skilldrop-cli 0.16.3__py3-none-any.whl

skilldrop_cli/data/packs/sre-oncall/skills/capacity-cost-model/templates/cost-model.md

@@ -0,0 +1,68 @@
+# Capacity & cost-model template
+
+Demand first, unit costs always, ranges not points, cliffs named. Every unit price tagged with source + date.
+
+```markdown
+# Capacity & cost model: {service / feature}
+
+**Date:** {YYYY-MM-DD} · **Cloud/region:** {provider, region}
+
+## Assumptions that most move the total (top 3)
+
+- {driver value, headroom choice, or unit price the answer is most sensitive to} `[data|estimate]`
+
+## Demand model
+
+| Driver | Current | Growth | Peak : average | Source |
+|---|---|---|---|---|
+| {requests/sec | tenants | GB | events/day} | {value} | {curve, e.g. 8%/mo} | {e.g. 4:1} | `[data: …]` |
+
+## Components (quantity × unit price)
+
+| Component | Quantity (from demand) | Unit price (source, date) | Monthly (expected) | Range |
+|---|---|---|---|---|
+| Compute | {peak/autoscale} | {$/…} `[src 2026-06]` | {$} | {low–high} |
+| Storage | {GB, cumulative} | {$/GB-mo} | {$} | |
+| Egress | {GB out} | {$/GB} | {$} | |
+| Managed: {db/cache/search} | {tier/nodes} | {$/node} | {$} | |
+| Observability | {GB ingest, series} | {$/GB} | {$} | |
+| Backups/DR | {GB × retention × copies} | {$/GB-mo} | {$} | |
+| Non-prod | {fraction of prod} | — | {$} | |
+| Always-on (NAT/LB/floor) | {24/7 units} | {$/hr} | {$} | |
+| **Total (average load)** | | | **{$ range}** | |
+| **Total (peak provisioned)** | | | **{$ range}** | |
+
+## Unit economics
+
+- Cost per {request | tenant | 1k events | GB}: **{$ expected (range)}**
+- Dominated by: {the line item driving it}
+
+## Growth scenarios & cliffs
+
+| Scale | Monthly cost (range) | Cost per unit | Cliff hit? |
+|---|---|---|---|
+| 1× (today) | {$} | {$/unit} | — |
+| 3× | {$} | {$/unit} | {none / names it} |
+| 10× | {$} | {$/unit} | **{e.g. search → sharded cluster, +$3k step at ~6×}** |
+
+**Unit-cost trend:** {flat / declining / ⚠ rising — and why if rising}
+
+## Cost-driver ranking (optimize these, not the rounding error)
+
+1. {line item} — {% of total} — {lever to reduce}
+2. …
+
+## Forgotten-costs checklist
+
+{egress · cross-AZ · observability · backups×retention×copies · non-prod · NAT/LB ·
+idle floor · support/licenses · migration egress · free-tier expiry — each: ✅ included / n/a (reason)}
+
+## Headroom decision
+
+Target utilization {x%}; buffer = peak × {multiplier} for {failover + spike}; {autoscale | static} because {peak:avg ratio}. Tradeoff accepted: {money vs incident}.
+
+## Guardrails
+
+- Budget alert at {threshold}; hard stop / review at {threshold}.
+- Unit-cost regression: alert if cost-per-{unit} rises > {x%} quarter-over-quarter.
+```

skilldrop_cli/data/packs/sre-oncall/skills/cloud-cost-review/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: cloud-cost-review
+description: Review actual cloud spend from a cost export (AWS CUR or Data Exports, GCP billing export, Azure cost details) and produce a ranked savings report — idle and unattached resources, oversized instances backed by utilisation evidence, storage tiering, data transfer hot spots, commitment coverage and untagged spend — each finding with a monthly saving computed from the bill, a confidence level and an ease rating. Use when the user shares a cost CSV and says "where are we wasting money", "review our AWS bill", "why did the cloud bill jump this month", "find savings in our GCP/Azure spend", or "should we buy savings plans".
+---
+
+# cloud-cost-review
+
+Reads what the organisation actually spent, from a billing export, and produces a short list of savings ranked by size and effort. A script aggregates the export: totals by service, account and tag, month-over-month change, top movers, hot spots, untagged share and commitment coverage. The skill turns that into findings. Each finding has a saving worked out from the bill, a confidence level, and the evidence still needed before anyone acts.
