- 
+ 
---
@@ -58,6 +58,7 @@ mindmap
Spot Instances
Savings Plans
Schedule Optimization
+ Cost Explorer Integration
Security & Privacy
GDPR Compliance
ISO 27701
@@ -66,11 +67,20 @@ mindmap
30+ AWS Services
AI/ML Services
Multi-Region
+ Multi-Account
+ Kubernetes
+ EKS Sessions
+ Deployment Lifecycle
+ RTO/RPO Analysis
Reporting
HTML Interactive
JSON/CSV Export
S3 Upload
Visual Charts
+ CI/CD Integration
+ GitHub Actions
+ Jenkins
+ CircleCI
```
---
@@ -140,17 +150,25 @@ graph TB
SavingsPlans["Savings Plans"]
CUR["Cost & Usage Report"]
ScheduleOpt["Schedule Optimizer"]
+ CostExplorer["Cost Explorer"]
end
subgraph Governance["Governance"]
Security["Security Analysis"]
Privacy["Privacy Compliance"]
Orphan["Orphaned Resources"]
+ RTO["RTO/RPO Analysis"]
+ end
+
+ subgraph Kubernetes["Kubernetes (EKS)"]
+ EKSSessions["Session Monitoring"]
+ EKSDeployment["Deployment Lifecycle"]
end
style AIML fill:#9b59b6,color:#fff
style Financial fill:#27ae60,color:#fff
style Governance fill:#e74c3c,color:#fff
+ style Kubernetes fill:#326ce5,color:#fff
```
### AI/ML Service Analysis
@@ -165,6 +183,43 @@ Comprehensive cost optimization for AWS AI/ML services:
- **Amazon Transcribe:** Analyzes custom vocabularies, language models, call analytics categories, and job patterns (failed/stuck detection).
- **Amazon Kendra:** Analyzes indexes (edition-based costs), data sources, experiences, and query patterns.
+### v12.0 New Features
+
+#### Multi-Account Analysis
+- **Consolidated Analysis**: Analyze multiple AWS accounts simultaneously with the `--accounts-file` option
+- **Cross-Account Reports**: Generate both individual and consolidated reports across accounts
+- **AWS Organizations Support**: Leverage AWS Organizations for automatic account discovery
+- **Partition Support**: Full support for AWS Commercial, GovCloud, and China partitions
+
+#### Cost Explorer Integration
+- **Real Cost Data**: Integrates with AWS Cost Explorer API for actual spend data
+- **Anomaly Detection**: Identifies cost spikes and unusual spending patterns
+- **Budget Tracking**: Compares actual costs against estimated costs
+- **Service-Level Analysis**: Breaks down costs by AWS service
+
+#### RTO/RPO Analysis
+- **Backup Assessment**: Analyzes backup configurations for RDS, S3, and other services
+- **Cross-Region Replication**: Checks for disaster recovery readiness
+- **Recovery Metrics**: Calculates estimated RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
+- **Compliance Checks**: Identifies resources not meeting recovery requirements
+
+#### EKS Monitoring (Kubernetes)
+- **Session Monitoring**: Tracks active kubectl and SSM sessions to EKS clusters
+- **Deployment Lifecycle**: Monitors deployment health, age, and update frequency
+- **Restart Analysis**: Identifies pods with excessive restart counts
+- **Stale Deployment Detection**: Flags deployments not updated in 90+ days
+
+#### Environment Filtering
+- **Environment Tags**: Filter analysis by environment (production, staging, development, test)
+- **Tag-Based Grouping**: Group resources by custom tags (Team, Project, CostCenter)
+- **Targeted Reports**: Generate environment-specific reports
+
+#### CI/CD Integration
+- **GitHub Actions**: Pre-built workflow for automated weekly analysis
+- **Jenkins Pipeline**: Jenkinsfile for Jenkins CI/CD integration
+- **CircleCI Config**: Configuration for CircleCI pipelines
+- **Artifact Upload**: Automatic report upload to S3 or CI artifacts
+
### Advanced Capabilities & Reporting
- **Multi-Region & China Region Support:** Analyzes resources across multiple specified AWS regions simultaneously, including AWS China regions (`cn-north-1`, `cn-northwest-1`).
@@ -382,12 +437,17 @@ flowchart LR
│ ├── __init__.py
│ ├── ... (various analyzer files) ...
│ ├── cur.py # Cost and Usage Report (CUR) analysis
+│ ├── cost_explorer_analyzer.py # Cost Explorer integration (v12.0)
+│ ├── rto_analyzer.py # RTO/RPO analysis (v12.0)
+│ ├── eks_session_analyzer.py # EKS session monitoring (v12.0)
+│ └── eks_deployment_lifecycle.py # EKS deployment lifecycle (v12.0)
├── core/ # Core Dedo-Duro functionality
│ ├── __init__.py
│ ├── analyzer.py # Main analyzer orchestration with lazy initialization
│ ├── metrics.py # CloudWatch metrics handling
│ ├── reporter.py # Report generation coordination
-│ └── types.py # Type definitions (AnalysisResult, TypedDicts, utc_now)
+│ ├── types.py # Type definitions (AnalysisResult, TypedDicts, utc_now)
+│ └── multi_account.py # Multi-account orchestration (v12.0)
├── reporters/ # Dedo-Duro report generators
│ ├── __init__.py
│ ├── json_reporter.py # JSON report generation
@@ -401,6 +461,13 @@ flowchart LR
│ └── templates/ # Templates for Dockerfile/Helm
├── schedule/ # Schedule optimization module
│ └── __init__.py
+├── ci/ # CI/CD integration templates (v12.0)
+│ ├── Jenkinsfile # Jenkins pipeline configuration
+│ └── github_reporter.py # GitHub-specific output format
+├── .github/workflows/ # GitHub Actions workflows (v12.0)
+│ └── dedo-duro-analysis.yml # Automated analysis workflow
+├── .circleci/ # CircleCI configuration (v12.0)
+│ └── config.yml # CircleCI pipeline config
└── utils/ # Utility functions (shared)
├── __init__.py
├── aws_utils.py # AWS-specific utilities
@@ -615,11 +682,66 @@ flowchart TD
| `--cur-s3-uri` | S3 URI for CUR data | None |
| `--cur-days-ago` | Days of CUR data to analyze | None |
| `--multi-region` | Analyze all regions | False |
+| `--accounts-file` | JSON file with account configs | None |
+| `--all-accounts` | Analyze all Organization accounts | False |
+| `--environment` | Filter by environment (prod/test/dev) | None |
+| `--grouping-tags` | Tags for resource grouping | Team,Project |
| `--verbose` | Detailed output | False |
| `--single-thread` | Disable parallel processing | False |
| `--max-workers` | Parallel workers | 10 |
| `--retry-attempts` | Max retry attempts | 5 |
+### Multi-Account Analysis (v12.0)
+
+Analyze multiple AWS accounts simultaneously:
+
+```bash
+# Using accounts file
+python main.py --accounts-file accounts.json --output-format html
+
+# Analyze all accounts in AWS Organizations
+python main.py --all-accounts --output-format html
+```
+
+**accounts.json** format:
+
+```json
+{
+ "accounts": [
+ {
+ "account_id": "111111111111",
+ "role_arn": "arn:aws:iam::111111111111:role/DedoDuroRole",
+ "alias": "production",
+ "regions": ["us-east-1", "us-west-2"]
+ },
+ {
+ "account_id": "222222222222",
+ "role_arn": "arn:aws:iam::222222222222:role/DedoDuroRole",
+ "alias": "staging",
+ "regions": ["us-east-1"]
+ }
+ ],
+ "partition": "aws"
+}
+```
+
+**Partition values:**
+- `aws` - AWS Commercial (default)
+- `aws-us-gov` - AWS GovCloud
+- `aws-cn` - AWS China
+
+### Environment Filtering (v12.0)
+
+Filter analysis by environment:
+
+```bash
+# Analyze only production resources
+python main.py --environment prod --region us-east-1
+
+# Analyze with custom grouping tags
+python main.py --grouping-tags Team,Project,CostCenter --region us-east-1
+```
+
### Supported Resource Types (Analyzer Keys)
```mermaid
@@ -681,6 +803,7 @@ graph LR
**Full list of analyzer keys:**
- `ec2`, `ec2-eff`, `s3`, `rds`, `ebs`, `ebs_snapshot`, `lambda`, `elasticache`, `elb`, `dynamodb`, `api_gateway`, `nat`, `eip`, `vpc_endpoints`, `spot`, `security_privacy`, `orphan`, `ecs`, `sagemaker`, `bedrock`, `comprehend`, `rekognition`, `textract`, `transcribe`, `kendra`, `opensearch`, `compute_optimizer`, `savings_plans`, `cur`, `cloudfront`, `efs`, `route53`, `schedule_optimizer`, `terraform_recommendations`, `cloudformation_recommendations`
+- **v12.0 New:** `cost_explorer`, `rto_analysis`, `eks_sessions`, `eks_deployments`
---
@@ -753,6 +876,122 @@ flowchart LR
---
+## CI/CD Integration (v12.0)
+
+Dedo-Duro includes ready-to-use CI/CD configurations for automated analysis.
