AWS cost report
By Toolspoke
Compares last week's AWS spend with the week before every Monday and posts the change, and what may explain it, to Slack.
Needs a Toolspoke account. You choose which project it installs into.
- AWS + Slack
- Required integrations
- Runs on a schedule
- Mondays at 9am by default
- Post one message
- What its last step does
- Nothing destructive
- 0 of 22 actions in its tools
On this page
The short version
- What it is
- A ready-made Toolspoke agent that tells your team every Monday how AWS spend moved and what may have caused it.
- What it reads
- Daily cost totals for the last fourteen days and the month so far, and EC2, Lambda and S3 details as evidence.
- Where it posts
- One Slack channel, chosen when you set it up.
- What it reports
- This week against last, the day spend stepped, the month to date with a rough projection, and up to five things that may explain the change.
- How often
- Mondays at 9am once you switch it on.
- What it never does
- Invoke a function, or start, stop, resize or change any resource.
- What you need
- A Toolspoke account, AWS access keys that can read Cost Explorer, EC2, Lambda and S3, and a Slack workspace.
What AWS cost report does
AWS cost report is an AI agent that compares last week's AWS spend with the week before every Monday, finds the day it moved, and posts the numbers and what may explain them to Slack.
An AWS bill that creeps up by a few hundred a week is noticed at month end, when the cause is four weeks old and nobody remembers what changed. By then the instance someone launched for a test has run for a month.
AWS budgets can email you when you cross a line, but a budget alert says you spent too much, not when it started or what changed.
AWS cost report reads the daily totals, works out the change and the day spend stepped up or down, and then looks at what it can see in the account around that day: instances launched, functions changed, buckets created. It names what it saw and when, and says "may explain", because a launch date is evidence, not a bill.
In practice, every Monday morning you get one message:
- Last week's total against the week before, in amount and percent
- The day spend stepped up or down
- The month to date and a rough projection
- Up to five resources that may explain the change, each with its date
How it works
AWS cost report works in four steps every Monday: it reads the daily totals, finds the change, looks for evidence and posts one message. All of it comes from the agent's written instructions, which you can read and edit after you install it.
Step 1: Read the totals
It reads daily cost for fourteen days and the month so far.
Step 2: Find the change
It compares the two weeks and finds the day spend stepped.
Step 3: Look for evidence
It checks instances, functions and buckets that changed near that day.
Step 4: Post one message
It posts the totals, the change, the projection and the evidence.
It reads totals, not a bill by service
It calls get_cost_summary with daily granularity. That gives the account's total for each day, not a split by service, so the report never shows a per-service amount it did not read. The evidence step is how it points at a likely cause.
It finds the step
The first day more than 20% away from last week's daily average, which stays there, is the step. Knowing it began on Wednesday narrows the search to what changed on Wednesday.
It looks for evidence
Only when the change crosses your threshold, it reads EC2 instances with describe_instances, Lambda functions with list_functions and S3 buckets with list_buckets, and names any launched, changed or created near the step.
It projects the month, roughly
Month to date plus this week's daily average for the days left. It is labelled a rough projection, and it is not a forecast. The limits are listed under what it will never do.
What a Monday message looks like
A message from AWS cost report is a single Slack post. It opens with the change, then the day it stepped, the month so far, and the evidence it found.
Fernhill
Channels
- # infra
- # engineering
- # finance
- # general
# infra
13 to 19 October, against 6 to 12 October. Threshold 10% and 50, set at install.
The change
- 2,310 last week, up 470 (26%) on 1,840.
- Spend stepped up on Wednesday 15th, from about 260 a day to about 380.
May explain it (2)
- 4 EC2 instances of type
m6i.2xlargelaunched on 15 October, all still running. - Lambda
image-resizememory raised to 3,008 MB on 14 October.
Month to date
6,920 so far. At this week's rate, a rough projection of 9,800 for October.
- The change
This week against last, in amount and percent, and the day the spend stepped. That day is where to look.
- May explain it
Resources launched, changed or created near the step, each with its date. They are evidence, not a bill.
- Month to date
The month so far and a rough projection at this week's rate.
What a steady week looks like
If the change is under your threshold, the message is two lines: the two totals and the month to date. A steady bill is worth knowing, and it takes a second to read.
