scan

AWS Cost Optimization Scan

Step 0: Ask for AWS Profile

If a profile name was passed as an argument ($ARGUMENTS), use it and skip the question. Otherwise, ask the user which AWS profile to use:

{
  "questions": [{
    "header": "AWS Profile",
    "question": "Which AWS profile should I use for the scan?",
    "multiSelect": false,
    "options": [
      {"label": "default", "description": "Use default AWS credentials"},
      {"label": "Enter profile name", "description": "I'll type my profile name"}
    ]
  }]
}

If user selects "Enter profile name" or "Other", ask them to type the profile name.

Store the profile name for all subsequent AWS commands.

Authentication: AWS commands work with any valid AWS credentials:

• SSO profile: --profile your-sso-profile
• Named profile: --profile your-profile
• Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
• IAM role (EC2/Lambda): automatic

Step 1: Discover Account

aws sts get-caller-identity --profile {profile}

Extract:

• Account ID → use in report header
• Profile name → use for file naming: reports/findings_{profile}.json

Step 2: Find Active Regions

# Get all regions
aws ec2 describe-regions --profile {profile} --query 'Regions[].RegionName' --output json

# Check which have EC2 instances (quick check)
aws ec2 describe-instances --profile {profile} --query 'Reservations[].Instances[0].Placement.AvailabilityZone' --output text

Only scan regions with resources.

Step 3: Ask Compliance

Use AskUserQuestion:

{
  "questions": [{
    "header": "Compliance",
    "question": "Which compliance requirements apply?",
    "multiSelect": true,
    "options": [
      {"label": "HIPAA", "description": "Healthcare - skip PHI resources"},
      {"label": "SOC2", "description": "Audit - preserve all logs"},
      {"label": "PCI-DSS", "description": "Payments - skip payment infra"},
      {"label": "None", "description": "No compliance requirements"}
    ]
  }]
}