aws · rajatgoy · Aug 21, 2026
diff --git a/cloudformation/devops-agent-skill-policies.yaml b/cloudformation/devops-agent-skill-policies.yaml
@@ -27,6 +27,7 @@ Metadata:
           - EnableMskOperations
           - EnableServiceQuotaCheck
           - EnableDmsOperationReview
+          - EnableEosCostAnalysis
       - Label:
           default: Optional Resource Scoping
         Parameters:
@@ -111,6 +112,14 @@ Parameters:
     AllowedValues: ['true', 'false']
     Default: 'true'
 
+  EnableEosCostAnalysis:
+    Type: String
+    Description: >
+      EOS Cost Analysis skill (read-only discovery across EKS/RDS/Lambda/ElastiCache/OpenSearch
+      + AWS Pricing API for live Extended Support pricing).
+    AllowedValues: ['true', 'false']
+    Default: 'true'
+
 Conditions:
   CreateNewRole: !Equals [!Ref ExistingRoleName, '']
   SkillAwsHealthEvents: !Equals [!Ref EnableAwsHealthEvents, 'true']
@@ -120,6 +129,7 @@ Conditions:
   SkillMskOperations: !Equals [!Ref EnableMskOperations, 'true']
   SkillServiceQuotaCheck: !Equals [!Ref EnableServiceQuotaCheck, 'true']
   SkillDmsOperationReview: !Equals [!Ref EnableDmsOperationReview, 'true']
+  SkillEosCostAnalysis: !Equals [!Ref EnableEosCostAnalysis, 'true']
   HasRegionRestriction: !Not [!Equals [!Join ['', !Ref AllowedRegions], '']]
 
 Resources:
@@ -302,6 +312,40 @@ Resources:
               - dms:TestConnection
             Resource: '*'
 
+  # eos-cost-analysis: read-only discovery + AWS Pricing API for live Extended Support pricing
+  PolicyEosCostAnalysis:
+    Type: AWS::IAM::Policy
+    Condition: SkillEosCostAnalysis
+    Properties:
+      PolicyName: DevOpsAgentSkill-EosCostAnalysis
+      Roles:
+        - !If [CreateNewRole, !Ref DevOpsAgentRole, !Ref ExistingRoleName]
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: EosResourceDiscovery
+            Effect: Allow
+            Action:
+              - eks:ListClusters
+              - eks:DescribeCluster
+              - rds:DescribeDBInstances
+              - rds:DescribeDBClusters
+              - lambda:ListFunctions
+              - elasticache:DescribeCacheClusters
+              - elasticache:DescribeReplicationGroups
+              - elasticache:DescribeServerlessCaches
+              - es:ListDomainNames
+              - es:DescribeDomain
+              - es:DescribeDomains
+            Resource: '*'
+          - Sid: EosPricingApi
+            Effect: Allow
+            Action:
+              - pricing:GetProducts
+              - pricing:GetAttributeValues
+              - pricing:DescribeServices
+            Resource: '*'
+
   # Optional: restrict agent to specific regions
   PolicyRegionalRestriction:
     Type: AWS::IAM::Policy
@@ -349,6 +393,7 @@ Outputs:
         - msk-operations: ${EnableMskOperations} (kafka:GetBootstrapBrokers)
         - service-quota-check: ${EnableServiceQuotaCheck} (servicequotas:*, cloudwatch:GetMetricData/GetMetricStatistics)
         - database-migration-service-expertise: ${EnableDmsOperationReview} (dms:TestConnection)
+        - eos-cost-analysis: ${EnableEosCostAnalysis} (eks/rds/lambda/elasticache/es read-only + pricing:GetProducts/GetAttributeValues/DescribeServices)
       Skills covered by AIDevOpsAgentAccessPolicy (no extra policy needed):
         - eks-operation-review, enrich-with-aws-security-agent, crm-production-investigation-guidelines
       No IAM required:

diff --git a/custom-agents/eos-cost-analysis/CHANGELOG.md b/custom-agents/eos-cost-analysis/CHANGELOG.md
@@ -0,0 +1,13 @@
+# Changelog
+
+## 1.0.0 (2026-08-20)
+
+Initial release.
+
+- System prompt for a dedicated/scheduled EOS Cost Analysis agent (pairs with the `eos-cost-analysis` skill)
+- Supports 5 services: EKS, RDS/Aurora, Lambda, ElastiCache, OpenSearch
+- Extended Support cost calculation with Year 1/2/3 tiered pricing and Multi-AZ doubling for RDS
+- Single-account and organization-wide (cross-account) analysis via agent associations
+- Never guesses EOS dates or pricing: EOS dates verified from AWS documentation per exact engine + version; pricing retrieved live from the AWS Pricing API
+- Produces persisted CSV artifacts for week-over-week tracking
+- Lambda deprecated-runtime flagging (security risk, no ES cost)
diff --git a/custom-agents/eos-cost-analysis/README.md b/custom-agents/eos-cost-analysis/README.md
@@ -0,0 +1,72 @@
+# EOS Cost Analysis — Custom Agent
+
+## Purpose
+
+A dedicated custom agent that discovers AWS resources approaching or past End of Standard Support and calculates the Extended Support cost impact. Use this when you want automated, scheduled EOS posture reports without manual prompting.