+
+This looks backward at a real bill. `capacity-cost-model` looks forward: it sizes a service from a demand driver before launch and projects cost at 1×, 3× and 10×. If the user has no bill yet, or asks "what will this cost", that is `capacity-cost-model`.
+
+## How to respond
+
+1. **Ask once for what is missing, then proceed.** Ask at most 2 questions:
+   - **The export and its source** (AWS CUR or CUR 2.0, GCP billing export, Azure cost details, or something else). The script detects the format from the header. Cost Explorer's "Download CSV" is a summary, not line items. Ask for CUR or Data Exports, or reshape it to the generic layout in [`reference.md`](reference.md).
+   - **The tag keys that carry ownership** (for example `team`, `env`, `cost-center`). Without one, untagged share can't be measured.
+   Default to the latest month in the file compared with the month before it. Two months of daily data is the minimum for a useful review. Say so if the file has less.
+
+2. **Run the script and read its output before writing findings.**
+
+   ```bash
+   # Claude Code
+   python3 "${CLAUDE_SKILL_DIR}/scripts/cost_summary.py" cost.csv \
+     --tag team --tag env --top 10 --out out/cost-summary.md --json out/cost-summary.json
+
+   # Other IDEs (from the skill folder)
+   python3 scripts/cost_summary.py cost.csv \
+     --tag team --tag env --top 10 --out out/cost-summary.md --json out/cost-summary.json
+   ```
+
+   - Check the "Column mapping used" section. If a field mapped to the wrong column, or didn't map, rerun with `--format` or rename the column. Don't reason from a mis-mapped total.
+   - Read the notes:
+     - A partial month means change columns are per day.
+     - A monthly-grain export can't show a steady on-demand floor.
+     - Missing tag keys mean the tag name is wrong.
+   - Exit 2 means bad input: the file, line and problem are in the message. Fix the input and rerun.
+
+3. **Check each category in [`reference.md`](reference.md) against the output.** For each one, read the evidence the bill gives and name the evidence it doesn't:
+
+   | Category | What the bill shows | What it can't show, and where to get it |
+   |---|---|---|
+   | Idle and unattached | Idle address lines, volumes and snapshots with steady cost | Whether a volume is attached or an IP is in use: the provider CLI (commands in the reference) |
+   | Oversized instances | Instance type, hours, cost | CPU and memory use. Get two or more weeks of CPU and memory metrics, or a rightsizing tool's report. **No evidence, no saving figure.** |
+   | Storage tiering | Storage class line items and their growth | Access pattern: storage analytics or access logs |
+   | Data transfer hot spots | NAT, inter-zone, inter-region and egress lines and their movement | Source and destination: flow logs |
+   | Commitment coverage | On-demand vs covered compute, utilisation, daily on-demand floor | Future plans for the workload: ask the owner |
+   | Untagged spend | Untagged share, of all spend and of spend with a resource id | Who owns it: the account or project owner |
+
+4. **Estimate each saving from the bill, and show the arithmetic.**
+   - ✅ *"Two always-on m6i.2xlarge web instances cost $552.96/month on demand. This bill shows the existing savings plan covering the same type at 31.0% below on-demand ($190.80 effective vs $276.48 on-demand equivalent). Covering both saves about $171/month."*
+   - ❌ *"Buying savings plans could save 30–70%."* That is a brochure range, not this bill.
+   - Take discount rates from the user's own bill, the provider's recommendation report, or a price the user supplies. If none of those exist, give the formula and leave the rate as an input. Never type a list price from memory.
+   - A finding whose saving can't be computed from the evidence at hand goes in **Evidence needed**, with what to collect. It doesn't get an invented number.
+
+5. **Rate confidence and ease, then rank.**
+   - **Confidence:**
+     - **High:** the bill alone proves it (an idle-address line, a measured coverage gap).
+     - **Medium:** one fact still needs checking (is the volume attached?).
+     - **Low:** depends on evidence not yet collected.
+   - **Ease:**
+     - **3:** a config change or deletion, no service impact.
+     - **2:** a change that needs a test or a maintenance window.
