local execution
-        click.echo("Using local execution...")
-        from cost_calculator.trends import analyze_trends
-        
-        # Initialize boto3 client
-        if 'aws_profile' in config:
-            session = boto3.Session(profile_name=config['aws_profile'])
-        else:
-            creds = config['credentials']
-            session_kwargs = {
-                'aws_access_key_id': creds['aws_access_key_id'],
-                'aws_secret_access_key': creds['aws_secret_access_key'],
-                'region_name': creds.get('region', 'us-east-1')
-            }
-            if 'aws_session_token' in creds:
-                session_kwargs['aws_session_token'] = creds['aws_session_token']
-            session = boto3.Session(**session_kwargs)
-        
-        ce_client = session.client('ce', region_name='us-east-1')
-        return analyze_trends(ce_client, accounts, weeks)
+    if not is_api_configured():
+        raise Exception(
+            "API not configured. Set COST_API_SECRET environment variable.\n"
+            "Local execution is disabled. Use the Lambda API."
+        )
+    
+    # Use API only
+    click.echo("Using Lambda API...")
+    credentials = get_credentials_dict(config)
+    if not credentials:
+        raise Exception("Failed to get AWS credentials. Check your AWS SSO session.")
+    return call_lambda_api('trends', credentials, accounts, weeks=weeks)
 
 
 def execute_monthly(config, months):
@@ -93,37 +122,23 @@ def execute_monthly(config, months):
     """
     accounts = config['accounts']
     
-    if is_api_configured():
-        # Use API
-        click.echo("Using Lambda API...")
-        credentials = get_credentials_dict(config)
-        return call_lambda_api('monthly', credentials, accounts, months=months)
-    else:
-        # Use local execution
-        click.echo("Using local execution...")
-        from cost_calculator.monthly import analyze_monthly_trends
-        
-        # Initialize boto3 client
-        if 'aws_profile' in config:
-            session = boto3.Session(profile_name=config['aws_profile'])
-        else:
-            creds = config['credentials']
-            session_kwargs = {
-                'aws_access_key_id': creds['aws_access_key_id'],
-                'aws_secret_access_key': creds['aws_secret_access_key'],
-                'region_name': creds.get('region', 'us-east-1')
-            }
-            if 'aws_session_token' in creds:
-                session_kwargs['aws_session_token'] = creds['aws_session_token']
-            session = boto3.Session(**session_kwargs)
-        
-        ce_client = session.client('ce', region_name='us-east-1')
-        return analyze_monthly_trends(ce_client, accounts, months)
+    if not is_api_configured():
+        raise Exception(
+            "API not configured. Set COST_API_SECRET environment variable.\n"
+            "Local execution is disabled. Use the Lambda API."
+        )
+    
+    # Use API only
+    click.echo("Using Lambda API...")
+    credentials = get_credentials_dict(config)
+    if not credentials:
+        raise Exception("Failed to get AWS credentials. Check your AWS SSO session.")
+    return call_lambda_api('monthly', credentials, accounts, months=months)
 
 
 def execute_drill(config, weeks, service_filter=None, account_filter=None, usage_type_filter=None, resources=False):
     """
-    Execute drill-down analysis via API or locally.
+    Execute drill-down analysis via API.
     
     Args:
         config: Profile configuration
@@ -138,86 +153,31 @@ def execute_drill(config, weeks, service_filter=None, account_filter=None, usage
     """
     accounts = config['accounts']
     
+    if not is_api_configured():
+        raise Exception(
+            "API not configured. Set COST_API_SECRET environment variable.\n"
+            "Local execution is disabled. Use the Lambda API."
+        )
+    
+    # Use API only
+    click.echo("Using Lambda API...")
+    credentials = get_credentials_dict(config)
+    if not credentials:
+        raise Exception("Failed to get AWS credentials. Check your AWS SSO session.")
+    
+    kwargs = {'weeks': weeks}
+    if service_filter:
+        kwargs['service'] = service_filter
+    if account_filter:
+        kwargs['account'] = account_filter
+    if usage_type_filter:
+        kwargs['usage_type'] = usage_type_filter
     if resources:
-        # Resource-level drill requires service filter
         if not service_filter:
             raise click.ClickException("--service is required when using --resources flag")
-        
-        if is_api_configured():
-            # Use API
-            click.echo("Using Lambda API for CUR resource query...")
-            credentials = get_credentials_dict(config)
-            kwargs = {
-                'weeks': weeks,
-                'service': service_filter,
-                'resources': True
-            }
-            if account_filter:
-                kwargs['account'] = account_filter
-            return call_lambda_api('drill', credentials, accounts, **kwargs)
-        else:
-            # Use local Athena client
-            click.echo("Using local Athena client for CUR resource query...")
-            from cost_calculator.cur import query_cur_resources
-            
-            # Initialize boto3 session
-            if 'aws_profile' in config:
-                session = boto3.Session(profile_name=config['aws_profile'])
-            else:
-                creds = config['credentials']
-                session_kwargs = {
-                    'aws_access_key_id': creds['aws_access_key_id'],
-                    'aws_secret_access_key': creds['aws_secret_access_key'],
-                    'region_name': creds.get('region', 'us-east-1')
-                }
-                if 'aws_session_token' in creds:
-                    session_kwargs['aws_session_token'] = creds['aws_session_token']
-                session = boto3.Session(**session_kwargs)
-            
-            athena_client = session.client('athena', region_name='us-east-1')
-            return query_cur_resources(
-                athena_client, accounts, service_filter, account_filter, weeks
-            )
-    else:
-        # Standard drill-down via Cost Explorer
-        if is_api_configured():
-            # Use API
-            click.echo("Using Lambda API...")
-            credentials = get_credentials_dict(config)
-            kwargs = {'weeks': weeks}
-            if service_filter:
-                kwargs['service'] = service_filter
-            if account_filter:
-                kwargs['account'] = account_filter
-            if usage_type_filter:
-                kwargs['usage_type'] = usage_type_filter
-            return call_lambda_api('drill', credentials, accounts, **kwargs)
-        else:
-            # Use local execution
-            click.echo("Using local execution...")
-            from cost_calculator.drill import analyze_drill_down
-            
-            # Initialize boto3 client
-            if 'aws_profile' in config:
-                session = boto3.Session(profile_name=config['aws_profile'])
-            else:
-                creds = config['credentials']
-                session_kwargs = {
-                    'aws_access_key_id': creds['aws_access_key_id'],
-                    'aws_secret_access_key': creds['aws_secret_access_key'],
-                    'region_name': creds.get('region', 'us-east-1')
-                }
-                if 'aws_session_token' in creds:
-                    session_kwargs['aws_session_token'] = creds['aws_session_token']
-                session = boto3.Session(**session_kwargs)
-            
-            ce_client = session.client('ce', region_name='us-east-1')
-            return analyze_drill_down(
-                ce_client, accounts, weeks,
-                service_filter=service_filter,
-                account_filter=account_filter,
-                usage_type_filter=usage_type_filter
-            )
+        kwargs['resources'] = True
+    
+    return call_lambda_api('drill', credentials, accounts, **kwargs)
 