+
+> **Note:** For ad-hoc queries, you don't need this custom agent. Just upload the [eos-cost-analysis skill](../../skills/eos-cost-analysis/) and ask questions in regular Chat. This custom agent is for scheduled/automated runs.
+
+## Key Capabilities
+
+- Runs on demand or on a weekly/monthly schedule
+- Discovers resources across all associated accounts automatically
+- Produces a persisted artifact (report) each run for tracking over time
+- Covers EKS, RDS/Aurora, Lambda, ElastiCache, and OpenSearch
+- Calculates per-resource Extended Support cost with Year 1/2/3 pricing tiers
+
+## Prerequisites
+
+- An AWS DevOps Agent space
+- The [eos-cost-analysis skill](../../skills/eos-cost-analysis/) uploaded to your Agent Space (choose "All agents" for Agent Type)
+- `use_aws` and `verify_aws_claim` tools available in the Agent Space
+- IAM permissions for resource discovery:
+  - `eks:ListClusters`, `eks:DescribeCluster`
+  - `rds:DescribeDBInstances`, `rds:DescribeDBClusters`
+  - `lambda:ListFunctions`
+  - `elasticache:DescribeCacheClusters`
+  - `opensearch:ListDomainNames`, `opensearch:DescribeDomains`
+- IAM permissions for live pricing (managed policy `AWSPriceListServiceFullAccess`):
+  - `pricing:GetProducts`, `pricing:GetAttributeValues`
+- For multi-account analysis: associate secondary accounts in DevOps Agent settings
+
+## Creating the Agent
+
+1. In the DevOps Agent web app, go to the "Agents" menu (on the bottom left pane)
+2. Click "Create agent" (on the right side), then click "Form" (the left-most option)
+3. In the "Name" field, use "eos-cost-analysis"
+4. Copy the content of the `SYSTEM_PROMPT.md` file from this directory, and paste it into the "System prompt" field
+5. In the "Skills" drop-down list, select the "eos-cost-analysis" skill, and click "Create agent"
+6. Add the `use_aws` tool — in the custom agent's window, click "Edit", select "Chat", and type "Add the use_aws tool to this custom agent"
+7. Add the `verify_aws_claim` tool — type "Also add the verify_aws_claim tool"
+8. Verify both tools appear under "Tools" for this custom agent
+
+## Executing the Agent
+
+You can execute the custom agent on-demand, on schedule, or using chat. Follow the [Executing custom agents guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/custom-agents-executing-custom-agents.html) for more information.
+
+**On-demand prompts:**
+- "Run this agent now" (uses default — full EOS analysis across all services and accounts)
+- "Analyze EKS EOS only in us-east-1 and eu-west-1"
+- "Check RDS extended support costs for the last quarter"
+
+**Scheduled runs:**
+- Configure weekly or monthly execution under the agent's schedule settings
+- Each run produces a new artifact version, allowing week-over-week comparison
+
+Once finished, the artifact is persisted on the **Artifacts** page in the DevOps Agent web app.
+
+## Multi-Account Setup
+
+For organization-wide analysis across multiple AWS accounts:
+
+1. In DevOps Agent, go to Settings → Cloud Sources
+2. Click "Add secondary cloud source"
+3. Follow the prompts to create a cross-account role in each secondary account
+4. After association, the agent automatically discovers resources across all connected accounts
+
+No additional configuration needed in the skill or agent — DevOps Agent handles cross-account access transparently.
+
+## Related
+
+- [eos-cost-analysis skill](../../skills/eos-cost-analysis/) — the domain knowledge skill this agent uses (also works standalone in Chat)
+- [AWS DevOps Agent custom agents documentation](https://docs.aws.amazon.com/devopsagent/latest/userguide/working-with-devops-agent-custom-agents-index.html)
diff --git a/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md b/custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md
@@ -0,0 +1,44 @@
+You are an EOS Cost Analyzer — a specialized agent that discovers AWS resources approaching or past End of Standard Support and calculates the financial impact of Extended Support charges across an AWS environment.
+
+## Goal
+
+Identify all resources incurring or approaching Extended Support charges, calculate the per-resource and organization-wide cost impact, and provide actionable upgrade recommendations with AWS documentation references.
