Cloud Cost Audit skill for Claude Code

# Provider commands for cost audits

All commands are read-only. Run per region where resources are regional
(`for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do ...; done`).

## AWS

```bash
# Spend by service last full month
aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY \
  --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE --output json \
  | jq -r '.ResultsByTime[0].Groups[] | [.Keys[0], (.Metrics.UnblendedCost.Amount|tonumber)] | @tsv' | sort -t$'\t' -k2 -nr | head -20

# Usage types within one service (find what drives EC2-Other, data transfer, etc.)
aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY \
  --metrics UnblendedCost --filter '{"Dimensions":{"Key":"SERVICE","Values":["EC2 - Other"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE

# Unattached EBS volumes
aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].[VolumeId,Size,VolumeType,CreateTime]' --output table

# gp2 volumes (candidates for gp3)
aws ec2 describe-volumes --filters Name=volume-type,Values=gp2 --query 'Volumes[].[VolumeId,Size]' --output text

# Snapshots owned by the account, oldest first
aws ec2 describe-snapshots --owner-ids self \
  --query 'sort_by(Snapshots,&StartTime)[].[SnapshotId,VolumeSize,StartTime,Description]' --output text | head -50

# Elastic IPs not associated
aws ec2 describe-addresses --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId]' --output table

# Stopped instances (still paying for EBS)
aws ec2 describe-instances --filters Name=instance-state-name,Values=stopped \
  --query 'Reservations[].Instances[].[InstanceId,InstanceType,LaunchTime,Tags[?Key==`Name`]|[0].Value]' --output table

# Load balancers: list, then check RequestCount / ProcessedBytes in CloudWatch for 30 days
aws elbv2 describe-load-balancers --query 'LoadBalancers[].[LoadBalancerName,Type,CreatedTime]' --output table

# NAT gateways and their processed bytes (BytesOutToDestination metric per NAT)
aws ec2 describe-nat-gateways --query 'NatGateways[].[NatGatewayId,VpcId,State]' --output table

# Log groups without retention, largest first
aws logs describe-log-groups \
  --query 'logGroups[?retentionInDays==null].[logGroupName,storedBytes]' --output text | sort -k2 -nr | head -30

# S3 buckets: check lifecycle presence
for b in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  aws s3api get-bucket-lifecycle-configuration --bucket "$b" >/dev/null 2>&1 || echo "no lifecycle: $b"
done

# Rightsizing recommendations
aws compute-optimizer get-ec2-instance-recommendations \
  --query 'instanceRecommendations[].[instanceArn,finding,currentInstanceType,recommendationOptions[0].instanceType]' --output table

# Savings Plans coverage and utilization
aws ce get-savings-plans-coverage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY
aws ce get-savings-plans-utilization --time-period Start=2026-09-01,End=2026-10-01
aws ce get-savings-plans-purchase-recommendation --savings-plans-type COMPUTE_SP \
  --term-in-years ONE_YEAR --payment-option NO_UPFRONT --lookback-period-in-days THIRTY_DAYS
```

Athena on CUR 2.0 (column names per Data Exports schema; check your table):

```sql
SELECT product['servicecode'] AS service, line_item_usage_type,
       ROUND(SUM(line_item_unblended_cost), 2) AS cost
FROM cur2
WHERE billing_period = '2026-09'
GROUP BY 1, 2
ORDER BY cost DESC
LIMIT 30;
```

## Google Cloud

```bash
# Unattached persistent disks
gcloud compute disks list --filter="-users:*" --format="table(name,zone,sizeGb,type,creationTimestamp)"

# Static external IPs not in use
gcloud compute addresses list --filter="status=RESERVED" --format="table(name,region,address)"

# Snapshots, oldest first
gcloud compute snapshots list --sort-by=creationTimestamp --format="table(name,diskSizeGb,creationTimestamp)"

# Idle VM and rightsizing recommendations (per zone)
gcloud recommender recommendations list --project=$PROJECT --location=$ZONE \
  --recommender=google.compute.instance.IdleResourceRecommender
gcloud recommender recommendations list --project=$PROJECT --location=$ZONE \
  --recommender=google.compute.instance.MachineTypeRecommender

# Log buckets and retention
gcloud logging buckets list --location=global --format="table(name,retentionDays)"
```

BigQuery on the billing export:

```sql
SELECT service.description AS service, sku.description AS sku,
       ROUND(SUM(cost) + SUM(IFNULL((SELECT SUM(c.amount) FROM UNNEST(credits) c), 0)), 2) AS net_cost
FROM `billing_dataset.gcp_billing_export_v1_XXXXXX`
WHERE invoice.month = '202609'
GROUP BY 1, 2
ORDER BY net_cost DESC
LIMIT 30;
```

## Azure

```bash
# Unattached managed disks
az disk list --query "[?diskState=='Unattached'].{name:name, rg:resourceGroup, sizeGb:diskSizeGB, sku:sku.name}" -o table

# Public IPs not associated
az network public-ip list --query "[?ipConfiguration==null].{name:name, rg:resourceGroup, sku:sku.name}" -o table

# Deallocated vs stopped VMs (stopped-but-allocated still bills compute)
az vm list -d --query "[?powerState!='VM running'].{name:name, rg:resourceGroup, state:powerState, size:hardwareProfile.vmSize}" -o table

# Advisor cost recommendations
az advisor recommendation list --category Cost -o table

# Snapshots
az snapshot list --query "[].{name:name, rg:resourceGroup, sizeGb:diskSizeGB, created:timeCreated}" -o table
```

Cost Management query: use the portal's cost analysis grouped by service name and
resource group, or schedule exports to storage and analyze the CSV with
`scripts/cost_pareto.py --cost costInBillingCurrency --group meterCategory --group resourceGroupName`
(column names vary by export type; check with `--list-columns`).