+     - **1:** a re-architecture, or a purchase that needs approval.
+   - Rank by monthly saving × ease, and show confidence next to each finding.
+   - Then set the order of work: waste removal comes before any commitment purchase, whatever their ranks. Size a commitment on the on-demand floor that is left after cleanup. Committing to spend you are about to delete locks in the waste.
+
+6. **Explain the month-over-month change in one paragraph.** Start from the top movers. ✅ *"Usage rose $1,481 (+24.4%). $1,099 of that is NAT gateway data processing in account 111111111111."*
+
+7. **Emit the report** with [`templates/cost-review.md`](templates/cost-review.md):
+   - the scope line (export, months, cost basis)
+   - the month-over-month paragraph
+   - the ranked findings table
+   - each finding with evidence, arithmetic, confidence, ease and the action
+   - evidence needed
+   - untagged spend and ownership
+   - what was excluded (tax, credits, commitment fees)
+   Hand a logging or metrics cost hot spot to `observability-plan` for a telemetry budget. Hand a forward projection to `capacity-cost-model`.
+
+**Non-interactive runs** (subagent, CI, headless): the month defaults to the latest in the file, and a missing tag key means untagged share is reported as "not measured". Both are tagged `[assumption]` at the top. With no export, emit `BLOCKED: need a cost export CSV (AWS CUR/Data Exports, GCP billing export, Azure cost details, or the generic layout)`. Never produce a saving figure that the script output and the stated evidence don't support.
+
+## Useful references in this skill
+
+- [`reference.md`](reference.md): field mapping for each provider's export, how line-item types are treated, the evidence each category needs and how to get it, saving formulas, and the confidence and ease scales
+- [`templates/cost-review.md`](templates/cost-review.md): the report skeleton
+- [`examples/acme-aws-september.md`](examples/acme-aws-september.md): the sample CUR export in this folder, the script's real output, and the review written from it
+- [`scripts/cost_summary.py`](scripts/cost_summary.py): the aggregator (stdlib, Python 3.9+)
+
+## Quality bar
+
+- **Every amount traces to the script output or to arithmetic shown in the finding.** No list prices from memory, and no "industry average" savings percentages.
+- **Rightsizing needs utilisation evidence.** An instance finding without CPU and memory data goes under Evidence needed, not in the ranked table.
+- **Each finding has a monthly saving, a confidence level and an ease rating**, or sits in Evidence needed with what to collect.
+- **Ranked by saving × ease, and sequenced so waste removal happens before any commitment purchase.**
+- **The month-over-month change is explained by named movers**, not described as "costs went up".
+- **Untagged share is reported** both against all spend and against spend that has a resource id, because data transfer and support lines often can't be tagged.
+- **Excluded lines are stated.** Tax, credits, refunds and commitment fees are listed separately so the review doesn't hide credits that mask waste.
+
+## When to use this skill
+
+- ✅ "Here's our CUR for August and September. Where's the waste?"
+- ✅ "Why did the bill jump this month?"
+- ✅ Deciding whether to buy more savings plans, reserved instances or committed use discounts.
+- ✅ Measuring untagged spend before a chargeback or showback rollout.
+
+## When NOT to use this skill
+
+- ❌ Estimating cost before launch, or projecting at 3× or 10× growth. Use `capacity-cost-model`.
+- ❌ Designing telemetry or a logging budget from scratch. Use `observability-plan`, though this skill flags logging cost as a hot spot.
+- ❌ Writing up an incident, including a cost spike from a runaway job. Use `postmortem-generator`.
+- ❌ Reporting AI tool usage or spend by user. Use `ai-usage-report`.
+- ❌ Defining business KPIs for a feature or product. Use `success-metrics`.
+
+## Anti-patterns to avoid
+
+- ❌ **Rightsizing from the bill alone.** An r6i.4xlarge costing $726/month says nothing about whether it is busy. Get the utilisation data.
+- ❌ **Committing before cleaning up.** Sizing a savings plan on an on-demand floor that includes a staging box you are about to stop locks in waste for a year or more.
+- ❌ **Brochure percentages.** "Spot saves up to 90%" is not a finding about this bill.
+- ❌ **Netting credits into usage.** A $250 credit makes a wasteful month look flat. Keep credits on their own line.