A failed run is different. If Cost Explorer cannot be read, it posts that once and stops, so a missing report is never mistaken for a quiet week.
Who uses AWS cost report
AWS cost report suits any team that runs on AWS without someone watching the bill every day. The examples use made-up names.
A CTO at a small company
Hannah Lindqvist signs off the AWS bill each month. Now she sees on Monday that spend jumped on Wednesday, and who to ask.
A platform engineer
Kofi Mensah launched instances for a load test and forgot one group. The Monday message named them with their launch date.
A finance lead
Elena Novak plans cash monthly. The month to date and rough projection tell her early whether AWS will be over the budget line.
A founder on credits
Tariq Hussain runs on AWS credits that end in March. A weekly number keeps the burn in view before the credits run out.
What AWS cost report connects to
AWS cost report connects to two tools: it reads AWS and posts to Slack. You connect each one yourself, and Toolspoke stores the connection encrypted, so the agent never sees the credential.
AWS
RequiredInspect AWS identity, storage, compute, logs, and cost data using scoped IAM credentials.
Authentication: Access keys
Slack
RequiredSearch conversations and send messages to your workspace.
Authentication: Bot token
| Tool | What AWS cost report does | What it cannot do |
|---|---|---|
| AWS | Reads cost totals and resource details (get_cost_summary, describe_instances, list_functions, list_buckets). | Start, stop, resize or terminate an instance, or change a function or bucket: the connector has no action for any of them. It can invoke a Lambda function, which this agent's instructions forbid. |
| Slack | Posts one message with send_message, to a channel. | Delete messages: the connector has no delete action. It can also edit the bot's messages, schedule messages and react, and the agent is told not to. |
The AWS connection cannot change your infrastructure, which is a property of the connector. Its one write is invoking a Lambda function, and the agent is told never to. If you want a lock, switch off invoke in your project, or give the access keys an IAM policy that allows only ce:GetCostAndUsage and the describe and list calls. The access control guide explains how.
The connector can also read S3 objects and CloudWatch log events. The agent is told not to, because names and metadata are enough. An IAM policy without s3:GetObject and log access makes that a lock.
What AWS cost report will never do
AWS cost report is told never to invoke a function or change a resource. It reports the bill and the evidence, and a person decides what to switch off.
- Invoke a Lambda function with invoke, even as a test or a dry run.
- Start, stop, resize or terminate an instance, or change a function, bucket or any other resource.
- Read the contents of S3 objects or log events.
- Post access keys, account ids beyond the last four digits, or instance tags that look like secrets.
- Promise a saving.
Why it does not switch things off
An instance that looks idle may be someone's test that finishes tomorrow, or a database replica nobody remembers is needed. Stopping it is a decision for the team that owns it.
Why it says "may explain"
The cost tool gives totals, not a bill by resource. A launch date that lines up with the step is strong evidence, but it is still evidence.
Why you may still want a lock
The AWS connection has no action that changes a resource. It can invoke a Lambda function, which runs code. The agent is told not to, but switching invoke off in your project, or a narrower IAM policy, makes that a lock.
If something goes wrong
If Cost Explorer cannot be read (it needs ce:GetCostAndUsage, and data can lag a day), post that once and stop. If EC2, Lambda or S3 cannot be read, post the totals and say which evidence was unavailable. If the account has under seven days of cost data, report what there is and skip the comparison.
These are written into AWS cost report's instructions. They guide the agent, but they are not a permission. What it is allowed to touch is set by the access you grant.
AWS cost report reads AWS and reports what it finds. Every change to your infrastructure stays with a person.
When AWS cost report runs
AWS cost report runs on Mondays at 9am, but only after you switch its schedule on. It arrives switched off, so nothing runs and nothing is charged until you decide.
- Each run compares the last seven full days with the seven before.
- Evidence is gathered only when the change crosses your threshold.
- A steady week gets a two line message.
- If Cost Explorer cannot be read, it posts that once.
Each run uses model credit from your workspace balance, so it makes one run a week. The AWS and Slack calls themselves are free in Toolspoke, though AWS charges a small fee for each Cost Explorer request on its own bill.
Your copy is an ordinary agent in your project. You can pause its schedule there, run it once on demand, change the day and time and edit its instructions. The agent's page lists recent runs and their cost.
