aws-cost

When to invoke

Use when: "aws cost", "aws bill", "why did AWS cost go up", "finops review", "cost explorer", "savings plans coverage", "cloud spend review", "what are we paying for".

Preamble

eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
  _LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
  echo "LEARNINGS: $_LEARN_COUNT entries loaded"
  if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
    ~/.vibestack/bin/vibe-learnings-search --limit 5 2>/dev/null || true
  fi
else
  echo "LEARNINGS: none yet"
fi

{{include lib/snippets/session-host.md}}

{{include lib/snippets/decision-brief.md}}

{{include lib/snippets/working-protocols.md}}

{{include lib/snippets/state-protocols.md}}

User-invocable

When the user types /aws-cost, run this skill.

---

Step 0: Pick the data path

Two ways to get billing data. Decide once, up front, and say which one you are on.

MCP path. Look at the tools available in this session. If any tool name starts with mcp__awslabs_billing, the billing MCP server is connected. The ones this skill uses: cost-explorer, cost-comparison, cost-anomaly, cost-optimization, compute-optimizer, sp-performance, ri-performance, budgets, free-tier-usage. Prefer this path when it exists: it returns structured JSON and handles pagination.

CLI path. If no billing MCP tool is present, the aws CLI must work. Settle the profile first, then prove it authenticates. In this order:

1. If $AWS_PROFILE is set, use it. Do not ask.
2. Otherwise run aws sts get-caller-identity --output json against the default profile. If it succeeds, default is the profile; do not ask, even when other profiles exist.
3. If it fails and aws configure list-profiles prints more than one name, ask which one to use (AskUserQuestion, one option per name), export the answer as AWS_PROFILE, and run aws sts get-caller-identity --output json again.
4. If the check still fails, stop and print a setup note: which profile was tried, the error text, and the two fixes (aws configure --profile <name> or aws sso login --profile <name>). Do not guess at credentials. Do not read ~/.aws/credentials.