+
+### GitHub Actions
+
+```yaml
+# .github/workflows/dedo-duro-analysis.yml
+name: Dedo-Duro AWS Analysis
+
+on:
+ schedule:
+ - cron: '0 6 * * 1' # Weekly on Mondays
+ workflow_dispatch:
+
+jobs:
+ analyze:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Configure AWS Credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+ aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ aws-region: us-east-1
+
+ - name: Run Dedo-Duro Analysis
+ run: |
+ pip install -r requirements.txt
+ python main.py --region us-east-1 --output-format html
+
+ - name: Upload Report
+ uses: actions/upload-artifact@v4
+ with:
+ name: dedo-duro-report
+ path: '*.html'
+```
+
+### Jenkins Pipeline
+
+```groovy
+// ci/Jenkinsfile
+pipeline {
+ agent any
+
+ triggers {
+ cron('0 6 * * 1') // Weekly
+ }
+
+ environment {
+ AWS_DEFAULT_REGION = 'us-east-1'
+ }
+
+ stages {
+ stage('Setup') {
+ steps {
+ sh 'pip install -r requirements.txt'
+ }
+ }
+
+ stage('Analyze') {
+ steps {
+ withCredentials([[$class: 'AmazonWebServicesCredentialsBinding',
+ credentialsId: 'aws-credentials']]) {
+ sh 'python main.py --region us-east-1 --output-format html'
+ }
+ }
+ }
+
+ stage('Archive') {
+ steps {
+ archiveArtifacts artifacts: '*.html', fingerprint: true
+ }
+ }
+ }
+}
+```
+
+### CircleCI
+
+```yaml
+# .circleci/config.yml
+version: 2.1
+
+jobs:
+ analyze:
+ docker:
+ - image: cimg/python:3.11
+ steps:
+ - checkout
+ - run:
+ name: Install dependencies
+ command: pip install -r requirements.txt
+ - run:
+ name: Run analysis
+ command: python main.py --region us-east-1 --output-format html
+ - store_artifacts:
+ path: .
+ destination: reports
+
+workflows:
+ weekly-analysis:
+ triggers:
+ - schedule:
+ cron: "0 6 * * 1"
+ filters:
+ branches:
+ only: main
+ jobs:
+ - analyze
+```
+
+---
+
## Automated Multi-Account/Region Execution (AWS Batch)
```mermaid
@@ -1010,16 +1249,21 @@ timeline
section Enhancement
v7.0-v8.0 : EC2 efficiency, RI awareness
v9.0 : Containerization, S3 reports
-
- section Current
v10.0 : Type safety, lazy init
v11.0 : AI/ML services
+ section Current
+ v12.0 : Multi-Account support
+ : Cost Explorer integration
+ : RTO/RPO Analysis
+ : EKS Monitoring
+ : CI/CD Integration
+ : Environment filtering
+
section Future
- v12.0+ : CI/CD integration
- : Cost Explorer integration
- : Web interface
- : Auto-remediation
+ v13.0+ : Web interface
+ : Auto-remediation
+ : Real-time dashboards
```
---
@@ -1102,15 +1346,26 @@ The Dedo-Duro architecture supports team collaboration:
## Conclusion
-Dedo-Duro 11.0 introduces comprehensive **AI/ML service cost optimization** capabilities:
+Dedo-Duro 12.0 introduces **enterprise-scale analysis capabilities**:
-- **Amazon SageMaker (Enhanced)**: Complete analysis of notebook instances, endpoints, training jobs, models, Feature Store, and Studio domains
-- **Amazon Bedrock (NEW)**: Provisioned throughput, custom models, guardrails, knowledge bases
-- **Amazon Comprehend (NEW)**: Endpoints, classifiers, entity recognizers, flywheels
-- **Amazon Rekognition (NEW)**: Custom Labels projects, stream processors ($4,320/month if 24/7), face collections
-- **Amazon Textract (NEW)**: Custom adapters, per-operation cost estimation
-- **Amazon Transcribe (NEW)**: Vocabularies, language models, job patterns
-- **Amazon Kendra (NEW)**: Indexes (Developer $810/mo, Enterprise $2,700/mo), data sources, experiences
+### v12.0 Highlights
+
+- **Multi-Account Analysis**: Analyze entire AWS Organizations with consolidated reporting
+- **Cost Explorer Integration**: Real cost data with anomaly detection
+- **RTO/RPO Analysis**: Disaster recovery readiness assessment
+- **EKS Monitoring**: Kubernetes session tracking and deployment lifecycle analysis
+- **Environment Filtering**: Target specific environments (prod/test/dev)
+- **CI/CD Integration**: GitHub Actions, Jenkins, and CircleCI support out-of-the-box
+
+### v11.0 AI/ML Capabilities (Retained)
+
+- **Amazon SageMaker**: Notebook instances, endpoints, training jobs, Feature Store, Studio
+- **Amazon Bedrock**: Provisioned throughput, custom models, guardrails, knowledge bases
+- **Amazon Comprehend**: Endpoints, classifiers, entity recognizers, flywheels
+- **Amazon Rekognition**: Custom Labels projects, stream processors, face collections
+- **Amazon Textract**: Custom adapters, per-operation cost estimation
+- **Amazon Transcribe**: Vocabularies, language models, job patterns
+- **Amazon Kendra**: Indexes, data sources, experiences
This object-oriented approach results in a maintainable and adaptable codebase, capable of evolving with new AWS services and user requirements.
@@ -1126,19 +1381,28 @@ MIT License
Developed and maintained by **Gustavo Lima**.
-Key milestones: v2.0 (architecture), v3.0 (security), v4.0 (Spot), v5.0 (orphan), v7-8.0 (efficiency), v9.0 (automation), v10.0 (type safety), v11.0 (AI/ML services).
+Key milestones: v2.0 (architecture), v3.0 (security), v4.0 (Spot), v5.0 (orphan), v7-8.0 (efficiency), v9.0 (automation), v10.0 (type safety), v11.0 (AI/ML services), v12.0 (multi-account, Cost Explorer, EKS, CI/CD).
---
## To Do's
-- Division of execution by environment, production and test
-- List new permissions required for new functions, such as Kubernetes
-- Monitoring of open sessions by environments versus Kubernetes
-- Monitoring the deployment lifecycle with Kubernetes
-- RTO Analysis Process for Production
-- Reading files with tags and metadata to facilitate the resource grouping process
-- Create the all-in option - Run for a set of accounts at the same time, with logic to not overload the process, delivering segregated and consolidated reports
+### Completed in v12.0 ✅
+
+- ~~Division of execution by environment, production and test~~ → **Environment filtering** (`--environment` flag)
+- ~~Monitoring of open sessions by environments versus Kubernetes~~ → **EKS Session Analyzer** (`eks_sessions`)
+- ~~Monitoring the deployment lifecycle with Kubernetes~~ → **EKS Deployment Lifecycle** (`eks_deployments`)
+- ~~RTO Analysis Process for Production~~ → **RTO/RPO Analyzer** (`rto_analysis`)
+- ~~Reading files with tags and metadata to facilitate the resource grouping process~~ → **Tag-based grouping** (`--grouping-tags`)
+- ~~Create the all-in option - Run for a set of accounts at the same time~~ → **Multi-Account Analysis** (`--accounts-file`, `--all-accounts`)
+
+### Pending
+
+- List new permissions required for new functions, such as Kubernetes (partial - see `docs/kubernetes_permissions.md`)
+- Web interface for real-time monitoring
+- Auto-remediation capabilities (experimental)
+- Integration with Slack/Teams for notifications
+- Custom alerting thresholds
---
diff --git a/analyzers/cost_explorer_analyzer.py b/analyzers/cost_explorer_analyzer.py
new file mode 100644
index 0000000..10a9d71
--- /dev/null
+++ b/analyzers/cost_explorer_analyzer.py
@@ -0,0 +1,482 @@
+"""
+Cost Explorer Analyzer module.
+
+Analyzes AWS Cost Explorer data to identify actual spending patterns,
+cost anomalies, and compare with estimated costs from other analyzers.
+"""
+
+import logging
+from datetime import datetime, timedelta
+from typing import Dict, List, Any, Optional
+from dateutil.tz import tzutc
+
+from core.analyzer import ResourceAnalyzer
+from config import AWSConfig, AnalysisConfig
+from core.metrics import CloudWatchMetrics
+from utils.console import print_error, print_info, print_warning
+
+log = logging.getLogger(__name__)
+
+
+class CostExplorerAnalyzer(ResourceAnalyzer):
+ """
+ Analyzer for AWS Cost Explorer data.
+
+ Provides:
+ - Actual cost breakdown by service
+ - Cost trends over time
+ - Cost anomaly detection
+ - Comparison with optimization estimates
+ """
+
+ def __init__(
+ self,
+ aws_config: AWSConfig,
+ analysis_config: AnalysisConfig,
+ metrics: CloudWatchMetrics,
+ account_id: Optional[str],
+ partition: Optional[str]
+ ):
+ super().__init__(aws_config, analysis_config, metrics, account_id, partition)
+ self.ce_client = aws_config.create_client('ce')
+
+ def get_service_name(self) -> str:
+ return 'cost_explorer'
+
+ def get_estimated_time(self) -> str:
+ return "Medium (30-60s)"
+
+ def get_description(self) -> str:
+ return "Analyzes AWS Cost Explorer data for spending patterns and anomalies"
+
+ def analyze(self, **kwargs) -> List[Dict[str, Any]]:
+ """
+ Analyze AWS Cost Explorer data.
+
+ Returns:
+ List of cost findings and recommendations
+ """
+ results = []
+
+ try:
+ print_info("Analyzing Cost Explorer data...")
