servosity/msp-skills/aws-billing

AWS Billing Intelligence - Claude Code Skill

Prerequisites: Install the CLI

This skill drives the aws-billing-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/aws-billing/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/aws-billing/install.ps1 | iex ``

1. Verify: aws-billing-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the aws-billing-cli and aws-billing-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

A self-contained Go binary (native AWS SDK, no aws CLI needed) that pulls your bill, breaks it down per-account and per-service with month-over-month deltas, hunts real waste (idle instances, orphaned volumes, data-transfer bleed) instead of nagging you to buy Reserved Instances, and posts a smart HTML/PDF report to Slack. The headline feature is the part everyone else skips: a tiered least-privilege IAM setup (copy-paste policy, one-click CloudFormation, or admin bootstrap) so you can actually share it with a colleague.

When to Use This CLI

Reach for this CLI when someone asks what an AWS bill means, why it changed month-over-month, which linked account is driving spend, or where money is being wasted on idle/orphaned resources. It is the right tool for recurring bill reviews, pre-bill cleanup sweeps, and onboarding a non-expert to read their own AWS costs. It is read-only and waste-focused; it does not buy Reserved Instances or modify any AWS resource.

When Not to Use This CLI

Do not activate this CLI for requests that require creating, updating, deleting, publishing, commenting, upvoting, inviting, ordering, sending messages, booking, purchasing, or changing remote state. This printed CLI exposes read-only commands for inspection, export, sync, and analysis.

Unique Capabilities

Onboarding that doesn't make you quit

• `iam-setup` - Get from zero to a working billing read-only setup with copy-paste least-privilege policy, a one-click CloudFormation launch-stack, or an admin bootstrap path.

_Reach for this first when sharing the tool with someone who has never touched IAM - it produces exactly the permissions this CLI needs and nothing more._

``bash aws-billing-cli iam-setup --tier core --format cloudformation ``

• `doctor` - Probes the AWS credential chain and, on an AccessDenied, names the exact missing ce:/ec2: permission and whether you're in a member vs management account.

_Run this whenever a command fails with AccessDenied - it tells you precisely what to fix instead of a generic stack trace._

``bash aws-billing-cli doctor --json ``

Local state that compounds

• `consolidated` - Shows each linked account's bill with names resolved, the management rollup, and an inline month-over-month delta per account in one view.

_The fastest answer to 'which account is driving the org bill and is it creeping?'_

``bash aws-billing-cli consolidated --period this-month --agent ``

• `ask` - Answers known questions about your bill (top services, biggest month-over-month mover, per-account total, transfer spend) straight from the local cache; emits the relevant slice as JSON for anything it can't answer directly.

_Lets a non-expert get a plain answer about the bill without learning Cost Explorer's dimension grammar._

``bash aws-billing-cli ask "what changed since last month" --agent ``

Waste-first, not upsell-first

• `waste rank` - One table of every idle, orphaned, or over-provisioned resource the hunters found, sorted by estimated monthly dollars wasted, with a grand-total you could save.

_The table to paste into Slack before the monthly bill lands - it turns 'I think we're wasting money' into a ranked, actionable number._

``bash aws-billing-cli waste rank --agent --select rows.resource_id,rows.monthly_waste_usd ``

• `waste gp2-gp3` - Lists gp2 EBS volumes and computes the exact monthly dollars saved by converting each to gp3.

_A concrete, low-risk savings target you can act on the same day without touching workloads._

``bash aws-billing-cli waste gp2-gp3 --profile-aws dev ``

• `waste transfer` - Surfaces the cross-AZ, cross-region, and NAT-gateway data-transfer line items ranked by spend, with the AZ/region pair that's bleeding.

_Data transfer is the most confusing and most over-looked AWS cost; this names exactly where it's leaking._

``bash aws-billing-cli waste transfer --period last-month ``

Command Reference

accounts - AWS Organizations member accounts (id, name, status)

• aws-billing-cli accounts get - Get one synced AWS account
• aws-billing-cli accounts list - List synced AWS accounts in the organization

ask

• aws-billing-cli ask - Answers known questions about your bill (top services, biggest month-over-month mover, per-account total, transfer spend) straight from the local cache; emits the relevant slice as JSON for anything it can't answer directly.

consolidated

• aws-billing-cli consolidated - Shows each linked account's bill with names resolved, the management rollup, and an inline month-over-month delta per account in one view.

iam-setup

• aws-billing-cli iam-setup - Get from zero to a working billing read-only setup with copy-paste least-privilege policy, a one-click CloudFormation launch-stack, or an admin bootstrap path.

waste

• aws-billing-cli waste rank - One table of every idle, orphaned, or over-provisioned resource the hunters found, sorted by estimated monthly dollars wasted, with a grand-total you could save.