## Kubernetes

- Compare requested vs used CPU/memory per namespace (`kubectl top pods -A` for a
  snapshot; Prometheus `container_cpu_usage_seconds_total` vs
  `kube_pod_container_resource_requests` for history).
- Tools: OpenCost or Kubecost for per-namespace allocation; cluster autoscaler or
  Karpenter consolidation to remove underused nodes.

#!/usr/bin/env python3
"""Pareto summary of a cloud cost CSV export: which groups make up most of the spend.

Works with any CSV that has a cost column and one or more grouping columns, e.g.
AWS CUR 2.0 / Data Exports (line_item_unblended_cost, product_servicecode,
line_item_usage_type, resource_tags_user_team), GCP billing export to CSV
(cost, service.description, sku.description), or Azure cost exports (costInBillingCurrency,
meterCategory, resourceGroupName). Untagged/empty group values are reported as "(none)".

Usage:
  python3 cost_pareto.py export.csv --cost line_item_unblended_cost \
      --group product_servicecode [--group line_item_usage_type] [--top 20] [--threshold 0.8]
  python3 cost_pareto.py export.csv --list-columns

Exit codes: 0 ok, 2 bad input (missing file/columns, no numeric costs).
Standard library only; streams the file, so multi-GB exports are fine.
"""
from __future__ import annotations

import argparse
import csv
import gzip
import sys
from collections import defaultdict


def open_any(path: str):
    if path.endswith(".gz"):
        return gzip.open(path, "rt", newline="", encoding="utf-8-sig")
    return open(path, newline="", encoding="utf-8-sig")


def parse_cost(raw: str) -> float | None:
    if raw is None:
        return None
    s = raw.strip().replace(",", "").replace("$", "").replace("€", "").replace("£", "")
    if not s:
        return None
    try:
        return float(s)
    except ValueError:
        return None


def main() -> int:
    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
    ap.add_argument("csv_path")
    ap.add_argument("--cost", help="name of the cost column")
    ap.add_argument("--group", action="append", default=[], help="grouping column (repeatable)")
    ap.add_argument("--top", type=int, default=20, help="rows to print (default 20)")
    ap.add_argument("--threshold", type=float, default=0.8, help="cumulative share to mark (default 0.8)")
    ap.add_argument("--list-columns", action="store_true", help="print header columns and exit")
    args = ap.parse_args()

    try:
        fh = open_any(args.csv_path)
    except OSError as e:
        print(f"cannot open {args.csv_path}: {e}", file=sys.stderr)
        return 2

    with fh:
        reader = csv.DictReader(fh)
        header = reader.fieldnames or []
        if args.list_columns:
            print("\n".join(header))
            return 0
        if not args.cost or not args.group:
            print("--cost and at least one --group are required (use --list-columns to see names)", file=sys.stderr)
            return 2
        missing = [c for c in [args.cost, *args.group] if c not in header]
        if missing:
            print(f"columns not found: {', '.join(missing)}", file=sys.stderr)
            return 2

        totals: dict[tuple[str, ...], float] = defaultdict(float)
        rows = skipped = 0
        for row in reader:
            cost = parse_cost(row.get(args.cost, ""))
            if cost is None:
                skipped += 1
                continue
            key = tuple((row.get(g) or "").strip() or "(none)" for g in args.group)
            totals[key] += cost
            rows += 1

    grand = sum(totals.values())
    if rows == 0 or grand == 0:
        print("no numeric cost values found", file=sys.stderr)
        return 2

    ranked = sorted(totals.items(), key=lambda kv: kv[1], reverse=True)
    width = max(len(" / ".join(k)) for k, _ in ranked[: args.top])
    width = min(max(width, 10), 70)
    print(f"Total cost: {grand:,.2f} across {rows:,} line items ({skipped:,} skipped), {len(ranked):,} groups")
    print(f"{'#':>3}  {'group':<{width}}  {'cost':>14}  {'share':>6}  {'cum':>6}")
    cum = 0.0
    crossed_at = None
    for i, (key, cost) in enumerate(ranked, 1):
        cum += cost
        if crossed_at is None and cum / grand >= args.threshold:
            crossed_at = i
        if i <= args.top:
            label = " / ".join(key)
            label = label if len(label) <= width else label[: width - 3] + "..."
            mark = " <" if crossed_at == i else ""
            print(f"{i:>3}  {label:<{width}}  {cost:>14,.2f}  {cost / grand:>6.1%}  {cum / grand:>6.1%}{mark}")
    print(f"\n{crossed_at} of {len(ranked)} groups account for {args.threshold:.0%} of spend.")
    untagged = sum(c for k, c in ranked if "(none)" in k)
    if untagged:
        print(f"Groups with an empty value in a grouping column: {untagged:,.2f} ({untagged / grand:.1%} of spend)")
    return 0


if __name__ == "__main__":
    sys.exit(main())