+
+ # Get cost data for different time periods
+ end_date = datetime.now(tzutc()).date()
+
+ # Last 30 days
+ start_date_30d = end_date - timedelta(days=30)
+ costs_30d = self._get_costs_by_service(start_date_30d, end_date)
+
+ # Previous 30 days for comparison
+ start_date_60d = end_date - timedelta(days=60)
+ costs_previous = self._get_costs_by_service(start_date_60d, start_date_30d)
+
+ # Get daily cost trend
+ daily_costs = self._get_daily_costs(start_date_30d, end_date)
+
+ # Get cost by linked account (for organizations)
+ costs_by_account = self._get_costs_by_account(start_date_30d, end_date)
+
+ # Analyze cost trends
+ trend_analysis = self._analyze_cost_trends(costs_30d, costs_previous)
+ results.append(trend_analysis)
+
+ # Get top services by cost
+ top_services = self._analyze_top_services(costs_30d)
+ results.extend(top_services)
+
+ # Detect cost anomalies
+ anomalies = self._detect_anomalies(daily_costs)
+ if anomalies:
+ results.extend(anomalies)
+
+ # Multi-account cost breakdown (if applicable)
+ if costs_by_account and len(costs_by_account) > 1:
+ account_analysis = self._analyze_account_costs(costs_by_account)
+ results.append(account_analysis)
+
+ # Generate overall summary
+ results.append(self._generate_cost_summary(costs_30d, daily_costs))
+
+ except Exception as e:
+ log.error(f"Error in Cost Explorer analysis: {e}")
+ print_error(f"Cost Explorer analysis failed: {e}")
+ return [{'error': str(e)}]
+
+ return results
+
+ def _get_costs_by_service(
+ self,
+ start_date: datetime.date,
+ end_date: datetime.date
+ ) -> Dict[str, float]:
+ """Get cost breakdown by AWS service."""
+ try:
+ response = self.ce_client.get_cost_and_usage(
+ TimePeriod={
+ 'Start': start_date.isoformat(),
+ 'End': end_date.isoformat()
+ },
+ Granularity='MONTHLY',
+ Metrics=['UnblendedCost'],
+ GroupBy=[
+ {'Type': 'DIMENSION', 'Key': 'SERVICE'}
+ ]
+ )
+
+ costs = {}
+ for result in response.get('ResultsByTime', []):
+ for group in result.get('Groups', []):
+ service = group['Keys'][0]
+ amount = float(group['Metrics']['UnblendedCost']['Amount'])
+ if service in costs:
+ costs[service] += amount
+ else:
+ costs[service] = amount
+
+ return costs
+
+ except Exception as e:
+ log.warning(f"Error getting costs by service: {e}")
+ return {}
+
+ def _get_daily_costs(
+ self,
+ start_date: datetime.date,
+ end_date: datetime.date
+ ) -> List[Dict[str, Any]]:
+ """Get daily cost data for trend analysis."""
+ try:
+ response = self.ce_client.get_cost_and_usage(
+ TimePeriod={
+ 'Start': start_date.isoformat(),
+ 'End': end_date.isoformat()
+ },
+ Granularity='DAILY',
+ Metrics=['UnblendedCost']
+ )
+
+ daily_costs = []
+ for result in response.get('ResultsByTime', []):
+ daily_costs.append({
+ 'date': result['TimePeriod']['Start'],
+ 'cost': float(result['Total']['UnblendedCost']['Amount'])
+ })
+
+ return daily_costs
+
+ except Exception as e:
+ log.warning(f"Error getting daily costs: {e}")
+ return []
+
+ def _get_costs_by_account(
+ self,
+ start_date: datetime.date,
+ end_date: datetime.date
+ ) -> Dict[str, float]:
+ """Get cost breakdown by linked account (for AWS Organizations)."""
+ try:
+ response = self.ce_client.get_cost_and_usage(
+ TimePeriod={
+ 'Start': start_date.isoformat(),
+ 'End': end_date.isoformat()
+ },
+ Granularity='MONTHLY',
+ Metrics=['UnblendedCost'],
+ GroupBy=[
+ {'Type': 'DIMENSION', 'Key': 'LINKED_ACCOUNT'}
+ ]
+ )
+
+ costs = {}
+ for result in response.get('ResultsByTime', []):
+ for group in result.get('Groups', []):
+ account_id = group['Keys'][0]
+ amount = float(group['Metrics']['UnblendedCost']['Amount'])
+ if account_id in costs:
+ costs[account_id] += amount
+ else:
+ costs[account_id] = amount
+
+ return costs
+
+ except Exception as e:
+ log.warning(f"Error getting costs by account: {e}")
+ return {}
+
+ def _analyze_cost_trends(
+ self,
+ current_costs: Dict[str, float],
+ previous_costs: Dict[str, float]
+ ) -> Dict[str, Any]:
+ """Analyze cost trends comparing current and previous periods."""
+ current_total = sum(current_costs.values())
+ previous_total = sum(previous_costs.values())
+
+ # Calculate change percentage
+ if previous_total > 0:
+ change_pct = ((current_total - previous_total) / previous_total) * 100
+ else:
+ change_pct = 0
+
+ # Identify services with significant cost increases
+ cost_increases = []
+ for service, cost in current_costs.items():
+ prev_cost = previous_costs.get(service, 0)
+ if prev_cost > 0:
+ service_change = ((cost - prev_cost) / prev_cost) * 100
+ if service_change > 20 and cost > 10: # >20% increase and >$10
+ cost_increases.append({
+ 'service': service,
+ 'current_cost': round(cost, 2),
+ 'previous_cost': round(prev_cost, 2),
+ 'change_percent': round(service_change, 1)
+ })
+
+ # Sort by absolute change
+ cost_increases.sort(key=lambda x: x['current_cost'] - x['previous_cost'], reverse=True)
+
+ findings = []
+ recommendation = None
+
+ if change_pct > 20:
+ findings.append({
+ 'type': 'cost_increase',
+ 'severity': 'high' if change_pct > 50 else 'medium',
+ 'message': f"Monthly costs increased by {change_pct:.1f}% compared to previous period",
+ 'details': cost_increases[:5] # Top 5 increases
+ })
+ recommendation = (
+ f"Costs have increased {change_pct:.1f}% from ${previous_total:.2f} to "
+ f"${current_total:.2f}. Review the services with highest increases: "
+ f"{', '.join([c['service'] for c in cost_increases[:3]])}."
+ )
+ elif change_pct < -10:
+ findings.append({
+ 'type': 'cost_decrease',
+ 'severity': 'low',
+ 'message': f"Monthly costs decreased by {abs(change_pct):.1f}%"
+ })
+ recommendation = f"Good progress! Costs decreased by ${previous_total - current_total:.2f}."
+ else:
+ recommendation = "Costs are relatively stable compared to the previous period."
+
+ return {
+ 'resource_type': 'cost_trend_analysis',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'current_period_total': round(current_total, 2),
+ 'previous_period_total': round(previous_total, 2),
+ 'change_percent': round(change_pct, 1),
+ 'significant_increases': cost_increases[:10],
+ 'findings': findings,
+ 'recommendation': recommendation,
+ 'estimated_monthly_savings': 0.0
+ }
+
+ def _analyze_top_services(
+ self,
+ costs: Dict[str, float]
+ ) -> List[Dict[str, Any]]:
+ """Analyze top cost services and identify optimization opportunities."""
+ results = []
+
+ # Sort services by cost
+ sorted_services = sorted(costs.items(), key=lambda x: x[1], reverse=True)
+ total_cost = sum(costs.values())
+
+ for i, (service, cost) in enumerate(sorted_services[:10]):
+ if cost < 1: # Skip services with negligible cost
+ continue
+
+ percentage = (cost / total_cost * 100) if total_cost > 0 else 0
+ findings = []
+ recommendation = None
+ estimated_savings = 0.0
+
+ # Service-specific recommendations
+ if service == 'Amazon Elastic Compute Cloud - Compute':
+ findings.append({
+ 'type': 'ec2_optimization',
+ 'severity': 'medium',
+ 'message': 'EC2 compute costs may have optimization opportunities'
+ })
+ recommendation = (
+ "Review EC2 instances for rightsizing opportunities, Reserved Instance "
+ "or Savings Plan coverage, and consider Spot instances for flexible workloads."
+ )
+ estimated_savings = cost * 0.3 # Estimate 30% potential savings
+
+ elif service == 'Amazon Relational Database Service':
+ findings.append({
+ 'type': 'rds_optimization',
+ 'severity': 'medium',
+ 'message': 'RDS costs may have optimization opportunities'
+ })
+ recommendation = (
+ "Review RDS instances for rightsizing, consider Reserved Instances, "
+ "and evaluate Aurora Serverless for variable workloads."
+ )
+ estimated_savings = cost * 0.25
+
+ elif 'S3' in service:
+ findings.append({
+ 'type': 's3_optimization',
+ 'severity': 'low',
+ 'message': 'S3 storage may benefit from lifecycle policies'
+ })
+ recommendation = (
+ "Review S3 lifecycle policies, enable Intelligent-Tiering, "
+ "and check for unused buckets or objects."
+ )
+ estimated_savings = cost * 0.15
+
+ elif 'NAT Gateway' in service or 'VPC' in service:
+ findings.append({
+ 'type': 'network_optimization',
+ 'severity': 'medium',
+ 'message': 'VPC/NAT Gateway costs may be reducible'
+ })
+ recommendation = (
+ "Review NAT Gateway data processing costs, consider VPC endpoints "
+ "for AWS service traffic, and optimize data transfer patterns."
+ )
+ estimated_savings = cost * 0.4
+
+ else:
+ recommendation = f"Review {service} usage for optimization opportunities."
+
+ results.append({
+ 'resource_type': 'cost_by_service',
+ 'service': service,
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'rank': i + 1,
+ 'monthly_cost': round(cost, 2),
+ 'percentage_of_total': round(percentage, 1),
+ 'findings': findings,
+ 'recommendation': recommendation,
+ 'estimated_monthly_savings': round(estimated_savings, 2)
+ })
+
+ return results
+
+ def _detect_anomalies(
+ self,
+ daily_costs: List[Dict[str, Any]]
+ ) -> List[Dict[str, Any]]:
+ """Detect cost anomalies using simple statistical analysis."""