+- ❌ **Comparing a partial month with a full one.** Ten days of October against all of September always looks like a saving.
+- ❌ **Treating all untagged spend as a tagging failure.** Data transfer without a resource id can't carry a tag. Report it separately.
+- ❌ **A 40-item list.** Five findings with real numbers get acted on. Forty with guesses don't.

skilldrop_cli/data/packs/sre-oncall/skills/cloud-cost-review/evals/eval_queries.json

@@ -0,0 +1,34 @@
+[
+  {
+    "query": "Here's our AWS CUR for the last two months \u2014 where are we wasting money?",
+    "should_trigger": true
+  },
+  {
+    "query": "Why did our Azure bill jump in September? Cost export attached",
+    "should_trigger": true
+  },
+  {
+    "query": "Review this GCP billing export for idle resources, untagged spend and committed use coverage",
+    "should_trigger": true
+  },
+  {
+    "query": "Should we buy more savings plans? Here's the cost and usage report",
+    "should_trigger": true
+  },
+  {
+    "query": "Estimate what the new search service will cost to run at 10x our current traffic",
+    "should_trigger": false
+  },
+  {
+    "query": "Our log volume is out of control \u2014 design what we should log, sample, and alert on",
+    "should_trigger": false
+  },
+  {
+    "query": "Write the postmortem for the runaway batch job that burned $40k last weekend",
+    "should_trigger": false
+  },
+  {
+    "query": "Report how much each engineer spent on Claude and Cursor this month from the usage log",
+    "should_trigger": false
+  }
+]

skilldrop_cli/data/packs/sre-oncall/skills/cloud-cost-review/evals/evals.json

@@ -0,0 +1,29 @@
+{
+  "skill_name": "cloud-cost-review",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Attached is Northwind's AWS Cost and Usage Report for August and September 2026 (daily, legacy CUR columns, tags resourceTags/user:team and resourceTags/user:env). The September bill went up about 20%. Where are we wasting money, and should we buy more savings plans? We have no CloudWatch or Compute Optimizer data handy.",
+      "assertions": [
+        "Runs scripts/cost_summary.py on the export and bases every amount on its output or on arithmetic shown in the finding",
+        "Explains the month-over-month change by naming the top movers with amounts, not just the total",
+        "Does not recommend downsizing any specific instance with a saving figure, because no utilisation data was provided; instance sizing goes under Evidence needed",
+        "Each ranked finding has a monthly saving, a confidence level and an ease rating, and the table is ordered by saving \u00d7 ease",
+        "Sizes any savings plan recommendation on the daily on-demand floor after waste removal, using a discount rate from the bill or a provider recommendation, not a remembered list price or a brochure range",
+        "Reports untagged share for team (and env), separating spend with no resource id",
+        "Lists tax, credits and commitment fees separately rather than netting them into usage",
+        "Does not invent resources, prices or utilisation figures not present in the export or the prompt"
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Here's Acme's GCP billing export flattened to CSV (usage_start_time, project_id, service_description, sku_description, cost, credits_total, labels) for September only. Find savings.",
+      "assertions": [
+        "States that with one month there is no month-over-month change or movers list",
+        "States that committed use discount coverage can't be computed from the GCP export and points to the console's CUD analysis",
+        "Treats credits as netted into cost and says so",
+        "Does not invent a prior month or savings percentages"
+      ]
+    }
+  ]
+}

skilldrop_cli/data/packs/sre-oncall/skills/cloud-cost-review/examples/acme-aws-september.md

@@ -0,0 +1,247 @@
+# Example: Acme, AWS, September vs August 2026
+
+Acme's platform lead shared two months of a daily legacy CUR export and asked: "Where are we wasting money, and why did September go up?"
+
+## Input
+
+[`acme-cur-2026-08-09.csv`](acme-cur-2026-08-09.csv): 1,084 synthetic line items, 2026-08-01 to 2026-09-30, daily. Two accounts: 111111111111 (prod) and 222222222222 (staging). The ownership tag is `team`. It holds a subset of the real CUR columns: the ones the script maps, plus `resourceTags/user:team` and `resourceTags/user:env`. All amounts are made up for illustration and are not AWS list prices.