+
+## Approach
+
+1. Read the `eos-cost-analysis` skill to load the methodology, discovery procedures, and cost calculation formulas.
+2. Determine scope: which service(s), which regions. Always scan ALL associated accounts by default unless the user explicitly restricts to a specific account.
+3. Discover resources using AWS service APIs via `use_aws`.
+4. Validate EOS dates using documentation search, and retrieve live Extended Support pricing from the AWS Pricing API (`pricing:GetProducts`). Extract only the price per unit — never dump the full pricing response.
+5. Classify each resource by EOS status and calculate its monthly Extended Support cost.
+6. Generate a structured report with per-resource breakdown, urgency levels, and upgrade recommendations.
+7. Produce a CSV artifact with the complete resource inventory and cost analysis.
+
+## Constraints
+
+- Read-only — do not modify, upgrade, or delete any resources.
+- Never guess EOS dates or pricing. Validate EOS dates from AWS documentation per exact engine + version (never reuse one version's date for another, even within the same service); retrieve pricing live from the AWS Pricing API. If a date cannot be confirmed, report "UNVERIFIED"; if pricing cannot be retrieved, report "PRICING_UNAVAILABLE".
+- Extended Support pricing tiers vary by service: EKS is flat ($0.50/cluster/hr), RDS and ElastiCache have Year 3 = 2× the Year 1-2 rate, OpenSearch is a single flat rate. Determine which tier applies based on months past EOS (Year 3 = 24+ months).
+- For RDS Multi-AZ instances, Extended Support is billed on both primary and standby — multiply cost by 2.
+- If cross-account role assumption fails for any account, skip it and note it in the report rather than stopping the entire analysis.
+- All output is AI-generated and must be independently verified before taking action or sharing externally.
+
+## Output
+
+Produce a single artifact titled "EOS Cost Impact Report — [date]" containing:
+
+1. **Executive Summary** — Total monthly/annual Extended Support cost, affected resource count, top impacted accounts.
+2. **Cost Breakdown by Service** — Per-service totals with resource counts.
+3. **Resource Detail Table** — Every affected resource with: ARN, version, EOS status, monthly cost, urgency, recommended upgrade target.
+4. **Upgrade Recommendations** — Per-version migration path with AWS documentation links.
+5. **Security Risk** (if applicable) — Deprecated Lambda runtimes flagged separately (no ES cost, but security risk).
+
+If an EOS Cost Impact Report artifact already exists for the same scope, update it with the latest data instead of creating a new one.
+
+## Notifications
+
+After generating the report, attempt to send a summary notification via Slack or any available communication tool:
+- Try to post a message to the configured Slack channel with: total monthly ES cost, number of CRITICAL resources, top impacted account and service
+- If Slack posting succeeds: note "Notification sent to Slack" in the report
+- If Slack posting fails or no communication tool is available: note "Notification skipped — no communication tool available or posting failed" in the report
+- Do not send a notification if no resources are affected (all supported)
diff --git a/skills/eos-cost-analysis/CHANGELOG.md b/skills/eos-cost-analysis/CHANGELOG.md
@@ -0,0 +1,34 @@
+# Changelog
+
+## 1.0.0 (2026-08-20)
+
+Initial release.
+
+Workflow:
+- 5-phase workflow: Scope -> Discover -> Classify -> Calculate -> Report
+- Works in regular Chat (ad-hoc) or as a Custom Agent (scheduled)
+- Defaults to scanning all associated accounts, all regions (no confirmation gate); announces scope and estimates scan size with a large-scope heads-up (>10 accounts)
+
+Discovery:
+- Services: EKS, RDS/Aurora, Lambda, ElastiCache, OpenSearch
+- RDS covers standalone instances AND Aurora clusters (`DescribeDBClusters`, authoritative cluster EngineVersion)
+- ElastiCache covers redis, valkey, and memcached across node clusters (`DescribeCacheClusters`), replication groups (`DescribeReplicationGroups`), and serverless caches (`DescribeServerlessCaches`)
+- Lambda deprecated-runtime detection verified at runtime (no hardcoded runtime list)
+- Mandatory pagination across all discovery APIs
+- Discovery summary proves which APIs ran and accounts for SUPPORTED resources (not just affected ones)
+
+Classification & pricing:
+- EOS status: IN_EXTENDED_SUPPORT, APPROACHING_EOS, PAST_EXTENDED_SUPPORT, SUPPORTED
+- Per-version EOS date verification from AWS documentation (no guessing, no date-bleed across versions/engines)
+- OpenSearch Elasticsearch vs OpenSearch engine families verified independently (separate EOS calendars)
+- Live pricing from the AWS Pricing API (`pricing:GetProducts`); never hardcoded
+- Region prefix resolved via `pricing:GetAttributeValues`; RDS ExtendedSupport usagetype is region-prefix-free (regionCode filter only)
+- OpenSearch NIH derived from instance type x count; small/micro sizes doc-verified, never extrapolated
+- Year 1/2 vs Year 3 tiered pricing (boundary at >= 24 months); Multi-AZ cost doubling for RDS
+- `jmespath_filter` guidance to avoid dumping large PriceList payloads
+
+Reporting:
+- Reactive (current) vs proactive (projected) cost split with cost-cliff metric
+- CSV artifact with per-resource breakdown, `es_year` sentinel `N/A` for APPROACHING_EOS, and upgrade recommendations
+- Documentation/upgrade lookups via `verify_aws_claim`
+- Lambda deprecated runtimes flagged as security risk (no ES charge)
diff --git a/skills/eos-cost-analysis/README.md b/skills/eos-cost-analysis/README.md
@@ -0,0 +1,79 @@
+# EOS Cost Analysis — Skill
+
+## Purpose
+
+Discovers AWS resources approaching or past End of Standard Support and calculates the Extended Support cost impact across your AWS environment. Covers EKS, RDS/Aurora, Lambda, ElastiCache, and OpenSearch — the services that incur Extended Support charges.
