review-costs

name	review-costs
description	[pr-review-focus-area: Cloud Costs] Flag cost hotspots in Terraform plans and live cloud inventory - oversized instances, orphaned volumes, idle load balancers, untagged resources, NAT egress.
user-invocable	true
disable-model-invocation	true
allowed-tools	["Read","Bash","Grep","Glob","WebFetch","AskUserQuestion"]
argument-hint	[aws|gcp|auto]

Cloud Cost Review

Surface cost hotspots across Terraform plans and live cloud inventory, rank them by certainty of waste, and estimate monthly spend where pricing data is available. This skill is read-only — it never modifies resources, attaches/detaches anything, or runs mutating CLI commands.

Invocation

The user runs /review-costs [aws|gcp|auto].

• aws — scope to AWS only (Terraform providers + live account via aws CLI).
• gcp — scope to GCP only (Terraform providers + live account via gcloud).
• auto (default when omitted) — detect cloud from Terraform providers, .tf backends, or available CLI credentials, and run whichever surfaces.

Execution Steps

1. Determine Scope

Run the shared scope helper to learn what IaC artifacts exist. Prefer ${CLAUDE_PLUGIN_ROOT}/scripts/detect-iac-scope.sh and fall back to plugins/infra/scripts/detect-iac-scope.sh when running from the plugin dev repo.

SCRIPT="${CLAUDE_PLUGIN_ROOT:-plugins/infra}/scripts/detect-iac-scope.sh"
[ -x "$SCRIPT" ] || SCRIPT="plugins/infra/scripts/detect-iac-scope.sh"
"$SCRIPT"

Use the JSON .terraform.modules[] to pick module roots for the IaC pass. Then use AskUserQuestion to narrow the review:

Question: "Which scope should I audit?"
Options:
  1. "Terraform plan only" - "Parse IaC for likely cost issues, no cloud calls"
  2. "Live account only" - "Inventory the live cloud, skip IaC parsing"
  3. "Both" - "Cross-reference IaC against live inventory"

When the user picks Live account only or Both, probe credentials with the auth helper for the chosen cloud:

AUTH="${CLAUDE_PLUGIN_ROOT:-plugins/infra}/scripts/cloud-auth-check.sh"
[ -x "$AUTH" ] || AUTH="plugins/infra/scripts/cloud-auth-check.sh"
"$AUTH" aws    # or: gcp

If the JSON status is MISSING_CLI, UNAUTHENTICATED, or EXPIRED, mark the live scan SKIPPED with the detail field as the reason, fall back to Terraform plan only, and note the degradation in the report header.

2. IaC Scan

When Terraform plan scope is enabled:

1. Locate module roots (directories containing *.tf + .terraform/). Do NOT run terraform init.
2. Generate the plan JSON with terraform plan -out=/tmp/tfplan -lock=false followed by terraform show -json /tmp/tfplan. Skip the module with SKIPPED if it is not initialized.
3. Walk planned_values.root_module and flag:
   • aws_instance / google_compute_instance with instance families above *.large without matching autoscaling rules.
   • aws_ebs_volume / google_compute_disk with size > 500 GiB or type of io2 / pd-ssd without a declared throughput need.
   • aws_lb / google_compute_forwarding_rule that expose no target group attachments in the plan.
   • aws_nat_gateway count per VPC (each one is a recurring fixed charge plus egress).
   • aws_eip / google_compute_address without an attachment in the plan.
   • aws_db_instance / google_sql_database_instance with multi_az or availability_type=REGIONAL on non-production environments.
   • Any resource lacking the org-standard tags (surface the resource type and the missing keys).

3. Live Scan

When live account scope is enabled, run read-only inventory calls:

• AWS:
  • aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,Tags]'
  • aws ec2 describe-volumes --filters Name=status,Values=available (orphaned volumes)
  • aws ec2 describe-addresses --query 'Addresses[?AssociationId==null]' (unassociated EIPs)
  • aws elbv2 describe-load-balancers and describe-target-groups --target-group-arn to find LBs with zero healthy targets
  • aws ec2 describe-nat-gateways
  • aws rds describe-db-instances
• GCP:
  • gcloud compute instances list --format=json
  • gcloud compute disks list --filter='-users:*' (orphaned disks)
  • gcloud compute addresses list --filter='status=RESERVED'
  • gcloud compute forwarding-rules list
  • gcloud sql instances list

If the CLI is missing or unauthenticated, mark the live scan SKIPPED for that cloud and continue.

4. Rank Findings

Assign every finding exactly one category:

• orphaned — unattached volume, unassociated EIP, LB with no targets, idle NAT gateway. High confidence of waste.
• oversized — instance family larger than workload evidence supports. Medium confidence; flag as "needs metrics to confirm."
• architectural — NAT egress concentration, cross-region data transfer, multi-AZ on dev, over-provisioned RDS/CloudSQL. Low-to-medium confidence; requires human review.
• tagging — resource missing org-standard tags. No direct $ impact but blocks chargeback.

5. Estimate Monthly Cost

For each finding, include a Est $/mo column with a confidence label of Low, Med, or High:

• High — the resource's instance type / volume type appears in a pricing snapshot retrieved via WebFetch from the official AWS or GCP pricing page during this session, and usage is fixed-rate (e.g. NAT hourly, EIP idle fee).
• Med — a generic band for the resource class (e.g. "orphaned gp3 500GiB ~ $40/mo") based on published on-demand list prices.
• Low — structural estimate only (e.g. "NAT egress cost scales with traffic - needs VPC flow logs to bound").

If pricing cannot be retrieved, record Est $/mo as needs pricing and set confidence to Low.

Output Format

## Cost Review - <scope>

**Scope:** <Terraform plan only | Live account only | Both>
**Cloud:** <aws | gcp>

| Resource | Category | Est $/mo | Confidence | Recommendation |
|----------|----------|----------|------------|----------------|
| vol-0abc123 | orphaned | $40 | High | Detach confirmed, delete after 7-day hold |
| i-0def456 (m5.4xlarge) | oversized | $560 | Med | Rightsize pending CPU/mem history |
| nat-0ghi789 (us-east-1b) | architectural | $35 fixed + egress | Low | Consolidate with AZ-a NAT or VPC endpoints |
| aws_s3_bucket.logs | tagging | n/a | n/a | Missing `owner`, `cost-center` tags |

**Totals:** orphaned: N ($X), oversized: N ($X), architectural: N (varies), tagging: N
**Verdict:** <CLEAN | REVIEW | HIGH-WASTE>

Verdict

• CLEAN — no orphaned findings, no oversized findings, tagging gaps below 5% of resources.
• REVIEW — at least one oversized or architectural finding, or tagging gaps above 5%, but no orphaned waste. Human judgment required.
• HIGH-WASTE — one or more orphaned findings, or aggregate High-confidence monthly estimate exceeds a threshold the user can eyeball in the totals.

Rules

1. Read-only. Never run aws ec2 terminate-instances, aws ec2 delete-volume, gcloud compute instances delete, terraform apply, or any mutating call.
2. Graceful skip. Missing aws / gcloud CLI, expired credentials, or uninitialized Terraform modules produce SKIPPED entries, not failures.
3. No fabricated prices. Never invent dollar figures. Use only pricing retrieved during the session or explicit generic bands, and always tag with Low/Med/High confidence.
4. No fabricated resource IDs. If a resource ID is not in the plan JSON or live API response, do not include it.
5. Rightsizing needs evidence. Never claim an instance is oversized without a metric source; mark it "needs metrics to confirm."
6. Respect scope. aws and gcp arguments must not cause cross-cloud calls.

$ARGUMENTS