cost-investigation

name

cost-investigation

description

Use when a cloud bill already spiked and nobody knows why — storage or egress jumped, a specific bucket's cost ballooned, a cost-anomaly alert fired, or finance is asking "what changed this week?" Queries the billing export by service/bucket/region, diffs the suspect window against a prior baseline, and ranks the top movers. Insists on accounting for the 24-48h billing lag before declaring a trend, and points the investigation at the usual culprit: cross-region egress. Not for cost forecasting/estimation, general spend optimization, pricing questions, budget-alert setup, or latency "expense" — only for diagnosing an unexpected spike that already happened.

Cloud Cost Spike Investigation

Overview

A bill spike is almost always one dimension moving, hidden inside an aggregate that only shows the total going up. This skill turns "the bill jumped" into "bucket X in region Y egressed 4 TB cross-region starting Tuesday" by querying the billing export, diffing the suspect window against a matched baseline window, and ranking what actually moved. It is read-only — it explains the spike, it does not change anything.

When to Use

Use this skill when you see symptoms like:

• The monthly/weekly cloud bill is up sharply with no obvious release behind it.
• Storage or egress line items jumped and you need to localize the source.
• Finance or a cost dashboard flags an anomaly and asks "what changed?"
• A specific bucket, project, or region's cost ballooned.
• Someone asks "why is our egress bill so high this week?"

Do NOT use this skill when:

• You are reclaiming idle/orphaned GPU resources — use gpu-node-orphans.
• The "spike" is the most recent 1-2 days only; that is likely billing lag, not a real trend (see Gotchas).
• There is no billing export available to query — get the export enabled first.

Investigation flow