+ if len(daily_costs) < 7:
+ return []
+
+ results = []
+ costs = [d['cost'] for d in daily_costs]
+
+ # Calculate mean and standard deviation
+ mean_cost = sum(costs) / len(costs)
+ variance = sum((x - mean_cost) ** 2 for x in costs) / len(costs)
+ std_dev = variance ** 0.5
+
+ # Find days with costs > 2 standard deviations from mean
+ anomalies = []
+ for d in daily_costs:
+ if std_dev > 0:
+ z_score = (d['cost'] - mean_cost) / std_dev
+ if abs(z_score) > 2:
+ anomalies.append({
+ 'date': d['date'],
+ 'cost': round(d['cost'], 2),
+ 'expected': round(mean_cost, 2),
+ 'deviation': round(z_score, 2)
+ })
+
+ if anomalies:
+ results.append({
+ 'resource_type': 'cost_anomaly',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'mean_daily_cost': round(mean_cost, 2),
+ 'std_deviation': round(std_dev, 2),
+ 'anomalous_days': anomalies,
+ 'findings': [{
+ 'type': 'cost_spike',
+ 'severity': 'medium',
+ 'message': f"{len(anomalies)} day(s) with unusual cost patterns detected"
+ }],
+ 'recommendation': (
+ f"Detected {len(anomalies)} day(s) with costs significantly different from "
+ f"the ${mean_cost:.2f}/day average. Investigate these dates for unexpected "
+ "usage or billing events."
+ ),
+ 'estimated_monthly_savings': 0.0
+ })
+
+ return results
+
+ def _analyze_account_costs(
+ self,
+ costs_by_account: Dict[str, float]
+ ) -> Dict[str, Any]:
+ """Analyze costs across linked accounts."""
+ total = sum(costs_by_account.values())
+ sorted_accounts = sorted(costs_by_account.items(), key=lambda x: x[1], reverse=True)
+
+ accounts_summary = []
+ for account_id, cost in sorted_accounts:
+ percentage = (cost / total * 100) if total > 0 else 0
+ accounts_summary.append({
+ 'account_id': account_id,
+ 'monthly_cost': round(cost, 2),
+ 'percentage': round(percentage, 1)
+ })
+
+ return {
+ 'resource_type': 'cost_by_account',
+ 'region': self.aws_config.region,
+ 'total_monthly_cost': round(total, 2),
+ 'num_accounts': len(costs_by_account),
+ 'accounts': accounts_summary[:20], # Top 20 accounts
+ 'recommendation': (
+ f"Total spending of ${total:.2f} across {len(costs_by_account)} linked accounts. "
+ f"Top account ({sorted_accounts[0][0]}) represents "
+ f"{sorted_accounts[0][1]/total*100:.1f}% of total costs."
+ ),
+ 'estimated_monthly_savings': 0.0
+ }
+
+ def _generate_cost_summary(
+ self,
+ costs_by_service: Dict[str, float],
+ daily_costs: List[Dict[str, Any]]
+ ) -> Dict[str, Any]:
+ """Generate overall cost summary."""
+ total_monthly = sum(costs_by_service.values())
+
+ # Calculate average daily cost
+ if daily_costs:
+ avg_daily = sum(d['cost'] for d in daily_costs) / len(daily_costs)
+ projected_monthly = avg_daily * 30
+ else:
+ avg_daily = total_monthly / 30
+ projected_monthly = total_monthly
+
+ # Count services with significant spending
+ significant_services = sum(1 for cost in costs_by_service.values() if cost > 10)
+
+ return {
+ 'resource_type': 'cost_summary',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'total_monthly_cost': round(total_monthly, 2),
+ 'average_daily_cost': round(avg_daily, 2),
+ 'projected_monthly_cost': round(projected_monthly, 2),
+ 'total_services': len(costs_by_service),
+ 'significant_services': significant_services,
+ 'top_service': max(costs_by_service.items(), key=lambda x: x[1])[0] if costs_by_service else 'N/A',
+ 'recommendation': (
+ f"Total AWS spend: ${total_monthly:.2f}/month across {len(costs_by_service)} services. "
+ f"Average daily spend: ${avg_daily:.2f}. Review top services for optimization opportunities."
+ ),
+ 'estimated_monthly_savings': 0.0
+ }
diff --git a/analyzers/eks_deployment_lifecycle.py b/analyzers/eks_deployment_lifecycle.py
new file mode 100644
index 0000000..2729690
--- /dev/null
+++ b/analyzers/eks_deployment_lifecycle.py
@@ -0,0 +1,480 @@
+"""
+EKS Deployment Lifecycle Analyzer module.
+
+Analyzes Kubernetes deployment health, rollout status, pod restart patterns,
+and deployment age vs update frequency for EKS clusters.
+"""
+
+import logging
+from datetime import datetime, timedelta
+from typing import Dict, List, Any, Optional
+from dateutil.tz import tzutc
+import base64
+import tempfile
+import os
+
+from core.analyzer import ResourceAnalyzer
+from config import AWSConfig, AnalysisConfig
+from core.metrics import CloudWatchMetrics
+from utils.console import print_error, print_info, print_warning
+
+log = logging.getLogger(__name__)
+
+
+class EKSDeploymentLifecycleAnalyzer(ResourceAnalyzer):
+ """
+ Analyzer for EKS deployment health and lifecycle patterns.
+
+ Analyzes:
+ - Deployment rollout status
+ - Pod restart patterns
+ - Deployment age vs update frequency
+ - Resource utilization trends
+ """
+
+ def __init__(
+ self,
+ aws_config: AWSConfig,
+ analysis_config: AnalysisConfig,
+ metrics: CloudWatchMetrics,
+ account_id: Optional[str],
+ partition: Optional[str]
+ ):
+ super().__init__(aws_config, analysis_config, metrics, account_id, partition)
+ self.eks_client = aws_config.create_client('eks')
+ self.k8s_client = None # Will be initialized per cluster
+
+ def get_service_name(self) -> str:
+ return 'eks_deployments'
+
+ def get_estimated_time(self) -> str:
+ return "Medium-Long (60-120s)"
+
+ def get_description(self) -> str:
+ return "Analyzes EKS deployment health, rollout status, and pod restart patterns"
+
+ def analyze(self, **kwargs) -> List[Dict[str, Any]]:
+ """
+ Analyze EKS deployment lifecycle and health.
+
+ Returns:
+ List of deployment findings and recommendations
+ """
+ results = []
+
+ try:
+ # Get all EKS clusters
+ clusters = self._get_eks_clusters()
+ if not clusters:
+ print_info("No EKS clusters found in the current region")
+ return []
+
+ print_info(f"Analyzing deployments for {len(clusters)} EKS cluster(s)...")
+
+ for cluster_name in clusters:
+ try:
+ cluster_results = self._analyze_cluster(cluster_name)
+ results.extend(cluster_results)
+ except Exception as e:
+ log.warning(f"Error analyzing cluster {cluster_name}: {e}")
+ results.append({
+ 'resource_type': 'eks_cluster',
+ 'cluster_name': cluster_name,
+ 'status': 'error',
+ 'error': str(e),
+ 'recommendation': f"Unable to analyze cluster: {e}"
+ })
+
+ except Exception as e:
+ log.error(f"Error in EKS deployment analysis: {e}")
+ print_error(f"EKS deployment analysis failed: {e}")
+ return [{'error': str(e)}]
+
+ return results
+
+ def _get_eks_clusters(self) -> List[str]:
+ """Get list of EKS cluster names."""
+ try:
+ response = self.eks_client.list_clusters()
+ return response.get('clusters', [])
+ except Exception as e:
+ log.error(f"Error listing EKS clusters: {e}")
+ return []
+
+ def _analyze_cluster(self, cluster_name: str) -> List[Dict[str, Any]]:
+ """
+ Analyze a single EKS cluster's deployments.
+
+ Args:
+ cluster_name: Name of the EKS cluster
+
+ Returns:
+ List of findings for the cluster
+ """
+ results = []
+
+ # Get cluster details
+ try:
+ cluster_info = self.eks_client.describe_cluster(name=cluster_name)
+ cluster = cluster_info.get('cluster', {})
+ except Exception as e:
+ log.error(f"Error describing cluster {cluster_name}: {e}")
+ return [{
+ 'resource_type': 'eks_cluster',
+ 'cluster_name': cluster_name,
+ 'error': f"Cannot describe cluster: {e}"
+ }]
+
+ # Check if we can access the Kubernetes API
+ # This requires proper RBAC configuration
+ try:
+ k8s_available = self._check_k8s_access(cluster)
+ except Exception:
+ k8s_available = False
+
+ # Generate cluster-level metrics analysis using CloudWatch
+ cluster_metrics = self._get_cluster_metrics(cluster_name)
+
+ # Add cluster health summary
+ results.append(self._generate_cluster_summary(
+ cluster_name,
+ cluster,
+ cluster_metrics,
+ k8s_available
+ ))
+
+ # If K8s API is not available, provide recommendations based on CloudWatch only
+ if not k8s_available:
+ results.append({
+ 'resource_type': 'eks_access_warning',
+ 'cluster_name': cluster_name,
+ 'region': self.aws_config.region,
+ 'recommendation': (
+ "Kubernetes API access not available. To enable detailed deployment "
+ "analysis, configure RBAC permissions as documented in "
+ "docs/kubernetes_permissions.md. CloudWatch metrics analysis available."
