Build1 publisher2 min readPublished
AWS's FinOps Agent reads CloudTrail to name the role behind the cost spike
The agent runs on Amazon Bedrock, starts its investigation when Cost Anomaly Detection fires, and posts the root cause into the Slack channel where the engineers who provisioned the resource already work. Public preview is us-east-1 only.
The Engineer · Build desk
What happened
- AWS launched the FinOps Agent in June 2026 to investigate costs in an account, with integrations for Slack and Jira.
- When Cost Anomaly Detection flags a deviation, the agent investigates the root cause and can publish a consolidated report in a Slack channel or open a Jira ticket with the result.
- Cost Optimization Hub and Compute Optimizer have to be enabled before the agent is created, or the agent still answers queries while its optimization recommendations return empty.
- During the public preview the service is only available in us-east-1 and is not listed in other regions, so the console has to be switched there to set it up.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure An anomaly report that carries the user or role and the time of the change puts a person-level attribution into a shared channel.
- decision Verifying the setup becomes its own step, because an agent created in the wrong order behaves like a healthy one and returns no savings recommendations, the same output it would give if there were none to find.
- constraint Shops standardised on other regions have to operate their cost tooling from a us-east-1 console for as long as the preview lasts.
- cost The adoption bill is IAM role creation and a Slack app authorisation, both of which need someone holding admin rights in each system.
Cost Anomaly Detection is the trigger. CloudTrail decides what the alert can say. According to the dev.to walkthrough, the agent uses CloudTrail's API activity logs to identify the infrastructure changes made during an anomaly, correlating the cost increase with the action that caused it and identifying which user or role ran that change and at what moment [8].
Three of the agent's four features wait for a person or a clock [18]. Natural-language cost queries run against the account's real cost and usage data when someone asks [3]. The consolidated Cost Optimization Hub and Compute Optimizer recommendations are a pull [5]. Scheduled reports go out daily, weekly or monthly as HTML, PDF or PPT [6].
Both prerequisite services cost nothing, and AWS can take some hours after they are enabled to produce recommendations, so the dashboards may be empty on first access [11].
The console asks for two permissions and they do different jobs. The recommended option, "Auto-create a new FinOps Agent role", creates the role the agent uses to read the account's cost data [14]. The second governs what the web application may do: create tasks, view execution history and manage context files, with an "Auto-create a new FinOps Operator role" option to generate it [15].
The case for pushing any of this into Slack is the walkthrough's own reasoning. It says AWS cost data is normally consulted in Cost Explorer, Compute Optimizer and Cost Optimization Hub, that those tools are usually accessed only by the FinOps or infrastructure team, and that the development teams provisioning the resources rarely open them [16]. Without active monitoring, it says, a team can be slow to identify when a cost rises, and publishing into the channel where the team works every day reduces the chance an anomaly goes unnoticed [17]. The write-up does not quantify that lag or state a price for the agent [19]. It does list an account with enough cost volume to generate recommendations among the prerequisites [13].
What to watch
- General availability and any region beyond us-east-1, which is the main blocker for shops that do not run consoles there.
- Whether the Jira path carries the same CloudTrail attribution as the Slack report, or only the cost summary.
- Whether AWS narrows the Operator role's task-creation and context-file permissions before general availability.