+
+## Command
+
+```bash
+python3 scripts/cost_summary.py examples/acme-cur-2026-08-09.csv --tag team --top 8 --out out/summary.md
+```
+
+## Script output (real, unedited)
+
+```markdown
+# Cloud cost summary: 2026-09 vs 2026-08
+
+Format: aws-cur. Days with data: 2026-09=30, 2026-08=31. Change basis: monthly totals. Amounts are usage line items at effective cost; tax, credits, refunds and commitment fees are listed separately.
+
+| | 2026-09 | 2026-08 | Change |
+|---|---:|---:|---:|
+| Usage cost | $7,560.14 | $6,078.69 | $1,481.45 (+24.4%) |
+| Commitment fees | $190.80 | $197.16 | |
+| Tax | $455.12 | $412.37 | |
+| Credits and discounts | -$250.00 | -$250.00 | |
+| Excluded (savings plan negation) | -$276.48 | -$285.70 | |
+
+## By service
+
+| Service | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| Amazon Elastic Compute Cloud | $3,934.83 | $2,690.71 | $1,244.13 | +46.2% | 52.0% |
+| Amazon Simple Storage Service | $1,149.63 | $977.50 | $172.13 | +17.6% | 15.2% |
+| AmazonCloudWatch | $1,040.76 | $925.58 | $115.19 | +12.4% | 13.8% |
+| AWS Data Transfer | $808.51 | $837.63 | -$29.12 | -3.5% | 10.7% |
+| Amazon Relational Database Service | $619.20 | $639.84 | -$20.64 | -3.2% | 8.2% |
+| Amazon Virtual Private Cloud | $7.20 | $7.44 | -$0.24 | -3.2% | 0.1% |
+
+## By account / project / subscription
+
+| Account | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| 111111111111 | $6,778.79 | $5,271.30 | $1,507.49 | +28.6% | 89.7% |
+| 222222222222 | $781.35 | $807.39 | -$26.04 | -3.2% | 10.3% |
+
+## By region
+
+| Region | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| us-east-1 | $7,560.14 | $6,078.69 | $1,481.45 | +24.4% | 100.0% |
+
+## Top movers (service / usage type)
+
+| Line | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| Amazon Elastic Compute Cloud / USE1-NatGateway-Bytes | $1,657.73 | $559.05 | $1,098.68 | +196.5% | 21.9% |
+| Amazon Simple Storage Service / TimedStorage-ByteHrs | $1,149.63 | $977.50 | $172.13 | +17.6% | 15.2% |
+| Amazon Elastic Compute Cloud / USE1-DataTransfer-Regional-Bytes | $457.33 | $294.16 | $163.17 | +55.5% | 6.0% |
+| AmazonCloudWatch / USE1-DataProcessing-Bytes | $1,040.76 | $925.58 | $115.19 | +12.4% | 13.8% |
+| Amazon Elastic Compute Cloud / USE1-EBS:SnapshotUsage | $171.17 | $138.75 | $32.42 | +23.4% | 2.3% |
+| AWS Data Transfer / USE1-DataTransfer-Out-Bytes | $808.51 | $837.63 | -$29.12 | -3.5% | 10.7% |
+| Amazon Elastic Compute Cloud / USE1-BoxUsage:r6i.4xlarge | $725.76 | $749.95 | -$24.19 | -3.2% | 9.6% |
+| Amazon Elastic Compute Cloud / USE1-BoxUsage:m6i.2xlarge | $842.06 | $865.32 | -$23.26 | -2.7% | 11.1% |
+
+## Top resources by current cost
+
+| Resource / service / usage type | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| nat-0c9prod / Amazon Elastic Compute Cloud / USE1-NatGateway-Bytes | $1,657.73 | $559.05 | $1,098.68 | +196.5% | 21.9% |
+| acme-logs-archive / Amazon Simple Storage Service / TimedStorage-ByteHrs | $1,149.63 | $977.50 | $172.13 | +17.6% | 15.2% |
+| i-0b7stgbatch / Amazon Elastic Compute Cloud / USE1-BoxUsage:r6i.4xlarge | $725.76 | $749.95 | -$24.19 | -3.2% | 9.6% |
+| arn:aws:rds:us-east-1:111111111111:db:payments-primary / Amazon Relational Database Service / USE1-InstanceUsage:db.r6g.2xlarge | $619.20 | $639.84 | -$20.64 | -3.2% | 8.2% |
+| i-0a1c3web02 / Amazon Elastic Compute Cloud / USE1-BoxUsage:m6i.2xlarge | $276.48 | $285.70 | -$9.22 | -3.2% | 3.7% |