• aws-billing-cli waste gp2-gp3 - Lists gp2 EBS volumes and computes the exact monthly dollars saved by converting each to gp3.

• aws-billing-cli waste transfer - Surfaces the cross-AZ, cross-region, and NAT-gateway data-transfer line items ranked by spend, with the AZ/region pair that's bleeding.

Finding the right command

When you know what you want to do but not which command does it, ask the CLI directly:

aws-billing-cli which "<capability in your own words>"

which resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code 0 means at least one match; exit code 2 means no confident match - fall back to --help or use a narrower query. --json (and other machine formats) keep that exit-2 contract and write {"matches":[]} on stdout so agents can inspect the envelope without treating a miss as success.

Recipes

Monday bill-creep check

aws-billing-cli consolidated --period this-month --agent --select accounts.name,accounts.amount_usd,accounts.delta_pct

Per-account spend with month-over-month delta, narrowed to just the three fields that answer 'is it creeping?'

Pre-bill waste sweep for a dev account

aws-billing-cli waste rank --profile-aws dev --agent

Dollar-ranked idle/orphaned/over-provisioned resources in the member account, ready to act on before the bill lands.

Find the data-transfer bleed

aws-billing-cli waste transfer --period last-month

Ranks the cross-AZ/region/NAT data-transfer line items so you can see exactly where transfer cost is leaking.

Decode a confusing line item

aws-billing-cli explain EUC1-DataTransfer-Out-Bytes

Plain-English decode of an opaque usage-type string.

Auto-report to Slack with attitude

aws-billing-cli report --post-slack --yes --period last-month --snark

Renders the HTML/PDF breakdown, posts it to Slack, with the opt-in Corey-Quinn voice on the human summary.

Auth Setup

Uses the native AWS credential chain - environment variables, a shared --profile, SSO, or assume-role (EC2 instance-metadata credentials are not used) - and signs requests itself (SigV4), so no access keys to paste and no aws CLI required. Org-wide cost data lives in the management/payer account; run iam-setup to mint exactly the read-only permissions this tool needs, then doctor to confirm what's reachable. Resource-level waste scans work in any member account immediately.

Run aws-billing-cli doctor to verify setup.

Credential safety

• AWS credentials come from the AWS SDK default chain (environment variables, ~/.aws shared files, SSO, assume-role, or an instance or task role). This CLI stores none of its own, and config.toml never holds one.
• Signed AWS requests go only to the AWS endpoints of the services this CLI calls (Cost Explorer, Organizations, STS, EC2, CloudWatch, S3, and the SSO and sign-in services), over HTTPS. A custom endpoint (AWS_ENDPOINT_URL) and every redirect are refused, so a signature or session token never reaches another host.
• The shared credential kit holds every AWS credential this program can read from the moment it starts (the credential variables, ~/.aws/credentials, the credential keys of ~/.aws/config, the SSO and login token caches, the web identity and container token files) and every credential the AWS SDK retrieves while it runs. Nothing the CLI or the MCP server prints, writes to a file or to the local store, hands to a helper program, or sends to a host other than those AWS endpoints can carry one, in any encoding: the kit withholds the whole message, file write, store row or request, and prints "[credkit: withheld from <where>: it carried a credential this program holds]" in its place. Responses are never cached on disk.
• Three AWS setups are refused rather than weakened: a custom CA bundle (AWS_CA_BUNDLE, or ca_bundle in the AWS config) stops with an error, a container credential endpoint that needs an authorization token over plain HTTP (EKS Pod Identity, or ECS with AWS_CONTAINER_AUTHORIZATION_TOKEN) is never sent the token, and EC2 instance-metadata (instance role) credentials are not used: nothing is sent to the instance-metadata service, so on EC2 use a profile, SSO or environment keys.
• --dry-run sends nothing to AWS. report --post-slack only previews the post unless you add --yes; over MCP the report tool previews until confirm: true, and an MCP call never writes a file. The Slack and PDF helper programs start with no AWS variable but the region, and do not start at all when their arguments, input or environment would carry a credential this program holds.

Agent Mode

Add --agent to any command. Expands to: --json --compact --no-input --no-color.

Global format flags share one contract on promoted, novel, sync, and --deliver paths:

• --json - one JSON document on stdout (sync progress events go to stderr)
• --compact - keep identity/status/timestamp fields; does not change the document vs stream shape
• --csv / --plain - tabular rows (collection envelopes unwrap to the row array). --csv prefixes ' on a cell or header key that starts with =, +, -, @, tab, CR, or LF (fullwidth ＝＋－＠ too) so a spreadsheet does not run it as a formula; a plain signed number such as -5 or +2.5e3 is unchanged.
• --quiet - one identity value per row, no envelope