 
 def execute_analyze(config, weeks, analysis_type, pattern=None, min_cost=None):

cost_calculator/forensics.py

@@ -236,7 +236,8 @@ def format_investigation_report(cost_data, inventories, cloudtrail_data=None):
         report.append("")
         
         for inv in inventories:
-            report.append(f"### Account {inv['account_id']} ({inv['profile']})")
+            profile_name = inv.get('profile', inv['account_id'])
+            report.append(f"### Account {inv['account_id']} ({profile_name})")
             report.append(f"**Region:** {inv['region']}")
             report.append("")
             
@@ -288,7 +289,8 @@ def format_investigation_report(cost_data, inventories, cloudtrail_data=None):
         report.append("")
         
         for ct in cloudtrail_data:
-            report.append(f"### Account {ct['account_id']} ({ct['profile']})")
+            profile_name = ct.get('profile', ct['account_id'])
+            report.append(f"### Account {ct['account_id']} ({profile_name})")
             report.append(f"**Period:** {ct['start_date'][:10]} to {ct['end_date'][:10]}")
             report.append("")
             

aws_cost_calculator_cli-1.8.2.dist-info/RECORD

@@ -1,15 +0,0 @@
-aws_cost_calculator_cli-1.8.2.dist-info/licenses/LICENSE,sha256=cYtmQZHNGGTXOtg3T7LHDRneleaH0dHXHfxFV3WR50Y,1079
-cost_calculator/__init__.py,sha256=PJeIqvWh5AYJVrJxPPkI4pJnAt37rIjasrNS0I87kaM,52
-cost_calculator/api_client.py,sha256=4ZI2XcGIN3FBeQqb7xOxQ91kCoeM43-rExiOELXoKBQ,2485
-cost_calculator/cli.py,sha256=jkyPlHAdVgpk5LrP1T9YvBK4-K6hM5fd538VqIHw-7A,52255
-cost_calculator/cur.py,sha256=QaZ_nyDSw5_cti-h5Ho6eYLbqzY5TWoub24DpyzIiSs,9502
-cost_calculator/drill.py,sha256=hGi-prLgZDvNMMICQc4fl3LenM7YaZ3To_Ei4LKwrdc,10543
-cost_calculator/executor.py,sha256=aWLELeisDu6b-5U5LDPDPnK5uJKilYcoUPerxPUqtYg,10435
-cost_calculator/forensics.py,sha256=Ny5IbMhJF6kawQDiLDExQGb5C-zRDbbmziS5JoinmdA,12694
-cost_calculator/monthly.py,sha256=6k9F8S7djhX1wGV3-T1MZP7CvWbbfhSTEaddwCfVu5M,7932
-cost_calculator/trends.py,sha256=k_s4ylBX50sqoiM_fwepi58HW01zz767FMJhQUPDznk,12246
-aws_cost_calculator_cli-1.8.2.dist-info/METADATA,sha256=wCkJT5XL6m3ESmbK0mdfzSpkWiJn9PJQ6nuUBelILXU,11978
-aws_cost_calculator_cli-1.8.2.dist-info/WHEEL,sha256=Nw36Djuh_5VDukK0H78QzOX-_FQEo6V37m3nkm96gtU,91
-aws_cost_calculator_cli-1.8.2.dist-info/entry_points.txt,sha256=_5Qy4EcHbYVYrdgOu1E48faMHb9fLUl5VJ3djDHuJBo,47
-aws_cost_calculator_cli-1.8.2.dist-info/top_level.txt,sha256=PRwGPPlNqASfyhGHDjSfyl4SXeE7GF3OVTu1tY1Uqyc,16
-aws_cost_calculator_cli-1.8.2.dist-info/RECORD,,