investigation-cost-guardrail

Name: investigation-cost-guardrail
Author: aws-samples

25stars20forks

How to install investigation-cost-guardrail?

aws-samples/sample-devops-agent-tools/investigation-cost-guardrail

$npx -y skills add aws-samples/sample-devops-agent-tools --skill investigation-cost-guardrail

Installs into the current project.

Summary

Estimates the downstream AWS API cost of an incident investigation before the agent runs any CloudWatch Logs Insights, GetMetricData, X-Ray, or cross-region query, shows a per-step cost plan, and cancels if the estimate exceeds a threshold or no time window is provided. This skil

Files · 1

View on GitHub

SKILL.md

1	# Investigation Cost Guardrail
2
3	## Overview
4
5	This skill acts as a cost guardrail for DevOps Agent investigations. Before pulling any data, it:
6
7	1. Lists every resource the agent will query (CloudWatch Logs, Metrics, CloudTrail, X-Ray)
8	2. Queries the actual stored bytes and IncomingBytes metric of relevant CloudWatch Log Groups
9	3. Detects cross-region data transfer costs if the Agent Space and workload are in different regions
10	4. Produces a visual investigation plan showing every step, its estimated data volume, and cost
11	5. Makes a proceed/cancel decision based on total estimated cost vs. threshold (default: $10 — proceeds automatically when the estimate is under $10, cancels and requests operator approval when it is exceeded)
12	6. If cancelled: tells the user exactly what information is missing to make it cheaper
13
14	## Step 1: Parse the investigation request
15
16	You MUST determine:
17	- Which CloudWatch Log Groups are relevant to the investigation
18	- Which CloudWatch Metrics namespaces/dimensions to query
19	- Whether X-Ray or CloudTrail is needed
20	- Whether a time window was explicitly provided by the user
21	- ALL AWS regions the investigation will touch (see region rule below)
22
23	### Region determination (MUST follow this order)
24
25	DevOps Agent monitors resources across ALL regions in an account, and a single investigation can span multiple regions. You MUST derive each region from concrete evidence — never assume or default to us-east-1:
26
27	1. From the resource ARN — extract the region segment (e.g., `arn:aws:logs:eu-west-1:...` → `eu-west-1`)
28	2. From the triggering alarm — CloudWatch alarms are region-scoped; use the alarm's region
29	3. From the log group / metric — the region where it is queried
30	4. From the topology — if the investigation spans services in multiple regions, collect EVERY region involved, not just one
31
32	You MUST build a list of all involved regions. For each region, Step 2 queries its log groups and its own Pricing API rate separately (rates differ by region).
33
34	You MUST identify the Agent Space region (where DevOps Agent is deployed) to detect cross-region transfer in Step 3.
35
36	### Agent Space region detection
37
38	The Agent Space region is provided in the system context:
39	- ARN: `arn:aws:aidevops:<REGION>:<ACCOUNT>:agentspace/<ID>`
40	- Extract the region segment (e.g., `us-east-1`)
41
42	If it is not available, ask the user:
43	> "I need to know which region your DevOps Agent is deployed in to calculate cross-region data transfer costs. Which region is your Agent Space in?"
44
45	Common mistake: assuming workload region = Agent Space region. Always verify both independently.
46
47	You MUST NOT:
48	- Invent or assume a time window if the user didn't provide one (e.g., do NOT default to "last 1 hour")
49	- Assume or default any region for rate lookups — if a region cannot be derived from an ARN, alarm, or resource ID, use the worst-case/fallback estimate and ask the user to confirm the region
50
51	When inputs are missing (region, log group, or time window), do NOT stop at open-ended questions. Still produce the Step 4 visual plan with worst-case or fallback estimates (flagged ⚠️) and an explicit decision, then list what the user should provide. A missing time window always results in 🚫 CANCEL.
52
53	On failure: show the worst-case plan and CANCEL decision, then ask the user to clarify what service, resource, region, or time window is affected.
54
55	## Step 2: Fetch actual data volume
56
57	You MUST query real data. Do NOT estimate without API calls.
58
59	CRITICAL: You MUST use the AWS Pricing API to get the correct per-unit rate for the workload region. Do NOT hardcode $0.005/GB — rates vary by region. See [references/pricing-reference.md](references/pricing-reference.md) for exact API calls and region prefix mapping. If the Pricing API fails, fall back to the floor estimates in that file and flag with ⚠️.
60
61	CRITICAL: If a time window is prov