+
+## Key Capabilities
+
+- Discovers resources with deprecated versions across 5 AWS services (multi-account supported)
+- Validates EOS dates and Extended Support pricing against live AWS documentation
+- Calculates per-resource monthly cost with Year 1/2/3 tiered pricing escalation
+- Handles RDS Multi-AZ cost doubling and instance class to vCPU mapping
+- Flags deprecated Lambda runtimes as security risk (no ES charge but patching stops)
+- Produces a structured report with per-resource breakdown, urgency levels, and upgrade recommendations
+
+## Usage Options
+
+### Option 1: Ad-Hoc via Regular Chat
+
+Upload the skill and use it directly in the built-in DevOps Agent chat for on-demand analysis.
+
+**Setup:**
+1. Import the skill (choose "All agents" for Agent Type)
+2. Go to the regular Chat interface
+3. Ask any EOS-related question
+
+**Example prompts:**
+- "What's my EOS cost exposure?"
+- "Check which EKS clusters are in Extended Support"
+- "Full EOS analysis across all services and accounts"
+- "What RDS instances are approaching end of support?"
+
+### Option 2: Dedicated Custom Agent (Scheduled/Automated)
+
+Create a custom agent for scheduled runs that produce reports on a weekly or monthly cadence — no human prompt needed.
+
+**Setup:**
+1. Import the skill (choose "All agents" for Agent Type)
+2. Go to Agents → Create agent → Form
+3. Name: `eos-cost-analysis`
+4. System prompt: paste from [SYSTEM_PROMPT.md](../../custom-agents/eos-cost-analysis/SYSTEM_PROMPT.md)
+5. Skills: select `eos-cost-analysis`
+6. Add tools: `use_aws` and `verify_aws_claim`
+7. Configure a schedule (weekly or monthly) under the agent's settings
+
+**When to use this option:**
+- You want automated, recurring EOS posture reports
+- You want artifacts generated without manual prompting
+- You want to track EOS cost drift over time (compare reports week over week)
+
+## Prerequisites
+
+- AWS DevOps Agent space with `use_aws` and `verify_aws_claim` tools available
+- IAM permissions for resource discovery:
+  - `eks:ListClusters`, `eks:DescribeCluster`
+  - `rds:DescribeDBInstances`, `rds:DescribeDBClusters`
+  - `lambda:ListFunctions`
+  - `elasticache:DescribeCacheClusters`
+  - `opensearch:ListDomainNames`, `opensearch:DescribeDomains`
+- IAM permissions for live pricing (attach managed policy `AWSPriceListServiceFullAccess`):
+  - `pricing:GetProducts`, `pricing:GetAttributeValues`
+- For multi-account analysis: associate secondary accounts in DevOps Agent settings
+- AWS Support plan: Business, Enterprise On-Ramp, or Enterprise (required for DevOps Agent)
+
+## Importing the Skill
+
+1. In the DevOps Agent web app, go to "Skills" (left sidebar)
+2. Click "Import skill"
+3. Upload the zip file containing `SKILL.md`
+4. In "Agent Type" field: select **"All agents"**
+5. Click "Import"
+
+## Related
+
+- [eos-cost-analysis custom agent](../../custom-agents/eos-cost-analysis/) — system prompt and setup guide for the dedicated agent
+- [AWS EKS Version Lifecycle](https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html)
+- [Amazon RDS Extended Support](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/extended-support.html)
+- [Amazon ElastiCache Extended Support](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/extended-support-versions.html)
+- [Amazon OpenSearch Service version support](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/what-is.html#choosing-version)