AWS Cost Audit Skill

Ask Claude to audit your AWS bill. Get a clear savings plan where every number is checked against live AWS pricing, and nothing gets deleted without your say-so.

Part of the 10x marketplace, a curated set of Claude Code tools that ship quality.

English · 简体中文 · 日本語 · Español · Français

_{Ask Claude to audit your bill, get an evidence-first savings plan. All figures shown are illustrative (synthetic data, no real account).}

What is this?

It is a Claude Code skill that audits your AWS account for you.

You ask Claude something like "audit my AWS bill". The skill reads your live account, works out what each thing costs and why, finds the waste, and hands you a plain-language report: what you pay today, what you can safely cut, and how sure it is about each one. It reads only by default. It never guesses a price, and it never deletes anything on its own.

Think of it as a careful FinOps engineer that shows its work.

What is an AWS cost audit? It is a structured review of an AWS account that finds what you are paying for, which resources are wasted or oversized, and what you can safely remove. This skill runs that audit for you and follows the AWS Well-Architected Framework cost-optimization pillar and the FinOps Foundation framework, so the method is not something it made up.

Install

Pick whichever you prefer. All three install the same skill.

From the 10x marketplace (recommended, it's curated there alongside other Claude Code tools):

/plugin marketplace add Aboudjem/10x
/plugin install aws-cost-audit@10x

From this repo directly:

/plugin marketplace add Aboudjem/aws-cost-audit-skill
/plugin install aws-cost-audit@aws-cost-audit-skill

As a drop-in skill (no plugin system):

git clone https://github.com/Aboudjem/aws-cost-audit-skill
cp -r aws-cost-audit-skill/skills/aws-cost-audit ~/.claude/skills/aws-cost-audit

You also need the AWS CLI set up with read access to the account you want to audit. ReadOnlyAccess is enough for the audit itself.

Other AI CLIs (one line)

This is a skill-only plugin (no MCP server). The installer symlinks the aws-cost-audit skill into another CLI's skills directory:

curl -fsSL https://raw.githubusercontent.com/Aboudjem/aws-cost-audit-skill/main/install.sh | bash -s <platform>

Pass all to link into every platform above. Use --update to relink the latest, --uninstall to remove the links.

curl -fsSL https://raw.githubusercontent.com/Aboudjem/aws-cost-audit-skill/main/install.sh | bash -s codex

curl -fsSL https://raw.githubusercontent.com/Aboudjem/aws-cost-audit-skill/main/install.sh | bash -s copilot

git clone https://github.com/Aboudjem/aws-cost-audit-skill
./aws-cost-audit-skill/install.ps1 copilot

Use it in 3 steps

1. Install it (above).
2. Ask Claude to "audit my AWS bill" or "find my unused AWS resources". The skill turns on by itself.
3. Read the plan. You get a report, and an optional HTML dashboard, showing cost, cause, and a confidence level for every saving.

That is the whole thing. Nothing is changed in your account unless you ask, and even then only after a safety check and your confirmation.

What you get

_{The optional dashboard (sample shown, synthetic data). Open examples/sample-dashboard.html to see it live.}

• A spend breakdown. What you pay today, per service and per region, pulled live from Cost Explorer.
• A per-resource view. For each resource: what it costs, what it does in plain words, who made it, when, and when it was last used. If a fact can't be verified, it says so instead of guessing.
• A savings plan in two parts. "Save now safely" (high-confidence, reversible, low-risk) kept separate from "maximum theoretical save" (the bigger cuts that need your sign-off).
• An optional dashboard. A single self-contained HTML page a non-technical person can read. See examples/sample-dashboard.html and a sample report.
• Guardrails. It checks whether you have budgets and cost-anomaly alerts, and helps you set them.

What a run looks like

The recording above (assets/demo.gif) is illustrative: it uses synthetic data, not a real account, because AWS calls require live credentials (see the deferred-items note in CONTRIBUTING.md). Here is what happens step by step, mirrored in the sample report and the sample dashboard (both use synthetic data, clearly labelled):

1. Identity check. aws sts get-caller-identity confirms the account and region before anything else runs.
2. Spend baseline. Cost Explorer (aws ce get-cost-and-usage) pulls the trailing 30 and 90-day spend, broken down by service and region. You see a table: service → $/mo → share of total.
3. Resource inventory. The skill fans out across every enabled region, listing EC2 instances, EBS volumes, RDS instances, NAT Gateways, load balancers, S3 buckets, Lambda functions, CloudWatch log groups, Snapshots, AMIs, Elastic IPs, and more. Nothing is modified.
4. Waste detection. Each resource is checked against the hunt list (skills/aws-cost-audit/references/hunt-list.md): idle CPU, unattached volumes, old snapshots, gp2 volumes, over-retained logs, missing Savings Plan coverage, etc.
5. Live price verification. For every candidate saving, the skill fetches the live, region-specific unit price from the AWS Price List Query API, with no memorised rates. It shows unit price → math → source for every dollar figure.
6. Evidence-backed report. Findings are written as current $/mo → after $/mo → $ saved · confidence · evidence · reversibility, split into "save now safely" (High-confidence, reversible, tested) and "maximum theoretical save". See examples/sample-report.md for the exact shape.
7. Optional dashboard. An HTML file is generated from the findings, open it in any browser. See examples/sample-dashboard.html.

