Optimize AWS costs and monitor cloud operations

AWS Cost & Operations is a community expert skill for AWS cost optimization, monitoring, observability and operational excellence, built around integrated MCP servers and published under the MIT license by the zxkane/aws-skills project. It requires AWS facts to be verified with MCP documentation tools before answering; the aws-mcp-setup dependency is auto-loaded, and if the tools are unavailable the user is guided through that skill's setup.

The plugin bundles three MCP servers:

• AWS Pricing (pricing): pre-deployment cost estimation. It estimates costs before deploying, compares pricing across regions, calculates total cost of ownership and evaluates service options.
• AWS Cost Explorer (costexp): detailed cost analysis. It analyzes historical spending patterns, finds anomalies and trends, forecasts future costs and breaks costs down by service, region or tag.
• Amazon CloudWatch (cw): queries metrics and logs, creates and manages alarms, troubleshoots operational issues and monitors resource utilization.

Five more servers are available separately through the Full AWS MCP Server and are not bundled: Billing and Cost Management (real-time billing), CloudWatch Application Signals (APM and SLOs), AWS Managed Prometheus (PromQL for containers), CloudTrail (API activity audit) and the Well-Architected Security Assessment.

Cost guidance starts with the rule to always estimate before deploying: use the Pricing server to estimate resource costs, compare regions, evaluate alternatives, calculate the expected monthly bill and plan for growth. Regular reviews use Cost Explorer to spot trends and anomalies, review costs by service, region and environment, compare actual versus budgeted spend and generate recommendations. Strategies include right-sizing over-provisioned resources, choosing appropriate S3 and EBS storage classes, auto-scaling, Savings Plans and Reserved Instances, deleting unused resources and snapshots, and consistent cost allocation tags. Budgets are tracked with the Billing and Cost Management server, with alerts on threshold breaches.

Monitoring guidance covers CloudWatch metrics and alarms for CPU and memory, error rates and latency, queue depths, API Gateway throttling and Lambda errors, plus dashboards and Logs Insights. Example alarm scenarios are Lambda error rate above 1 percent, EC2 CPU above 80 percent, spikes in API Gateway 4xx or 5xx errors, DynamoDB throttled requests and ECS task failures. Application Signals adds service-level objectives, dependency monitoring and tracing, and Managed Prometheus covers container resource use, pod and node health and custom PromQL alerts. Audit guidance uses CloudTrail to see who changed resources and to investigate incidents, with sample questions such as "Who deleted this S3 bucket?" and "Show all IAM role changes in the last 24 hours". Security reviews use the Well-Architected Security Assessment across identity and access management, detective controls, infrastructure protection, data protection and encryption, and incident response preparedness.

Use it when optimizing AWS costs, estimating costs before deployment, analyzing bills and spending trends, setting up alarms and observability, querying logs, investigating operational issues, auditing account activity, assessing security posture or applying operational excellence practices.

It should be used only when the task clearly matches its upstream source and project context. Verify commands, generated code, dependencies, credentials and external service behavior before applying changes, and do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.

Inputs are natural-language questions or planned resources, for example:

"Estimate the monthly cost of running a Lambda function with
1 million invocations, 512MB memory, 3-second duration in us-east-1"

Outputs are cost estimates, spending analyses and optimization recommendations, alarm and dashboard configurations, audit findings and security assessment results. Three workflows tie the servers together: cost analysis (estimate with Pricing before deploying, track actual spend with Billing, analyze with Cost Explorer, then implement its recommendations), monitoring (configure metrics and alarms, monitor with CloudWatch, analyze with Application Signals, troubleshoot with Logs) and security (audit with CloudTrail, assess with Well-Architected, remediate, then monitor security events through CloudWatch).

Operational habits it promotes: tag everything for cost allocation, review spending monthly and performance weekly, tune alert thresholds to reduce false positives, make every alert actionable with remediation steps, balance log retention against cost and compliance, grant least privilege, encrypt data at rest and in transit, and keep incident response procedures. Two bundled references provide detail: references/operations-patterns.md for cost, monitoring, observability, security and troubleshooting patterns, and references/cloudwatch-alarms.md with common alarm configurations for Lambda, EC2, RDS, DynamoDB, API Gateway, ECS and Application Load Balancers.

It suits cloud engineers, FinOps practitioners and DevOps teams who want AWS spending, monitoring and security reviews driven by verified documentation and live account data.