+| i-0a1c3web03 / Amazon Elastic Compute Cloud / USE1-BoxUsage:m6i.2xlarge | $276.48 | $285.70 | -$9.22 | -3.2% | 3.7% |
+| i-0a1c3web01 / Amazon Elastic Compute Cloud / USE1-BoxUsage:m6i.2xlarge | $190.80 | $197.16 | -$6.36 | -3.2% | 2.5% |
+| snap-group-prod / Amazon Elastic Compute Cloud / USE1-EBS:SnapshotUsage | $171.17 | $138.75 | $32.42 | +23.4% | 2.3% |
+
+## Tag `team`
+
+| Month | Untagged cost | Untagged share | Untagged share of spend with a resource id | Spend with no resource id |
+|---|---:|---:|---:|---:|
+| 2026-08 | $2,916.68 | 48.0% | 44.4% | $2,057.36 |
+| 2026-09 | $3,196.82 | 42.3% | 36.8% | $2,306.60 |
+
+| Value of team | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| (untagged) | $3,196.82 | $2,916.68 | $280.14 | +9.6% | 42.3% |
+| platform | $2,902.06 | $1,656.85 | $1,245.21 | +75.2% | 38.4% |
+| web | $842.06 | $865.32 | -$23.26 | -2.7% | 11.1% |
+| payments | $619.20 | $639.84 | -$20.64 | -3.2% | 8.2% |
+
+Top services with no `team` tag:
+
+| Service | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| Amazon Elastic Compute Cloud | $1,231.47 | $1,094.11 | $137.36 | +12.6% | 16.3% |
+| Amazon Simple Storage Service | $1,149.63 | $977.50 | $172.13 | +17.6% | 15.2% |
+| AWS Data Transfer | $808.51 | $837.63 | -$29.12 | -3.5% | 10.7% |
+| Amazon Virtual Private Cloud | $7.20 | $7.44 | -$0.24 | -3.2% | 0.1% |
+
+## Hot spots
+
+| Category | Current | Previous | Share of usage |
+|---|---:|---:|---:|
+| nat gateway | $1,690.13 | $592.53 | 22.4% |
+| data transfer | $1,265.84 | $1,131.79 | 16.7% |
+| idle address | $7.20 | $7.44 | 0.1% |
+| snapshot | $171.17 | $138.75 | 2.3% |
+| storage | $1,198.02 | $1,027.50 | 15.8% |
+| observability | $1,040.76 | $925.58 | 13.8% |
+
+Top nat gateway lines (account / region / service / usage type):
+
+| Line | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| 111111111111 / us-east-1 / Amazon Elastic Compute Cloud / USE1-NatGateway-Bytes | $1,657.73 | $559.05 | $1,098.68 | +196.5% | 21.9% |
+| 111111111111 / us-east-1 / Amazon Elastic Compute Cloud / USE1-NatGateway-Hours | $32.40 | $33.48 | -$1.08 | -3.2% | 0.4% |
+
+Top data transfer lines (account / region / service / usage type):
+
+| Line | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| 111111111111 / us-east-1 / AWS Data Transfer / USE1-DataTransfer-Out-Bytes | $808.51 | $837.63 | -$29.12 | -3.5% | 10.7% |
+| 111111111111 / us-east-1 / Amazon Elastic Compute Cloud / USE1-DataTransfer-Regional-Bytes | $457.33 | $294.16 | $163.17 | +55.5% | 6.0% |
+
+Top idle address lines (account / region / service / usage type):
+
+| Line | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| 222222222222 / us-east-1 / Amazon Virtual Private Cloud / USE1-PublicIPv4:IdleAddress | $7.20 | $7.44 | -$0.24 | -3.2% | 0.1% |
+
+Top snapshot lines (account / region / service / usage type):
+
+| Line | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| 111111111111 / us-east-1 / Amazon Elastic Compute Cloud / USE1-EBS:SnapshotUsage | $171.17 | $138.75 | $32.42 | +23.4% | 2.3% |
+
+Top storage lines (account / region / service / usage type):
+
+| Line | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| 111111111111 / us-east-1 / Amazon Simple Storage Service / TimedStorage-ByteHrs | $1,149.63 | $977.50 | $172.13 | +17.6% | 15.2% |