A real run on a mid-size AWS account typically surfaces findings within a few minutes of the first Cost Explorer call. The read-only phase completes before any remediation suggestion is made.

Why you can trust the numbers

Most "cut your AWS bill" advice is generic, or it is a tool that quotes a price from memory. This skill is built around five rules it will not break:

1. No made-up prices. Every dollar comes from the live AWS price for your region plus your actual usage. It shows the unit price, the math, and the source. It hardcodes no prices anywhere.
2. Attribute every dollar, or say "unknown." It never invents an owner, a date, or a "last used."
3. Nothing destructive without proof. A change runs only if the resource is proven unused, the action is reversible, it passed a dry run, and the result is certain. Otherwise it stays a recommendation.
4. One sample is never the whole fleet. A separate skeptic pass re-derives the headline numbers from the source before they ship.
5. Every finding shows its evidence. Current cost, cost after, dollars saved, a confidence level, the proof, and how to undo it.

These rules exist because we watched agents without the skill break them. The recorded baseline is in docs/research/RED-baseline-findings.md: asked for the same savings number, two models confidently returned two different wrong figures from memory. The skill fixes that.

How it compares

FAQ

How do I audit my AWS bill with Claude? Install this skill, then ask Claude Code to "audit my AWS bill." It reads your account with the AWS CLI and produces an evidence-backed cost report and savings plan.

Is it safe? Will it delete anything? It is read-only by default. It will not delete, stop, or change anything on its own. Any action is gated: the resource must be proven unused, the change must be reversible, it must pass a dry run, and you must confirm. Irreversible actions are always left as recommendations.

Does it need my AWS keys? No. It uses your existing AWS CLI credentials on your own machine. Nothing is uploaded anywhere. ReadOnlyAccess is enough for the audit.

Does it work on my account? Yes. It is generic. It reads whatever account your CLI is pointed at, across all regions, and ships with no account IDs, ARNs, or prices baked in.

Does it hardcode AWS prices? No, on purpose. Prices change and vary by region, so it always fetches the live price for your region and combines it with your real usage.

What does it cover? Idle and unattached resources, gp2→gp3, old snapshots and AMIs, NAT and data-transfer costs, idle load balancers, rightsizing, Savings Plans and Reserved Instance coverage, S3 lifecycle, CloudWatch log retention, cross-region leftovers, and missing budgets/alerts. The full list is in the hunt list.

Can I use it without the plugin system? Yes. Copy skills/aws-cost-audit/ into ~/.claude/skills/aws-cost-audit/ and it works the same way.

How it works under the hood

The skill is in skills/aws-cost-audit/SKILL.md. Heavier detail is loaded only when needed, from references/:

• hunt-list.md: every high-ROI check, with the read-only command to detect it.
• pricing-verification.md: how it pulls a live, region-correct price and re-checks it.
• safety-and-gating.md: the executor → verifier → rollback gate, and what may never run on its own.
• output-and-reporting.md: the report shape and the per-finding contract.

Helper scripts in scripts/ are dry-run by default. See the quickstart for a guided first run.

Editor support

This skill is designed for Claude Code. It works by loading SKILL.md into the Claude Code context and shelling out to the AWS CLI, so it requires Claude Code as the runtime.

Other AI editors (Cursor, VS Code with Copilot, Windsurf, Codex, Gemini CLI) do not use the Claude Code plugin or skill format natively. If you are using one of those editors, the most practical path is:

1. Install the AWS CLI and configure your credentials as normal.
2. Copy skills/aws-cost-audit/SKILL.md and the references/ folder into your project (or a personal context directory your editor reads).
3. Point your editor at the SKILL.md content as a system prompt or custom instruction.
4. Run the helper scripts in skills/aws-cost-audit/scripts/ directly. They are plain shell scripts that depend only on the AWS CLI, not on Claude Code.

The skill's logic (Iron Laws, workflow, safety gates) is fully portable. Only the installation mechanism (plugin system, /skill auto-discovery) is Claude Code-specific.

Contributing

Issues and PRs are welcome. The one firm rule: this skill is built test-first, so a change that adds behavior needs the failing baseline it fixes. See CONTRIBUTING.md and the Code of Conduct.

Star History

License

MIT. Use it, fork it, ship it.

_{Built and maintained by Adam Boudjemaa. Commands verified against AWS CLI v2 and the AWS docs in 2026. Spot a stale command or a gap? Open an issue.}