+ ),
+ 'estimated_monthly_savings': 0.0
+ })
+
+ # Analyze node groups
+ nodegroup_results = self._analyze_nodegroups(cluster_name)
+ results.extend(nodegroup_results)
+
+ return results
+
+ def _check_k8s_access(self, cluster: Dict[str, Any]) -> bool:
+ """
+ Check if we have access to the Kubernetes API.
+
+ Note: Full K8s API access requires additional setup (kubectl credentials).
+ This is a placeholder for when K8s client is configured.
+ """
+ # For now, return False - K8s API access requires additional configuration
+ # In a full implementation, this would attempt to connect to the K8s API
+ return False
+
+ def _get_cluster_metrics(self, cluster_name: str) -> Dict[str, Any]:
+ """
+ Get CloudWatch metrics for the cluster.
+
+ Args:
+ cluster_name: Name of the EKS cluster
+
+ Returns:
+ Dictionary of cluster metrics
+ """
+ metrics = {
+ 'cpu_utilization': None,
+ 'memory_utilization': None,
+ 'pod_count': None,
+ 'node_count': None
+ }
+
+ try:
+ # Get Container Insights metrics if available
+ namespace = 'ContainerInsights'
+
+ # CPU utilization
+ cpu_metrics = self.metrics.get_custom_metric(
+ namespace=namespace,
+ metric_name='pod_cpu_utilization',
+ dimensions=[
+ {'Name': 'ClusterName', 'Value': cluster_name}
+ ],
+ period_days=7
+ )
+ if cpu_metrics:
+ metrics['cpu_utilization'] = cpu_metrics
+
+ # Memory utilization
+ memory_metrics = self.metrics.get_custom_metric(
+ namespace=namespace,
+ metric_name='pod_memory_utilization',
+ dimensions=[
+ {'Name': 'ClusterName', 'Value': cluster_name}
+ ],
+ period_days=7
+ )
+ if memory_metrics:
+ metrics['memory_utilization'] = memory_metrics
+
+ # Pod count
+ pod_metrics = self.metrics.get_custom_metric(
+ namespace=namespace,
+ metric_name='pod_number_of_running_pods',
+ dimensions=[
+ {'Name': 'ClusterName', 'Value': cluster_name}
+ ],
+ period_days=7
+ )
+ if pod_metrics:
+ metrics['pod_count'] = pod_metrics
+
+ except Exception as e:
+ log.warning(f"Error getting cluster metrics for {cluster_name}: {e}")
+
+ return metrics
+
+ def _generate_cluster_summary(
+ self,
+ cluster_name: str,
+ cluster: Dict[str, Any],
+ metrics: Dict[str, Any],
+ k8s_available: bool
+ ) -> Dict[str, Any]:
+ """Generate a cluster health summary."""
+ now = datetime.now(tzutc())
+
+ # Get cluster age
+ created_at = cluster.get('createdAt')
+ cluster_age_days = None
+ if created_at:
+ if isinstance(created_at, datetime):
+ cluster_age_days = (now - created_at).days
+
+ # Determine cluster status
+ status = cluster.get('status', 'UNKNOWN')
+ version = cluster.get('version', 'unknown')
+
+ # Check version for updates
+ findings = []
+ recommendation = None
+
+ # Kubernetes version check (versions older than 1.27 as of 2024)
+ try:
+ major, minor = version.split('.')[:2]
+ minor_int = int(minor)
+ if minor_int < 27:
+ findings.append({
+ 'type': 'outdated_version',
+ 'severity': 'medium',
+ 'message': f"Cluster running Kubernetes {version}. Consider upgrading to a newer version.",
+ 'current_version': version
+ })
+ recommendation = (
+ f"Cluster is running Kubernetes {version}. AWS recommends keeping "
+ "clusters updated to receive security patches and new features. "
+ "Plan an upgrade to a supported version."
+ )
+ except (ValueError, IndexError):
+ pass
+
+ # Check if Container Insights is enabled (based on metrics availability)
+ if not metrics.get('cpu_utilization') and not metrics.get('memory_utilization'):
+ findings.append({
+ 'type': 'no_container_insights',
+ 'severity': 'low',
+ 'message': "Container Insights metrics not detected. Enable for better monitoring.",
+ 'recommendation': "Enable Container Insights for detailed pod and container metrics."
+ })
+
+ if not recommendation:
+ if findings:
+ recommendation = "Review findings for potential improvements."
+ else:
+ recommendation = "Cluster appears healthy. Continue monitoring."
+
+ return {
+ 'resource_type': 'eks_cluster_summary',
+ 'cluster_name': cluster_name,
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'status': status,
+ 'version': version,
+ 'cluster_age_days': cluster_age_days,
+ 'endpoint': cluster.get('endpoint', ''),
+ 'k8s_api_accessible': k8s_available,
+ 'metrics': {
+ 'cpu_avg': metrics.get('cpu_utilization', {}).get('average'),
+ 'memory_avg': metrics.get('memory_utilization', {}).get('average'),
+ 'pod_count_avg': metrics.get('pod_count', {}).get('average')
+ },
+ 'findings': findings,
+ 'recommendation': recommendation,
+ 'estimated_monthly_savings': 0.0
+ }
+
+ def _analyze_nodegroups(self, cluster_name: str) -> List[Dict[str, Any]]:
+ """
+ Analyze node groups for the cluster.
+
+ Args:
+ cluster_name: Name of the EKS cluster
+
+ Returns:
+ List of nodegroup findings
+ """
+ results = []
+
+ try:
+ nodegroups_response = self.eks_client.list_nodegroups(
+ clusterName=cluster_name
+ )
+ nodegroup_names = nodegroups_response.get('nodegroups', [])
+
+ for nodegroup_name in nodegroup_names:
+ try:
+ nodegroup_result = self._analyze_single_nodegroup(
+ cluster_name,
+ nodegroup_name
+ )
+ results.append(nodegroup_result)
+ except Exception as e:
+ log.warning(f"Error analyzing nodegroup {nodegroup_name}: {e}")
+
+ except Exception as e:
+ log.warning(f"Error listing nodegroups for {cluster_name}: {e}")
+
+ return results
+
+ def _analyze_single_nodegroup(
+ self,
+ cluster_name: str,
+ nodegroup_name: str
+ ) -> Dict[str, Any]:
+ """
+ Analyze a single node group.
+
+ Args:
+ cluster_name: Name of the EKS cluster
+ nodegroup_name: Name of the node group
+
+ Returns:
+ Analysis result for the node group
+ """
+ nodegroup_info = self.eks_client.describe_nodegroup(
+ clusterName=cluster_name,
+ nodegroupName=nodegroup_name
+ )
+ nodegroup = nodegroup_info.get('nodegroup', {})
+
+ now = datetime.now(tzutc())
+ findings = []
+ recommendation = None
+ estimated_savings = 0.0
+
+ # Basic nodegroup info
+ status = nodegroup.get('status', 'UNKNOWN')
+ instance_types = nodegroup.get('instanceTypes', [])
+ scaling_config = nodegroup.get('scalingConfig', {})
+ min_size = scaling_config.get('minSize', 0)
+ max_size = scaling_config.get('maxSize', 0)
+ desired_size = scaling_config.get('desiredSize', 0)
+ capacity_type = nodegroup.get('capacityType', 'ON_DEMAND')
+
+ # Check for potential optimizations
+ # 1. Check if nodegroup could use Spot instances
+ if capacity_type == 'ON_DEMAND' and min_size > 1:
+ findings.append({
+ 'type': 'spot_opportunity',
+ 'severity': 'low',
+ 'message': "Node group uses On-Demand instances. Consider Spot for non-critical workloads.",
+ 'instance_types': instance_types
+ })
+ # Rough estimate: 60% savings on Spot
+ if instance_types:
+ from utils.cost_estimator import CostEstimator
+ on_demand_cost = CostEstimator.get_instance_cost(instance_types[0]) * desired_size
+ estimated_savings = on_demand_cost * 0.6
+
+ # 2. Check scaling configuration
+ if min_size == max_size and desired_size == min_size:
+ findings.append({
+ 'type': 'no_autoscaling',
+ 'severity': 'low',
+ 'message': f"Node group has fixed size ({desired_size} nodes). Consider enabling autoscaling.",
+ 'current_size': desired_size
+ })
+
+ # 3. Check for old AMI release version
+ release_version = nodegroup.get('releaseVersion', '')
+ ami_type = nodegroup.get('amiType', 'AL2_x86_64')
+
+ # 4. Check node group age
+ created_at = nodegroup.get('createdAt')
+ nodegroup_age_days = None
+ if created_at:
+ if isinstance(created_at, datetime):
+ nodegroup_age_days = (now - created_at).days
+ if nodegroup_age_days > 180:
+ findings.append({
+ 'type': 'old_nodegroup',
+ 'severity': 'low',
+ 'message': f"Node group is {nodegroup_age_days} days old. Review for potential refresh.",
+ 'age_days': nodegroup_age_days
+ })
+
+ # 5. Check for Graviton opportunity
+ if ami_type in ['AL2_x86_64', 'BOTTLEROCKET_x86_64']:
+ findings.append({
+ 'type': 'graviton_opportunity',
+ 'severity': 'low',
+ 'message': "Node group uses x86_64 architecture. Consider Graviton (ARM64) for cost savings.",
+ 'current_ami_type': ami_type
+ })
+
+ # Generate recommendation
+ if findings:
+ primary_finding = findings[0]
+ if primary_finding['type'] == 'spot_opportunity':
+ recommendation = (
+ f"Consider using Spot capacity for cost savings. Current configuration "
+ f"uses {desired_size} On-Demand {', '.join(instance_types)} nodes. "
+ f"Estimated savings: ${estimated_savings:.2f}/month with Spot."