+| 222222222222 / us-east-1 / Amazon Elastic Compute Cloud / USE1-EBS:VolumeUsage.gp2 | $48.39 | $50.00 | -$1.61 | -3.2% | 0.6% |
+
+Top observability lines (account / region / service / usage type):
+
+| Line | Current | Previous | Change | Change % | Share |
+|---|---:|---:|---:|---:|---:|
+| 111111111111 / us-east-1 / AmazonCloudWatch / USE1-DataProcessing-Bytes | $1,040.76 | $925.58 | $115.19 | +12.4% | 13.8% |
+
+## Commitments (2026-09, compute usage)
+
+| Measure | Value |
+|---|---:|
+| compute on demand | $1,996.22 |
+| compute covered on demand equivalent | $276.48 |
+| compute covered effective cost | $190.80 |
+| compute spot | $0.00 |
+| compute pricing unknown | $0.00 |
+| commitment fees | $190.80 |
+| unused commitment lines | $0.00 |
+| on demand: Amazon Elastic Compute Cloud | $1,377.02 |
+| on demand: Amazon Relational Database Service | $619.20 |
+| coverage (covered / covered + on demand, on-demand-equivalent basis) | 12.2% |
+| utilisation estimate (covered effective cost / commitment fees) | 100.0% |
+| daily on demand compute min | $63.26 |
+| daily on demand compute p10 | $63.26 |
+| daily on demand compute median | $67.10 |
+| daily on demand min: Amazon Elastic Compute Cloud | $42.62 |
+| daily on demand min: Amazon Relational Database Service | $20.64 |
+
+## Column mapping used
+
+- date: lineItem/UsageStartDate
+- cost: lineItem/UnblendedCost
+- service: product/ProductName
+- account: lineItem/UsageAccountId
+- region: product/region
+- usage_type: lineItem/UsageType
+- resource_id: lineItem/ResourceId
+- line_type: lineItem/LineItemType
+- sp_effective: savingsPlan/SavingsPlanEffectiveCost
+- tag_columns: resourceTags/user:env, resourceTags/user:team
+- tag keys found: env, team
+```
+
+## Review the skill writes from that output
+
+**Export:** AWS legacy CUR, daily, two full months. **Basis:** usage at effective cost. Tax ($455.12), a $250.00 credit, commitment fees ($190.80) and savings plan negation (-$276.48) are listed separately. **Assumptions to confirm:** none. The user named the tag key.
+
+### What changed
+
+Usage rose $1,481.45 (+24.4%), from $6,078.69 to $7,560.14. Four lines explain more than all of it:
+- NAT gateway data processing in 111111111111 (`USE1-NatGateway-Bytes`): +$1,098.68, nearly tripling
+- S3 standard storage in `acme-logs-archive`: +$172.13
+- Inter-AZ transfer (`DataTransfer-Regional-Bytes`): +$163.17
+- CloudWatch log ingestion: +$115.19
+
+The steady lines (instances, RDS, idle IPs) are down 3.2% only because September has 30 days.
+
+### Ranked findings
+
+| # | Finding | Monthly saving | Confidence | Ease | Rank score | Action |
+|---|---|---:|---|---:|---:|---|
+| 1 | Staging r6i.4xlarge runs 24×7 | $459.65 | Medium | 2 | 919.30 | Schedule it to weekday hours once the owner confirms no overnight jobs |
+| 2 | Prod web on-demand floor not covered by the savings plan | $171.36 | High | 1 | 171.36 | Add Compute Savings Plan commitment for two m6i.2xlarge, **after** findings 1, 3 and 4 |
+| 3 | 500 GB gp2 volume in staging, untagged | $48.39 | Medium | 3 | 145.17 | Snapshot and delete if unattached |
+| 4 | Two idle public IPv4 addresses in staging | $7.20 | High | 3 | 21.60 | Release them |
+
+**1. Staging r6i.4xlarge runs 24×7.**
+- **Evidence:** `i-0b7stgbatch` in 222222222222 costs $725.76 in September. It is on demand, flat every day, and has no `team` tag.