How to set up AWS cost report
To see your AWS spend every Monday, add AWS cost report to a Toolspoke project, connect AWS and Slack, choose the channel and switch on the schedule. It takes a few minutes, and nothing runs until the last step.
Step 1: Create a Toolspoke account or sign in
Choose Use this agent. If you are new, you will be asked to sign up first, and you come straight back to this agent afterwards.
Step 2: Add it to a project
Pick the project it should live in. You get your own editable copy, and you can see the two tools it brings before anything connects.
Step 3: Create read-only AWS keys
Create an IAM user or role with
ce:GetCostAndUsage,ec2:DescribeInstances,lambda:ListFunctionsands3:ListAllMyBuckets, and nothing else. Paste its access keys. They are stored encrypted and the agent never sees them.Step 4: Connect Slack
Choose Sign in with Slack and approve the Toolspoke app. For a private channel, add the Toolspoke bot to it first.
Step 5: Set the channel and threshold
Name the channel and the change worth calling out in the instructions. If you leave the threshold out, it uses 10% and at least 50, and says so.
Step 6: Switch on the schedule
The schedule arrives switched off. Run it once to see a message, then switch it on.
Make AWS cost report fit your account
AWS cost report's instructions are plain English and you can edit them after you install it. Installing copies the agent, so your edits stay with your copy. Open the agent in Toolspoke and tell the builder what to change, and it rewrites the instructions.
Paste any sentence below into the builder chat, or say the same thing in your own words.
Only gather evidence when spend moves by 5% and at least 200.
Use the AmortizedCost metric instead of UnblendedCost, because we have savings plans.
Mention @platform-oncall when spend is up more than 20%.
Run every weekday at 9am and compare yesterday with the same day last week.
This changes when the agent wakes up, so the builder edits its schedule as well as the windows.
Also check instances and functions in eu-west-1.
None of these edits needs more access or touches the Never rules. They change what AWS cost report is told, not what the connections allow.
How it compares to other options
AWS cost report beats the alternatives when you want a weekly change with a likely cause in your team's channel, and loses to them when you need a full bill by service or an alert within hours.
| Compared on | AWS cost report | AWS Budgets alerts | AWS Cost Explorer | A cost management platform |
|---|---|---|---|---|
| Week on week change in Slack | Yes | No, a threshold email | You open it | Usually |
| Finds the day spend moved | Yes | No | On a chart | Yes |
| Split by service | No, totals and evidence | No | Yes | Yes |
| Names resources that changed | Yes, with dates | No | No | Often |
| Can change resources | No, the connector cannot | Budget actions can | No | Some can |
| Arrives as it happens | No, weekly | Yes, near it | No | Often |
| Setup effort | Connect two accounts | A few settings | None | A project |
AWS Cost Explorer is the better choice when you need the bill by service, tag or account. AWS cost report reads totals, and points at causes with evidence rather than a breakdown.
AWS Budgets alerts are better when you need to know within hours that you crossed a line. They do not tell you when it started or what changed.
Frequently asked questions
Can AWS cost report stop or delete resources?
No. The AWS connector has no action that starts, stops, resizes or terminates an instance or changes a function or bucket.
Can it run code in my account?
It is told never to. The connector can invoke a Lambda function, so if you want a lock, switch invoke off in your project or leave lambda:InvokeFunction out of the IAM policy (how access works).
Does it break the bill down by service?
No. The cost action it uses returns totals for the account. It finds the day spend moved and names resources that changed around then, as evidence.
Which cost does it use?
Unblended cost by default. If you use savings plans or reserved instances, ask the builder to use amortised cost instead.
Does it cost anything on the AWS side?
AWS charges a small fee for each Cost Explorer API request, on your AWS bill. The agent makes two cost requests a run.
Does it read my data?
It is told not to read S3 objects or log events, only names and metadata. An IAM policy without object and log access makes that a lock.
Is AWS cost report free?
It has no price of its own, and every Toolspoke plan includes agents. Tool calls cost nothing, but each run draws on your usage balance. Pricing has the details.
Catch the creep before month end
Connect AWS and Slack, set your threshold and switch on the schedule. Your first report lands on Monday at 9am.