+ )
+ elif primary_finding['type'] == 'graviton_opportunity':
+ recommendation = (
+ "Consider migrating to Graviton (ARM64) instances for improved "
+ "price-performance. Verify application compatibility first."
+ )
+ elif primary_finding['type'] == 'no_autoscaling':
+ recommendation = (
+ "Enable Cluster Autoscaler and configure scaling policies to "
+ "optimize costs during low-demand periods."
+ )
+ else:
+ recommendation = "Review findings for potential optimizations."
+ else:
+ recommendation = "Node group configuration appears optimal."
+
+ return {
+ 'resource_type': 'eks_nodegroup',
+ 'cluster_name': cluster_name,
+ 'nodegroup_name': nodegroup_name,
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'status': status,
+ 'instance_types': instance_types,
+ 'capacity_type': capacity_type,
+ 'ami_type': ami_type,
+ 'scaling': {
+ 'min_size': min_size,
+ 'max_size': max_size,
+ 'desired_size': desired_size
+ },
+ 'age_days': nodegroup_age_days,
+ 'findings': findings,
+ 'recommendation': recommendation,
+ 'estimated_monthly_savings': round(estimated_savings, 2)
+ }
diff --git a/analyzers/eks_session_analyzer.py b/analyzers/eks_session_analyzer.py
new file mode 100644
index 0000000..053a704
--- /dev/null
+++ b/analyzers/eks_session_analyzer.py
@@ -0,0 +1,396 @@
+"""
+EKS Session Analyzer module.
+
+Monitors active kubectl sessions and SSM sessions to EKS nodes
+for security and operational insights.
+"""
+
+import logging
+from datetime import datetime, timedelta
+from typing import Dict, List, Any, Optional
+from dateutil.tz import tzutc
+
+from core.analyzer import ResourceAnalyzer
+from config import AWSConfig, AnalysisConfig
+from core.metrics import CloudWatchMetrics
+from utils.aws_utils import safe_api_call, safe_get_tag_value
+from utils.console import print_error, print_info, print_warning
+
+log = logging.getLogger(__name__)
+
+
+class EKSSessionAnalyzer(ResourceAnalyzer):
+ """
+ Analyzer for EKS cluster sessions and access patterns.
+
+ Monitors:
+ - Active SSM sessions to EKS nodes
+ - kubectl session patterns (via CloudTrail if available)
+ - Unusual access patterns
+ """
+
+ def __init__(
+ self,
+ aws_config: AWSConfig,
+ analysis_config: AnalysisConfig,
+ metrics: CloudWatchMetrics,
+ account_id: Optional[str],
+ partition: Optional[str]
+ ):
+ super().__init__(aws_config, analysis_config, metrics, account_id, partition)
+ self.ssm_client = aws_config.create_client('ssm')
+ self.eks_client = aws_config.create_client('eks')
+ self.ec2_client = aws_config.create_client('ec2')
+
+ def get_service_name(self) -> str:
+ return 'eks_sessions'
+
+ def get_estimated_time(self) -> str:
+ return "Medium (30-60s)"
+
+ def get_description(self) -> str:
+ return "Monitors active EKS/kubectl sessions and detects unusual access patterns"
+
+ def analyze(self, **kwargs) -> List[Dict[str, Any]]:
+ """
+ Analyze EKS sessions and access patterns.
+
+ Returns:
+ List of session findings and recommendations
+ """
+ results = []
+
+ try:
+ # Get all EKS clusters
+ clusters = self._get_eks_clusters()
+ if not clusters:
+ print_info("No EKS clusters found in the current region")
+ return []
+
+ print_info(f"Analyzing sessions for {len(clusters)} EKS cluster(s)...")
+
+ # Get EKS node instance IDs
+ eks_node_ids = self._get_eks_node_instance_ids(clusters)
+
+ # Get active SSM sessions
+ active_sessions = self._get_active_ssm_sessions()
+
+ # Analyze sessions on EKS nodes
+ eks_sessions = self._filter_eks_sessions(active_sessions, eks_node_ids)
+
+ # Generate findings
+ for cluster_name in clusters:
+ cluster_sessions = [
+ s for s in eks_sessions
+ if s.get('cluster_name') == cluster_name
+ ]
+
+ cluster_result = self._analyze_cluster_sessions(
+ cluster_name,
+ cluster_sessions,
+ eks_node_ids.get(cluster_name, [])
+ )
+ results.append(cluster_result)
+
+ # Add overall session summary
+ if eks_sessions:
+ results.append(self._generate_session_summary(eks_sessions))
+
+ except Exception as e:
+ log.error(f"Error in EKS session analysis: {e}")
+ print_error(f"EKS session analysis failed: {e}")
+ return [{'error': str(e)}]
+
+ return results
+
+ def _get_eks_clusters(self) -> List[str]:
+ """Get list of EKS cluster names."""
+ try:
+ response = self.eks_client.list_clusters()
+ return response.get('clusters', [])
+ except Exception as e:
+ log.error(f"Error listing EKS clusters: {e}")
+ return []
+
+ def _get_eks_node_instance_ids(self, clusters: List[str]) -> Dict[str, List[str]]:
+ """
+ Get EC2 instance IDs for EKS node groups.
+
+ Args:
+ clusters: List of EKS cluster names
+
+ Returns:
+ Dictionary mapping cluster names to lists of instance IDs
+ """
+ cluster_nodes: Dict[str, List[str]] = {}
+
+ for cluster_name in clusters:
+ instance_ids = []
+
+ try:
+ # Get managed node groups
+ nodegroups_response = self.eks_client.list_nodegroups(
+ clusterName=cluster_name
+ )
+
+ for nodegroup_name in nodegroups_response.get('nodegroups', []):
+ try:
+ nodegroup = self.eks_client.describe_nodegroup(
+ clusterName=cluster_name,
+ nodegroupName=nodegroup_name
+ )
+ # Get instances from the Auto Scaling group
+ asg_name = nodegroup.get('nodegroup', {}).get('resources', {}).get(
+ 'autoScalingGroups', [{}]
+ )[0].get('name')
+
+ if asg_name:
+ asg_instances = self._get_asg_instances(asg_name)
+ instance_ids.extend(asg_instances)
+ except Exception as e:
+ log.warning(f"Error getting nodegroup {nodegroup_name}: {e}")
+
+ # Also look for self-managed nodes by tag
+ tagged_instances = self._get_tagged_eks_nodes(cluster_name)
+ instance_ids.extend(tagged_instances)
+
+ cluster_nodes[cluster_name] = list(set(instance_ids))
+
+ except Exception as e:
+ log.warning(f"Error getting nodes for cluster {cluster_name}: {e}")
+ cluster_nodes[cluster_name] = []
+
+ return cluster_nodes
+
+ def _get_asg_instances(self, asg_name: str) -> List[str]:
+ """Get instance IDs from an Auto Scaling group."""
+ try:
+ asg_client = self.aws_config.create_client('autoscaling')
+ response = asg_client.describe_auto_scaling_groups(
+ AutoScalingGroupNames=[asg_name]
+ )
+ instances = []
+ for asg in response.get('AutoScalingGroups', []):
+ for instance in asg.get('Instances', []):
+ instance_id = instance.get('InstanceId')
+ if instance_id:
+ instances.append(instance_id)
+ return instances
+ except Exception as e:
+ log.warning(f"Error getting ASG instances for {asg_name}: {e}")
+ return []
+
+ def _get_tagged_eks_nodes(self, cluster_name: str) -> List[str]:
+ """Get EC2 instances tagged as EKS nodes for a cluster."""
+ try:
+ response = self.ec2_client.describe_instances(
+ Filters=[
+ {
+ 'Name': f'tag:kubernetes.io/cluster/{cluster_name}',
+ 'Values': ['owned', 'shared']
+ },
+ {
+ 'Name': 'instance-state-name',
+ 'Values': ['running']
+ }
+ ]
+ )
+ instances = []
+ for reservation in response.get('Reservations', []):
+ for instance in reservation.get('Instances', []):
+ instances.append(instance['InstanceId'])
+ return instances
+ except Exception as e:
+ log.warning(f"Error getting tagged EKS nodes for {cluster_name}: {e}")
+ return []
+
+ def _get_active_ssm_sessions(self) -> List[Dict[str, Any]]:
+ """Get all active SSM sessions."""
+ try:
+ sessions = []
+ paginator = self.ssm_client.get_paginator('describe_sessions')
+
+ for page in paginator.paginate(State='Active'):
+ for session in page.get('Sessions', []):
+ sessions.append({
+ 'session_id': session.get('SessionId'),
+ 'target': session.get('Target'),
+ 'status': session.get('Status'),
+ 'start_time': session.get('StartDate'),
+ 'owner': session.get('Owner'),
+ 'document_name': session.get('DocumentName'),
+ 'reason': session.get('Reason', '')
+ })
+
+ return sessions
+ except Exception as e:
+ log.warning(f"Error getting SSM sessions: {e}")
+ return []
+
+ def _filter_eks_sessions(
+ self,
+ sessions: List[Dict[str, Any]],
+ cluster_nodes: Dict[str, List[str]]
+ ) -> List[Dict[str, Any]]:
+ """Filter sessions to only those on EKS nodes."""
