Skip to content

EOS Cost Analysis — Custom Agent

View on GitHub

use_aws eos-cost-analysis

Purpose

A dedicated custom agent that discovers AWS resources approaching or past End of Standard Support and calculates the Extended Support cost impact. Use this when you want automated, scheduled EOS posture reports without manual prompting.

Note: For ad-hoc queries, you don't need this custom agent. Just upload the eos-cost-analysis skill and ask questions in regular Chat. This custom agent is for scheduled/automated runs.

Key Capabilities

  • Runs on demand or on a weekly/monthly schedule
  • Discovers resources across all associated accounts automatically
  • Produces a persisted artifact (report) each run for tracking over time
  • Covers EKS, RDS/Aurora, Lambda, ElastiCache, and OpenSearch
  • Calculates per-resource Extended Support cost with Year 1-2 and Year 3 pricing tiers

Prerequisites

  • An AWS DevOps Agent space
  • The eos-cost-analysis skill uploaded to your Agent Space (choose "All agents" for Agent Type)
  • use_aws and verify_aws_claim tools available in the Agent Space
  • Resource discovery permissions (EKS, RDS, Lambda, ElastiCache, and OpenSearch read-only List/Describe calls, with OpenSearch under the es: IAM prefix) are already covered by the AIDevOpsAgentAccessPolicy managed policy — no extra IAM is required for discovery
  • For live Extended Support pricing, grant the AWS Pricing API actions (pricing:GetProducts, pricing:GetAttributeValues, pricing:DescribeServices) by setting EnableEosCostAnalysis in cloudformation/devops-agent-skill-policies/devops-agent-skill-policies.yaml
  • For multi-account analysis: associate secondary accounts in DevOps Agent settings

Creating the Agent

  1. In the DevOps Agent web app, go to the "Agents" menu (on the bottom left pane)
  2. Click "Create agent" (on the right side), then click "Form" (the left-most option)
  3. In the "Name" field, use "eos-cost-analysis"
  4. Copy the content of the SYSTEM_PROMPT.md file from this directory, and paste it into the "System prompt" field
  5. In the "Skills" drop-down list, select the "eos-cost-analysis" skill
  6. In the "Tools" section of the same form, select the use_aws and verify_aws_claim tools, then click "Create agent". (Both are built-in, non-MCP tools, so they can be chosen directly in the form.)
  7. Verify both tools appear under "Tools" on the agent's page

If the form doesn't offer a Tools selector (older UI), create the agent first, then add the tools through Chat: on the new agent's page click "Edit" → "Chat", wait for DevOps Agent to finish loading, and type "Add the use_aws and verify_aws_claim tools to this custom agent". Confirm both appear under "Tools" afterward.

Executing the Agent

You can execute the custom agent on-demand, on schedule, or using chat. Follow the Executing custom agents guide for more information.

On-demand prompts: - "Run this agent now" (uses default — full EOS analysis across all services and accounts) - "Analyze EKS EOS only in us-east-1 and eu-west-1" - "Check RDS and Aurora Extended Support costs in ap-south-1"

Scheduled runs: - Configure weekly or monthly execution under the agent's schedule settings - Each run produces a new artifact version, allowing week-over-week comparison

Once finished, the artifact is persisted on the Artifacts page in the DevOps Agent web app.

Safety and Notifications

The agent is read-only: it never modifies, upgrades, or deletes resources. The only outbound action is an optional summary message after a run that found affected resources (total monthly Extended Support cost, number of CRITICAL resources, top impacted account and service). It is sent only if you have attached a messaging tool such as Slack to the agent. Without one, the agent notes "Notification skipped" in the report and nothing is sent. The agent has no way to change customer AWS resources.

Multi-Account Setup

For organization-wide analysis across multiple AWS accounts:

  1. In DevOps Agent, go to Settings → Cloud Sources
  2. Click "Add secondary cloud source"
  3. Follow the prompts to create a cross-account role in each secondary account
  4. After association, the agent automatically discovers resources across all connected accounts

No additional configuration needed in the skill or agent — DevOps Agent handles cross-account access transparently.