fabrico-analyze-aws-costs

name	fabrico-analyze-aws-costs
description	Audit AWS cost optimization and tagging compliance.

Invocation portability: $fabrico-* below means the discovered entry workflow. Use the unqualified name for repository or filesystem installs and $fabrico-collections:fabrico-* for plugin installs.

Input

Use the user’s current request as the workflow input. Expected context: [AWS Account/Profile, Region, or 'all'] [focus: specific service or 'everything'].

Prefer the fabrico-devops-engineer subagent. When that custom agent is available, spawn it with the user's request and referenced context and adopt its operating contract. If this workflow is already running inside fabrico-devops-engineer, perform the audit locally and never spawn another DevOps engineer. If the profile is unavailable, as in a skills-only plugin installation, perform the complete workflow in the current thread with the required skills and the same audit contract. Perform an exhaustive, evidence-based AWS cost optimization and tagging compliance audit. Use a hybrid approach: analyze Terraform/IaC code first (if available), then always validate against live AWS infrastructure via API. The goal is to inspect every nook and cranny — every service, every resource, every configuration — for optimization opportunities, waste, misconfigurations, and tagging gaps.

When the user does not specify a narrow scope, default to auditing everything in the given account and region.

Required Skills

Before starting, load and follow these skills (in this order):

• fabrico-technical-context-discovering — identify existing IaC patterns, tagging conventions, and project context
• fabrico-codebase-analysing — IaC structure analysis, module relationships, and dead code detection; apply Steps 7, 2, 12 when IaC files are found
• fabrico-optimizing-cloud-cost — cost analysis framework: Pricing Model Decision table, Storage Tiering Decision, tagging standards, rightsizing process, and anti-patterns
• fabrico-implementing-terraform-modules (conditional) — Terraform module structure, best practices, and AWS module reference; load when Terraform files are found
• fabrico-managing-secrets (conditional) — secrets management audit criteria, security checklist, and exposure risk assessment; load when security findings are in scope

Workflow

1. Scope validation:

   • User should specify AWS Account/Profile and Region (or "all regions").
   • If missing, ask the user to clarify before proceeding.
   • If the user specifies a focus (e.g., "EC2 only"), respect that scope. Otherwise, audit all services — compute, storage, databases, networking, serverless, containers, AI/ML, security, and any other active resources.

2. Load required skills (MUST complete before any analysis):

   • Always load the fabrico-technical-context-discovering skill (read .agents/skills/fabrico-technical-context-discovering/SKILL.md) — follow its process to identify existing IaC patterns, tagging conventions, and project context.
   • Always load the fabrico-codebase-analysing skill (read .agents/skills/fabrico-codebase-analysing/SKILL.md) — even if no IaC files are found initially, this skill's Step 7 (infrastructure code) helps identify IaC in unexpected locations, and Step 2 (dependencies) reveals infrastructure-related dependencies in any project.
   • Always load the fabrico-optimizing-cloud-cost skill (read .agents/skills/fabrico-optimizing-cloud-cost/SKILL.md and references/tagging-standards.md) — use it to establish the "Core 5" Mandatory Tags, Pricing Model Decision table, Storage Tiering Decision table, Process steps, Checklist, and Anti-Patterns. If the skill file cannot be found, use the following hardcoded defaults for the Core 5 Mandatory Tags: CostCenter, Environment, Service, Owner, DataClass.
   • Conditionally load the fabrico-implementing-terraform-modules skill (read .agents/skills/fabrico-implementing-terraform-modules/SKILL.md) — load when Terraform files (*.tf, *.tfvars, terragrunt.hcl) are found. Use it as the reference standard for module structure, naming conventions, provider pinning, and AWS-specific module patterns when evaluating IaC quality and generating Terraform code.
   • Conditionally load the fabrico-managing-secrets skill (read .agents/skills/fabrico-managing-secrets/SKILL.md) — load when the audit scope includes security (which is always for a full audit). Use its Security Checklist, Anti-Patterns, and Cloud-Native Detection patterns when evaluating secrets management, KMS keys, and credential handling.

Prompt-Specific Guardrails

All standard DevOps agent guardrails (Mutation Lock, Zero-Deletion Policy, FinOps Alerts) apply automatically. Additionally:

• This workflow is analysis-only by default — do not generate or modify code unless the user explicitly requests it in the next steps.
• Always warn before suggesting modifications to resources tagged Environment:prod.
• All remediation output (CLI scripts, Terraform code) is for user review and manual execution only — never execute directly.
• When modifying existing Terraform code, show a diff preview of proposed changes before writing to files.