+ eks_sessions = []
+
+ # Create reverse mapping: instance_id -> cluster_name
+ instance_to_cluster = {}
+ for cluster_name, instance_ids in cluster_nodes.items():
+ for instance_id in instance_ids:
+ instance_to_cluster[instance_id] = cluster_name
+
+ for session in sessions:
+ target = session.get('target', '')
+ # SSM target format is typically i-xxxxxxxxx or mi-xxxxxxxxx
+ instance_id = target.replace('mi-', 'i-') if target.startswith('mi-') else target
+
+ if instance_id in instance_to_cluster:
+ session['cluster_name'] = instance_to_cluster[instance_id]
+ session['instance_id'] = instance_id
+ eks_sessions.append(session)
+
+ return eks_sessions
+
+ def _analyze_cluster_sessions(
+ self,
+ cluster_name: str,
+ sessions: List[Dict[str, Any]],
+ node_ids: List[str]
+ ) -> Dict[str, Any]:
+ """
+ Analyze sessions for a specific cluster.
+
+ Args:
+ cluster_name: Name of the EKS cluster
+ sessions: List of sessions on this cluster's nodes
+ node_ids: List of node instance IDs
+
+ Returns:
+ Analysis result for the cluster
+ """
+ now = datetime.now(tzutc())
+ findings = []
+ risk_level = 'low'
+
+ # Check for active sessions
+ if sessions:
+ # Flag long-running sessions (> 1 hour)
+ long_sessions = []
+ for session in sessions:
+ start_time = session.get('start_time')
+ if start_time:
+ if isinstance(start_time, datetime):
+ duration = now - start_time
+ if duration > timedelta(hours=1):
+ long_sessions.append({
+ 'session_id': session.get('session_id'),
+ 'owner': session.get('owner'),
+ 'duration_hours': round(duration.total_seconds() / 3600, 1),
+ 'instance_id': session.get('instance_id')
+ })
+
+ if long_sessions:
+ findings.append({
+ 'type': 'long_running_sessions',
+ 'severity': 'medium',
+ 'message': f"{len(long_sessions)} session(s) running for more than 1 hour",
+ 'details': long_sessions
+ })
+ risk_level = 'medium'
+
+ # Check for multiple simultaneous sessions
+ if len(sessions) > 3:
+ findings.append({
+ 'type': 'multiple_sessions',
+ 'severity': 'medium',
+ 'message': f"{len(sessions)} simultaneous sessions detected",
+ 'details': [
+ {'session_id': s.get('session_id'), 'owner': s.get('owner')}
+ for s in sessions
+ ]
+ })
+ risk_level = 'medium'
+
+ # Check for sessions from unusual document names
+ unusual_docs = [
+ s for s in sessions
+ if s.get('document_name') and 'SSM-SessionManagerRunShell' not in s.get('document_name', '')
+ ]
+ if unusual_docs:
+ findings.append({
+ 'type': 'unusual_session_type',
+ 'severity': 'low',
+ 'message': f"{len(unusual_docs)} session(s) using non-standard document",
+ 'details': [
+ {'session_id': s.get('session_id'), 'document': s.get('document_name')}
+ for s in unusual_docs
+ ]
+ })
+
+ recommendation = None
+ if risk_level == 'medium':
+ recommendation = (
+ "Review active sessions on EKS nodes. Long-running or multiple simultaneous "
+ "sessions may indicate operational issues or security concerns. Consider "
+ "implementing session time limits and audit logging."
+ )
+ elif sessions:
+ recommendation = (
+ "Active sessions detected on EKS nodes. Ensure all sessions are authorized "
+ "and follow security best practices."
+ )
+ else:
+ recommendation = "No active sessions on EKS nodes. Session access appears secure."
+
+ return {
+ 'resource_type': 'eks_cluster_sessions',
+ 'cluster_name': cluster_name,
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'total_nodes': len(node_ids),
+ 'active_sessions': len(sessions),
+ 'risk_level': risk_level,
+ 'findings': findings,
+ 'sessions': [
+ {
+ 'session_id': s.get('session_id'),
+ 'owner': s.get('owner'),
+ 'instance_id': s.get('instance_id'),
+ 'start_time': s.get('start_time').isoformat() if isinstance(s.get('start_time'), datetime) else str(s.get('start_time')),
+ 'status': s.get('status')
+ }
+ for s in sessions
+ ],
+ 'recommendation': recommendation,
+ 'estimated_monthly_savings': 0.0 # Session analysis is security-focused
+ }
+
+ def _generate_session_summary(
+ self,
+ all_sessions: List[Dict[str, Any]]
+ ) -> Dict[str, Any]:
+ """Generate an overall session summary."""
+ # Group sessions by owner
+ owners = {}
+ for session in all_sessions:
+ owner = session.get('owner', 'unknown')
+ if owner not in owners:
+ owners[owner] = 0
+ owners[owner] += 1
+
+ return {
+ 'resource_type': 'eks_session_summary',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'total_active_sessions': len(all_sessions),
+ 'unique_owners': len(owners),
+ 'sessions_by_owner': owners,
+ 'recommendation': (
+ f"Total of {len(all_sessions)} active sessions across EKS nodes. "
+ f"Sessions from {len(owners)} unique user(s). Review for compliance "
+ "with access policies."
+ ),
+ 'estimated_monthly_savings': 0.0
+ }
diff --git a/analyzers/rto_analyzer.py b/analyzers/rto_analyzer.py
new file mode 100644
index 0000000..13afb9f
--- /dev/null
+++ b/analyzers/rto_analyzer.py
@@ -0,0 +1,513 @@
+"""
+RTO (Recovery Time Objective) Analyzer module.
+
+Analyzes backup configurations, cross-region replication, and disaster
+recovery readiness to evaluate Recovery Time Objectives (RTO) and
+Recovery Point Objectives (RPO).
+"""
+
+import logging
+from datetime import datetime, timedelta
+from typing import Dict, List, Any, Optional
+from dateutil.tz import tzutc
+
+from core.analyzer import ResourceAnalyzer
+from config import AWSConfig, AnalysisConfig
+from core.metrics import CloudWatchMetrics
+from utils.console import print_error, print_info, print_warning
+
+log = logging.getLogger(__name__)
+
+
+class RTOAnalyzer(ResourceAnalyzer):
+ """
+ Analyzer for Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
+
+ Evaluates:
+ - RDS automated backups and snapshots
+ - EC2/EBS snapshot policies
+ - S3 cross-region replication
+ - DynamoDB backup configurations
+ - AWS Backup plan coverage
+ - Cross-region disaster recovery readiness
+ """
+
+ def __init__(
+ self,
+ aws_config: AWSConfig,
+ analysis_config: AnalysisConfig,
+ metrics: CloudWatchMetrics,
+ account_id: Optional[str],
+ partition: Optional[str]
+ ):
+ super().__init__(aws_config, analysis_config, metrics, account_id, partition)
+ self.rds_client = aws_config.create_client('rds')
+ self.ec2_client = aws_config.create_client('ec2')
+ self.s3_client = aws_config.create_client('s3')
+ self.dynamodb_client = aws_config.create_client('dynamodb')
+ self.backup_client = aws_config.create_client('backup')
+
+ def get_service_name(self) -> str:
+ return 'rto_analysis'
+
+ def get_estimated_time(self) -> str:
+ return "Medium-Long (60-120s)"
+
+ def get_description(self) -> str:
+ return "Analyzes backup configurations and disaster recovery readiness"
+
+ def analyze(self, **kwargs) -> List[Dict[str, Any]]:
+ """
+ Analyze RTO/RPO configurations across AWS services.
+
+ Returns:
+ List of DR findings and recommendations
+ """
+ results = []
+
+ try:
+ print_info("Analyzing disaster recovery configurations...")
+
+ # Analyze RDS backup configurations
+ rds_results = self._analyze_rds_backups()
+ results.extend(rds_results)
+
+ # Analyze EBS snapshot policies
+ ebs_results = self._analyze_ebs_snapshots()
+ results.extend(ebs_results)
+
+ # Analyze S3 replication
+ s3_results = self._analyze_s3_replication()
+ results.extend(s3_results)
+
+ # Analyze DynamoDB backups
+ dynamodb_results = self._analyze_dynamodb_backups()
+ results.extend(dynamodb_results)
+
+ # Analyze AWS Backup coverage
+ backup_results = self._analyze_aws_backup()
+ results.extend(backup_results)
+
+ # Generate overall DR summary
+ results.append(self._generate_dr_summary(results))
+
+ except Exception as e:
+ log.error(f"Error in RTO analysis: {e}")
+ print_error(f"RTO analysis failed: {e}")
+ return [{'error': str(e)}]
+
+ return results
+
+ def _analyze_rds_backups(self) -> List[Dict[str, Any]]:
+ """Analyze RDS automated backup configurations."""