People who liked this also viewed

6 picks

Type

investigation-cost-guardrail

25stars20forks

View on GitHub

How to install investigation-cost-guardrail?

aws-samples/sample-devops-agent-tools/investigation-cost-guardrail

$npx -y skills add aws-samples/sample-devops-agent-tools --skill investigation-cost-guardrail

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Investigation Cost Guardrail
2
3	## Overview
4
5	This skill acts as a cost guardrail for DevOps Agent investigations. Before pulling any data, it:
6
7	1. Lists every resource the agent will query (CloudWatch Logs, Metrics, CloudTrail, X-Ray)
8	2. Queries the actual stored bytes and IncomingBytes metric of relevant CloudWatch Log Groups
9	3. Detects cross-region data transfer costs if the Agent Space and workload are in different regions
10	4. Produces a visual investigation plan showing every step, its estimated data volume, and cost
11	5. Makes a proceed/cancel decision based on total estimated cost vs. threshold (default: $10 — proceeds automatically when the estimate is under $10, cancels and requests operator approval when it is exceeded)
12	6. If cancelled: tells the user exactly what information is missing to make it cheaper
13
14	## Step 1: Parse the investigation request
15
16	You MUST determine:
17	- Which CloudWatch Log Groups are relevant to the investigation
18	- Which CloudWatch Metrics namespaces/dimensions to query
19	- Whether X-Ray or CloudTrail is needed
20	- Whether a time window was explicitly provided by the user
21	- ALL AWS regions the investigation will touch (see region rule below)
22
23	### Region determination (MUST follow this order)
24
25	DevOps Agent monitors resources across ALL regions in an account, and a single investigation can span multiple regions. You MUST derive each region from concrete evidence — never assume or default to us-east-1:
26
27	1. From the resource ARN — extract the region segment (e.g., `arn:aws:logs:eu-west-1:...` → `eu-west-1`)
28	2. From the triggering alarm — CloudWatch alarms are region-scoped; use the alarm's region
29	3. From the log group / metric — the region where it is queried
30	4. From the topology — if the investigation spans services in multiple regions, collect EVERY region involved, not just one
31
32	You MUST build a list of all involved regions. For each region, Step 2 queries its log groups and its own Pricing API rate separately (rates differ by region).
33
34	You MUST identify the Agent Space region (where DevOps Agent is deployed) to detect cross-region transfer in Step 3.
35
36	### Agent Space region detection
37
38	The Agent Space region is provided in the system context:
39	- ARN: `arn:aws:aidevops:<REGION>:<ACCOUNT>:agentspace/<ID>`
40	- Extract the region segment (e.g., `us-east-1`)
41
42	If it is not available, ask the user:
43	> "I need to know which region your DevOps Agent is deployed in to calculate cross-region data transfer costs. Which region is your Agent Space in?"
44
45	Common mistake: assuming workload region = Agent Space region. Always verify both independently.
46
47	You MUST NOT:
48	- Invent or assume a time window if the user didn't provide one (e.g., do NOT default to "last 1 hour")
49	- Assume or default any region for rate lookups — if a region cannot be derived from an ARN, alarm, or resource ID, use the worst-case/fallback estimate and ask the user to confirm the region
50
51	When inputs are missing (region, log group, or time window), do NOT stop at open-ended questions. Still produce the Step 4 visual plan with worst-case or fallback estimates (flagged ⚠️) and an explicit decision, then list what the user should provide. A missing time window always results in 🚫 CANCEL.
52
53	On failure: show the worst-case plan and CANCEL decision, then ask the user to clarify what service, resource, region, or time window is affected.
54
55	## Step 2: Fetch actual data volume
56
57	You MUST query real data. Do NOT estimate without API calls.
58
59	CRITICAL: You MUST use the AWS Pricing API to get the correct per-unit rate for the workload region. Do NOT hardcode $0.005/GB — rates vary by region. See [references/pricing-reference.md](references/pricing-reference.md) for exact API calls and region prefix mapping. If the Pricing API fails, fall back to the floor estimates in that file and flag with ⚠️.
60
61	CRITICAL: If a time window is prov

People who liked this also viewed

6 picks

Type