Setup guide

Blanket read access covering the ec2:Describe*, cloudwatch:Get*, logs:Describe*, rds:Describe*, s3:List*, elasticloadbalancing:Describe*, eks:Describe*, ecr:Describe* and backup:List* calls the waste sweep makes across every region.

↳ Narrower alternative: a custom policy limited to ec2:DescribeRegions, ec2:DescribeInstances, ec2:DescribeVolumes, ec2:DescribeSnapshots, ec2:DescribeAddresses, ec2:DescribeNatGateways, ec2:DescribeVpcEndpoints, cloudwatch:GetMetricStatistics, cloudwatch:GetMetricData, cloudwatch:ListMetrics, logs:DescribeLogGroups, rds:DescribeDBInstances, elasticloadbalancing:DescribeLoadBalancers, eks:ListClusters, ecr:DescribeRepositories and backup:ListRecoveryPointsByBackupVault - that is the exact read surface the skill touches.

Pulls the 90-day AmortizedCost baseline grouped by SERVICE and USAGE_TYPE, which ranks every downstream finding.

↳ Cost Explorer actions do not support resource-level restriction; Resource must be "*". Grant only the specific ce:Get* actions listed here rather than ce:*.

Cross-checks Compute Optimizer findings with Cost Explorer's own CROSS_INSTANCE_FAMILY rightsizing recommendations in step 4.

Sizes the Compute Savings Plan commitment in step 6 against 60 days of hourly on-demand spend.

↳ Read-only: it returns a recommendation and never purchases. Purchasing requires savingsplans:CreateSavingsPlan, which must NOT be granted to the audit identity.

Reports commitment utilization %, which the cost model requires before quoting any savings from deleting or resizing covered compute.

Supplies current_SP_coverage, the multiplier in `on-demand rate x hours x (1 - current_SP_coverage)` - without it every savings figure is overstated.

Retrieves Overprovisioned findings with observed CPU/memory utilization for the rightsizing step.

↳ Use the managed policy arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess if you prefer a maintained policy over inline actions.

Pre-flight check in 'Inputs to gather' that confirms opt-in and how long data has been collected, so the skill can flag low-confidence findings.

Resolves live on-demand $/hr for each instance type in the reference scan instead of relying on hardcoded us-east-1 list prices.

↳ Also grant pricing:DescribeServices only if you extend the scan to discover filter fields; the skill itself needs GetProducts alone.

Enumerates linked accounts when the scope is a consolidated-billing payer rather than a single account.

↳ Omit entirely for single-account audits. It only works from the management account or a delegated administrator.

Proves which account and principal the audit is running as before anything is scanned or reported.

↳ Allowed implicitly for every IAM principal; no explicit grant needed.

Legacy billing-console permission still enforced on some accounts alongside the ce:* actions; paired with activating IAM access to billing information.

↳ On accounts migrated to fine-grained billing permissions this is superseded by billing:Get* and ce:Get*; grant arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess to cover both generations.

WRITE - Wave 1 gp2 to gp3 migration. Belongs to the separate remediation identity, never to the audit identity.

↳ Scope with a Condition on aws:ResourceTag/Environment or a resource ARN list so only pre-approved volumes can be modified.

WRITE - Wave 1 fix for log groups whose retentionInDays is null.

↳ Restrict Resource to arn:aws:logs:<region>:<account>:log-group:<prefix>:* rather than "*".

WRITE - Wave 1/3 creation of S3 and DynamoDB gateway endpoints and PrivateLink interface endpoints to remove NAT per-GB charges.

↳ Also needs ec2:ModifyVpcEndpoint and ec2:DescribeVpcEndpoints; scope by vpc-id condition key ec2:Vpc.

WRITE - creates the guardrail budget in step 7 (the CreateBudget API maps to this IAM action).

↳ Pair with budgets:ViewBudget for read-back; ce:CreateAnomalyMonitor and ce:CreateAnomalySubscription are needed for the anomaly guardrail.

Cause: Either the inline ce:Get* policy is missing, or 'IAM user and role access to billing information' was never activated on the payer account - the account-level switch overrides the IAM grant.

Fix: Activate IAM access to billing in the account-name menu > Account, and confirm the audit role has ce:GetCostAndUsage on Resource "*" (Cost Explorer does not support resource-level permissions). In an Organization, run the call from the management account or enable linked-account access.

Cause: Cost Explorer was enabled less than ~24 hours ago, or the requested time period predates the first prepared data.

Fix: Wait for the first daily preparation run, then narrow --time-period to the days actually available. Do not substitute UnblendedCost or estimated data - the skill's baseline requires AmortizedCost.

Cause: The account (or the organization) is not opted in to AWS Compute Optimizer, so no recommendations exist.

Fix: Opt in via the Compute Optimizer console Get started flow, or `aws compute-optimizer update-enrollment-status --status Active`, then wait ~12 h. Verify first with `aws compute-optimizer get-enrollment-status`, and skip the rightsizing step until status is Active with enough history.

Cause: The audit identity lacks ec2:Describe* in that region, or an SCP / permissions boundary on the account denies it.

Fix: Attach arn:aws:iam::aws:policy/ReadOnlyAccess (or the explicit ec2:Describe* list) and check Organizations SCPs. Re-run `aws sts get-caller-identity` to confirm you are the principal you think you are - a stale AWS_PROFILE is the usual cause.

Cause: The scan targeted an opt-in region (ap-east-1, me-south-1, af-south-1, eu-south-1, ...) that the account has not enabled.

Fix: Filter the REGIONS list to entries where DescribeRegions reports OptInStatus of opt-in-not-required or opted-in, and note the skipped regions in the assumptions section of the report.

Cause: One get-metric-statistics call per instance per region exceeds the CloudWatch request rate once the fleet passes roughly 50 instances.

Fix: Switch to `aws cloudwatch get-metric-data`, batching up to 500 MetricDataQueries per call, and enable adaptive retries with `export AWS_RETRY_MODE=adaptive AWS_MAX_ATTEMPTS=10`.

Cause: The Pricing API is served only from us-east-1, ap-south-1 and eu-central-1, but the call inherited the loop's regional --region value.

Fix: Always pass `--region us-east-1` to `aws pricing get-products` (as the reference implementation's price_hr() does) and pass the target region as the regionCode TERM_MATCH filter instead.

Cause: Temporary STS or IAM Identity Center credentials (AWS_ACCESS_KEY_ID starting ASIA) expired mid-scan; the default assume-role session is one hour.

Fix: Re-run `aws sso login --profile finops-audit` or re-assume the role with `--duration-seconds 43200` (up to the role's MaxSessionDuration), then restart the scan. Long multi-region sweeps should use a profile so the CLI refreshes credentials automatically.

Cause: The gp2 to gp3 migration was retried, or IOPS and throughput were changed in a second call within the 6-hour per-volume cooldown.

Fix: Set --volume-type, --iops and --throughput in a single modify-volume call, and poll `aws ec2 describe-volumes-modifications --volume-ids vol-0abc` for state 'completed' rather than retrying.

Cause: The BSD `date` on macOS does not accept GNU's `-d '90 days ago'`.

Fix: Use `date -u -v-90d +%F` (the fallback the skill documents) or install GNU coreutils and call `gdate`. The reference script's iso_ago() already tries both forms.