Fabrico Analyze Aws Costs

---
description: "Perform a comprehensive AWS cost optimization and tagging compliance audit — checks IaC code first, then validates everything against live infrastructure via API."
argument-hint: "[AWS Account/Profile, Region, or 'all'] [focus: specific service or 'everything']"
---

> **Delegate to the `fabrico-devops-engineer` subagent.** Launch it with the Task tool (subagent_type: `fabrico-devops-engineer`), passing the user's request below and any referenced context. Adopt its operating contract; do not do this work in the main thread when the subagent applies.

The request: $ARGUMENTS

Perform an exhaustive, evidence-based AWS cost optimization and tagging compliance audit. Use a **hybrid approach**: analyze Terraform/IaC code first (if available), then **always** validate against live AWS infrastructure via API. The goal is to inspect every nook and cranny — every service, every resource, every configuration — for optimization opportunities, waste, misconfigurations, and tagging gaps.

When the user does not specify a narrow scope, **default to auditing everything** in the given account and region.

## Required Skills
Before starting, load and follow these skills (in this order):
- `fabrico-technical-context-discovering` — identify existing IaC patterns, tagging conventions, and project context
- `fabrico-codebase-analysing` — IaC structure analysis, module relationships, and dead code detection; apply Steps 7, 2, 12 when IaC files are found
- `fabrico-optimizing-cloud-cost` — cost analysis framework: Pricing Model Decision table, Storage Tiering Decision, tagging standards, rightsizing process, and anti-patterns
- `fabrico-implementing-terraform-modules` (conditional) — Terraform module structure, best practices, and AWS module reference; load when Terraform files are found
- `fabrico-managing-secrets` (conditional) — secrets management audit criteria, security checklist, and exposure risk assessment; load when security findings are in scope

## Workflow

1. **Scope validation**:
   - User should specify **AWS Account/Profile** and **Region** (or "all regions").
   - If missing, ask the user to clarify before proceeding.
   - If the user specifies a focus (e.g., "EC2 only"), respect that scope. Otherwise, **audit all services** — compute, storage, databases, networking, serverless, containers, AI/ML, security, and any other active resources.

2. **Load required skills** (MUST complete before any analysis):
   - **Always load** the `fabrico-technical-context-discovering` skill (use the **Read** tool on `.claude/skills/fabrico-technical-context-discovering/SKILL.md`) — follow its process to identify existing IaC patterns, tagging conventions, and project context.
   - **Always load** the `fabrico-codebase-analysing` skill (use the **Read** tool on `.claude/skills/fabrico-codebase-analysing/SKILL.md`) — even if no IaC files are found initially, this skill's Step 7 (infrastructure code) helps identify IaC in unexpected locations, and Step 2 (dependencies) reveals infrastructure-related dependencies in any project.
   - **Always load** the `fabrico-optimizing-cloud-cost` skill (use the **Read** tool on `.claude/skills/fabrico-optimizing-cloud-cost/SKILL.md` and `references/tagging-standards.md`) — use it to establish the "Core 5" Mandatory Tags, Pricing Model Decision table, Storage Tiering Decision table, Process steps, Checklist, and Anti-Patterns. If the skill file cannot be found, use the following hardcoded defaults for the Core 5 Mandatory Tags: `CostCenter`, `Environment`, `Service`, `Owner`, `DataClass`.
   - **Conditionally load** the `fabrico-implementing-terraform-modules` skill (use the **Read** tool on `.claude/skills/fabrico-implementing-terraform-modules/SKILL.md`) — load when Terraform files (`*.tf`, `*.tfvars`, `terragrunt.hcl`) are found. Use it as the reference standard for module structure, naming conventions, provider pinning, and AWS-specific module patterns when evaluating IaC quality and generating Terraform code.
   - **Conditionally load** the `fabrico-managing-secrets` skill (use the **Read** tool on `.claude/skills/fabrico-managing-secrets/SKILL.md`) — load when the audit scope includes security (which is always for a full audit). Use its Security Checklist, Anti-Patterns, and Cloud-Native Detection patterns when evaluating secrets management, KMS keys, and credential handling.
   - **Fallback**: If any skill file cannot be loaded, log the failure, note the skill gap in the final report's Executive Summary, and proceed with available skills.
   - Do **not** proceed to step 3 until all applicable skills have been read and their processes initiated.

3. **IaC-first discovery** (hybrid approach — IaC then API):
   - Apply the `fabrico-technical-context-discovering` skill process loaded in step 2.
   - **Phase A — Terraform/IaC analysis** (if available):
     - Search the current workspace for Terraform files (`*.tf`, `*.tfvars`, `terragrunt.hcl`) and CloudFormation templates (`*.yaml`, `*.json` with `AWSTemplateFormatVersion`).
     - If found:
       - Apply the `fabrico-codebase-analysing` skill (loaded in step 2) — specifically run its infrastructure code analysis (Step 7), dependency check (Step 2), and dead code/duplication check (Step 12) against the IaC codebase.
       - Apply the `fabrico-implementing-terraform-modules` skill (loaded in step 2) to evaluate module structure quality: check for standard file layout (`main.tf`/`variables.tf`/`outputs.tf`/`versions.tf`), provider version pinning, variable validation blocks, and adherence to AWS module best practices.
       - Parse IaC files to extract provisioned resource types, instance sizes, storage configurations, networking rules, and any hardcoded values that affect cost (e.g., `instance_type`, `allocated_storage`, `desired_count`, `volume_size`, `engine`, `multi_az`).
       - Identify IaC anti-patterns: hardcoded instance types instead of variables, missing lifecycle policies, over-provisioned de