+- **Arithmetic:** running 12 hours on each of September's 22 weekdays is 264 of 720 hours. $725.76 × (1 − 264/720) = $459.65.
+- **Check before acting:** the name suggests batch work, which may run overnight. Ask the owner, and check scheduled jobs. Rightsizing it is a separate question: the bill holds no CPU or memory data, so that goes under Evidence needed.
+- **Action:** an instance scheduler for weekday hours. Tag the instance `team` while you're there.
+
+**2. Prod web on-demand floor not covered.**
+- **Evidence:** coverage is 12.2% and utilisation 100.0%. The daily on-demand EC2 floor is $42.62. $24.19 of that is the staging instance from finding 1. The other $18.43 is two always-on m6i.2xlarge (`i-0a1c3web02`, `i-0a1c3web03`).
+- **Arithmetic:** the existing plan covers the same instance type at $190.80 effective against $276.48 on-demand equivalent, a rate 30.99% below on demand, observed in this bill. Two instances × $276.48 = $552.96 on demand, × 30.99% = $171.36 a month.
+- **Check before acting:** that both web instances will run for the plan's term. The weekday-only `i-0a1c3web04` stays on demand because it is not in the floor.
+- **Action:** do this after findings 1, 3 and 4, so the staging instance never enters the commitment. The RDS instance ($619.20 on demand) needs a reserved instance, not a savings plan. See Evidence needed.
+
+**3. Unattached-looking gp2 volume.**
+- **Evidence:** `vol-0dead5stg` costs $48.39, the same every day in staging, with no tag.
+- **Check before acting:** `aws ec2 describe-volumes --filters Name=status,Values=available` in 222222222222. If it is attached, the fallback is a gp3 migration. AWS describes gp3 as up to 20% cheaper per GB than gp2, so at most $9.68.
+- **Action:** snapshot, then delete.
+
+**4. Idle public IPv4 addresses.**
+- **Evidence:** the usage type `USE1-PublicIPv4:IdleAddress` on `eipalloc-0aa1` and `eipalloc-0aa2` costs $7.20.
+- **Action:** release both. It's small, but certain and takes a minute.
+
+### Evidence needed (no saving figure yet)
+
+| Candidate | Bill signal | Evidence to collect | How |
+|---|---|---|---|
+| NAT gateway `nat-0c9prod` | $1,657.73, up $1,098.68 | Which destinations the bytes go to. If they are S3 or DynamoDB, a gateway VPC endpoint removes the NAT processing charge for them. The ceiling is $1,657.73. The September jump of $1,098.68 is the first place to look. | VPC flow logs on the NAT ENI for a week |
+| S3 `acme-logs-archive` | $1,149.63 standard storage, +17.6% | How often the objects are read, their sizes, and the target class's rate and retrieval charges | S3 Storage Lens or access logs, then the S3 pricing page for us-east-1 |
+| CloudWatch log ingestion | $1,040.76, 13.8% of usage | Which log groups drive ingestion | Per-log-group `IncomingBytes`. Hand off to `observability-plan` for a log budget. |
+| Inter-AZ transfer | $457.33, +55.5% | Which services talk across zones | VPC flow logs with AZ fields |
+| RDS `payments-primary` | $620/month on demand, steady | A 1-year RI rate for db.r6g.2xlarge and confirmation of the term | The AWS RI purchase recommendation |
+| `i-0b7stgbatch` size | r6i.4xlarge, $725.76 | CPU and memory over two weeks or more | Compute Optimizer, plus the CloudWatch agent for memory |
+| Snapshots | $171.17, +23.4% | Retention policy, and which snapshots back AMIs | Snapshot inventory by age |
+
+### Untagged spend
+
+42.3% of September usage ($3,196.82) has no `team` tag, down from 48.0%. $2,306.60 has no resource id (data transfer and CloudWatch ingestion) and can't be tagged at the resource. Of spend that has a resource id, 36.8% is untagged. The biggest items are the `acme-logs-archive` bucket ($1,149.63) and the staging instance ($725.76). Ask the owners of account 222222222222 and the logs bucket to tag them, then enforce `team` with a tag policy.