# Devops

DevOps skills and tooling for the PDEGO marketplace.

## Install

```sh
/plugin install devops@pdego-marketplace
```

## Skills

### `analyze-cost-anomaly`

Investigates an AWS Cost Anomaly Detection alert (or any date range) and writes
a root-cause report. The skill drives four bundled, **read-only** boto3 scripts —
the model does the investigation; the scripts only fetch raw data.

Invoke it from a Claude Code session:

```
/analyze-cost-anomaly                          # list recent anomalies, pick one
/analyze-cost-anomaly <anomaly-id>             # investigate a specific anomaly
/analyze-cost-anomaly 2026-06-01..2026-06-10   # ad-hoc analysis of a date range
```

Reports are saved to `reports/<id-or-range>.md` in your working directory and
summarized in the terminal.

#### Requirements

- [uv](https://docs.astral.sh/uv/) and Python 3.10+. The scripts are
  [PEP 723](https://peps.python.org/pep-0723/) scripts that declare their own
  dependencies, so `uv run` resolves and caches `boto3` on first use — no
  `pip install` or virtualenv.
- AWS credentials via the standard chain (`aws configure`, SSO, env vars). All
  scripts accept `--profile NAME`.
- IAM permissions (read-only):
  `ce:GetAnomalies`, `ce:GetCostAndUsage`, `ce:GetSavingsPlansUtilization`,
  `ce:GetSavingsPlansCoverage`, `cloudtrail:LookupEvents`, and the
  `describe-reserved-*` / `describe-savings-plans` describe calls for
  RDS / EC2 / ElastiCache / OpenSearch / Redshift / Savings Plans.

#### Cost & limits

- **Cost Explorer API calls cost $0.01 each.** A typical investigation makes
  3–8 of them. CloudTrail lookups and the reservation/Savings-Plan *describes*
  are free.
- Cost Explorer is served from `us-east-1` regardless of workload region (the
  scripts handle this).
- `cloudtrail:LookupEvents` only covers the **last 90 days** of **management
  events** in the queried region. Older anomalies or data-event-driven costs
  (e.g. S3 object activity) may not appear there.
- Cost Explorer data lags ~24h; an anomaly from today may be incomplete.

#### Bundled scripts

Located under `skills/analyze-cost-anomaly/scripts/` and referenced from the
skill via `${CLAUDE_PLUGIN_ROOT}`:

| Script | What it does |
|---|---|
| `list_anomalies.py` | Recent anomalies from Cost Anomaly Detection with AWS's root-cause hints |
| `cost_breakdown.py` | Daily costs for a period vs. a baseline window, grouped by `SERVICE` / `USAGE_TYPE` / `REGION` / `TAG:<key>`, with per-group deltas |
| `cloudtrail_events.py` | CloudTrail write events (who created/changed what) in a window |
| `reservation_coverage.py` | Reserved Instance / Savings Plan inventory, flagging coverage lapses near a date |

Each prints compact JSON; run with `uv run <script> --help` for all flags.