+ results = []
+
+ try:
+ paginator = self.rds_client.get_paginator('describe_db_instances')
+
+ for page in paginator.paginate():
+ for db in page.get('DBInstances', []):
+ db_id = db['DBInstanceIdentifier']
+ backup_retention = db.get('BackupRetentionPeriod', 0)
+ multi_az = db.get('MultiAZ', False)
+ engine = db.get('Engine', 'unknown')
+ storage_encrypted = db.get('StorageEncrypted', False)
+
+ # Check for read replicas in other regions
+ read_replicas = db.get('ReadReplicaDBInstanceIdentifiers', [])
+ has_cross_region_replica = False
+
+ findings = []
+ rto_estimate = 'Unknown'
+ rpo_estimate = 'Unknown'
+
+ # Evaluate backup configuration
+ if backup_retention == 0:
+ findings.append({
+ 'type': 'no_backup',
+ 'severity': 'critical',
+ 'message': 'Automated backups are disabled'
+ })
+ rpo_estimate = 'Infinite (no backups)'
+ elif backup_retention < 7:
+ findings.append({
+ 'type': 'short_retention',
+ 'severity': 'medium',
+ 'message': f'Backup retention is only {backup_retention} days'
+ })
+ rpo_estimate = f'{backup_retention} days max'
+ else:
+ rpo_estimate = f'{backup_retention} days max'
+
+ # Evaluate Multi-AZ
+ if not multi_az:
+ findings.append({
+ 'type': 'single_az',
+ 'severity': 'medium',
+ 'message': 'Database is not Multi-AZ (higher RTO on failure)'
+ })
+ rto_estimate = '10-30 minutes (point-in-time recovery)'
+ else:
+ rto_estimate = '1-2 minutes (automatic failover)'
+
+ # Check encryption
+ if not storage_encrypted:
+ findings.append({
+ 'type': 'unencrypted',
+ 'severity': 'low',
+ 'message': 'Storage is not encrypted'
+ })
+
+ # Generate recommendation
+ if findings:
+ if any(f['severity'] == 'critical' for f in findings):
+ recommendation = (
+ f"CRITICAL: Enable automated backups for {db_id} immediately. "
+ "Current configuration provides no disaster recovery capability."
+ )
+ elif not multi_az:
+ recommendation = (
+ f"Enable Multi-AZ for {db_id} to reduce RTO from ~30 minutes "
+ "to ~2 minutes. Consider increasing backup retention to 14+ days."
+ )
+ else:
+ recommendation = (
+ f"Review {db_id} backup retention ({backup_retention} days) "
+ "and consider cross-region read replicas for regional DR."
+ )
+ else:
+ recommendation = f"{db_id} has good DR configuration."
+
+ results.append({
+ 'resource_type': 'rds_dr_analysis',
+ 'resource_id': db_id,
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'engine': engine,
+ 'backup_retention_days': backup_retention,
+ 'multi_az': multi_az,
+ 'storage_encrypted': storage_encrypted,
+ 'read_replicas': len(read_replicas),
+ 'estimated_rto': rto_estimate,
+ 'estimated_rpo': rpo_estimate,
+ 'findings': findings,
+ 'recommendation': recommendation,
+ 'estimated_monthly_savings': 0.0
+ })
+
+ except Exception as e:
+ log.warning(f"Error analyzing RDS backups: {e}")
+
+ return results
+
+ def _analyze_ebs_snapshots(self) -> List[Dict[str, Any]]:
+ """Analyze EBS volume snapshot coverage."""
+ results = []
+
+ try:
+ # Get all volumes
+ volumes_paginator = self.ec2_client.get_paginator('describe_volumes')
+ volumes = []
+ for page in volumes_paginator.paginate():
+ volumes.extend(page.get('Volumes', []))
+
+ if not volumes:
+ return results
+
+ # Get recent snapshots
+ snapshots_paginator = self.ec2_client.get_paginator('describe_snapshots')
+ recent_snapshots = {}
+ cutoff_date = datetime.now(tzutc()) - timedelta(days=7)
+
+ for page in snapshots_paginator.paginate(OwnerIds=['self']):
+ for snapshot in page.get('Snapshots', []):
+ vol_id = snapshot.get('VolumeId')
+ start_time = snapshot.get('StartTime')
+ if vol_id and start_time and start_time > cutoff_date:
+ if vol_id not in recent_snapshots:
+ recent_snapshots[vol_id] = start_time
+ elif start_time > recent_snapshots[vol_id]:
+ recent_snapshots[vol_id] = start_time
+
+ # Analyze each volume
+ volumes_without_snapshots = []
+ volumes_with_old_snapshots = []
+
+ for volume in volumes:
+ vol_id = volume['VolumeId']
+ vol_size = volume.get('Size', 0)
+ vol_state = volume.get('State', 'unknown')
+
+ if vol_id not in recent_snapshots:
+ # Check for any snapshot
+ volumes_without_snapshots.append({
+ 'volume_id': vol_id,
+ 'size_gb': vol_size,
+ 'state': vol_state
+ })
+
+ # Create summary finding
+ if volumes_without_snapshots:
+ results.append({
+ 'resource_type': 'ebs_snapshot_coverage',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'total_volumes': len(volumes),
+ 'volumes_without_recent_snapshot': len(volumes_without_snapshots),
+ 'coverage_percent': round((len(volumes) - len(volumes_without_snapshots)) / len(volumes) * 100, 1),
+ 'unprotected_volumes': volumes_without_snapshots[:20], # Top 20
+ 'estimated_rpo': 'Unknown (no recent snapshots for some volumes)',
+ 'findings': [{
+ 'type': 'missing_snapshots',
+ 'severity': 'high' if len(volumes_without_snapshots) > len(volumes) * 0.5 else 'medium',
+ 'message': f'{len(volumes_without_snapshots)} volumes have no snapshots in the last 7 days'
+ }],
+ 'recommendation': (
+ f"Enable automated snapshots for {len(volumes_without_snapshots)} unprotected volumes. "
+ "Consider using AWS Backup or Data Lifecycle Manager for consistent protection."
+ ),
+ 'estimated_monthly_savings': 0.0
+ })
+ else:
+ results.append({
+ 'resource_type': 'ebs_snapshot_coverage',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'total_volumes': len(volumes),
+ 'volumes_without_recent_snapshot': 0,
+ 'coverage_percent': 100.0,
+ 'estimated_rpo': '7 days or better',
+ 'findings': [],
+ 'recommendation': 'All EBS volumes have recent snapshots. Good DR posture.',
+ 'estimated_monthly_savings': 0.0
+ })
+
+ except Exception as e:
+ log.warning(f"Error analyzing EBS snapshots: {e}")
+
+ return results
+
+ def _analyze_s3_replication(self) -> List[Dict[str, Any]]:
+ """Analyze S3 bucket replication configurations."""
+ results = []
+
+ try:
+ response = self.s3_client.list_buckets()
+ buckets = response.get('Buckets', [])
+
+ buckets_without_replication = []
+ buckets_with_replication = []
+
+ for bucket in buckets:
+ bucket_name = bucket['Name']
+
+ try:
+ # Check for replication configuration
+ replication = self.s3_client.get_bucket_replication(Bucket=bucket_name)
+ rules = replication.get('ReplicationConfiguration', {}).get('Rules', [])
+ if rules:
+ buckets_with_replication.append({
+ 'bucket': bucket_name,
+ 'rules': len(rules)
+ })
+ except self.s3_client.exceptions.ClientError as e:
+ if 'ReplicationConfigurationNotFoundError' in str(e):
+ buckets_without_replication.append(bucket_name)
+
+ total_buckets = len(buckets)
+ replicated = len(buckets_with_replication)
+
+ findings = []
+ if buckets_without_replication:
+ severity = 'medium' if replicated > 0 else 'high'
+ findings.append({
+ 'type': 'no_replication',
+ 'severity': severity,
+ 'message': f'{len(buckets_without_replication)} buckets have no cross-region replication'
+ })
+
+ results.append({
+ 'resource_type': 's3_replication_analysis',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'total_buckets': total_buckets,
+ 'buckets_with_replication': replicated,
+ 'replication_coverage_percent': round(replicated / total_buckets * 100, 1) if total_buckets > 0 else 0,
+ 'buckets_without_replication': buckets_without_replication[:20],
+ 'estimated_rpo': 'Minutes (for replicated)' if replicated > 0 else 'Unknown (no replication)',
+ 'findings': findings,
+ 'recommendation': (
+ f"{replicated}/{total_buckets} buckets have replication enabled. "
+ "Enable cross-region replication for critical data buckets."
+ ) if buckets_without_replication else 'S3 replication is well configured.',
+ 'estimated_monthly_savings': 0.0
+ })
+
+ except Exception as e:
+ log.warning(f"Error analyzing S3 replication: {e}")
+
+ return results
+
+ def _analyze_dynamodb_backups(self) -> List[Dict[str, Any]]:
+ """Analyze DynamoDB table backup configurations."""
+ results = []
+
+ try:
+ paginator = self.dynamodb_client.get_paginator('list_tables')
+ tables = []
+ for page in paginator.paginate():
+ tables.extend(page.get('TableNames', []))
+
+ if not tables:
+ return results
+
+ tables_without_pitr = []
+ tables_with_pitr = []
+
+ for table_name in tables:
+ try:
+ response = self.dynamodb_client.describe_continuous_backups(
+ TableName=table_name
+ )
+ pitr = response.get('ContinuousBackupsDescription', {}).get(
+ 'PointInTimeRecoveryDescription', {}
+ ).get('PointInTimeRecoveryStatus', 'DISABLED')
+
+ if pitr == 'ENABLED':
+ tables_with_pitr.append(table_name)
+ else:
+ tables_without_pitr.append(table_name)
+
+ except Exception as e:
+ log.warning(f"Error checking PITR for table {table_name}: {e}")
+ tables_without_pitr.append(table_name)
+
+ findings = []
+ if tables_without_pitr:
+ findings.append({
+ 'type': 'pitr_disabled',
+ 'severity': 'high' if len(tables_without_pitr) > len(tables) * 0.5 else 'medium',
+ 'message': f'{len(tables_without_pitr)} DynamoDB tables lack point-in-time recovery'
+ })
+
+ results.append({
+ 'resource_type': 'dynamodb_backup_analysis',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'total_tables': len(tables),
+ 'tables_with_pitr': len(tables_with_pitr),
+ 'pitr_coverage_percent': round(len(tables_with_pitr) / len(tables) * 100, 1) if tables else 0,
+ 'tables_without_pitr': tables_without_pitr[:20],
+ 'estimated_rpo': '5 minutes (for PITR-enabled)' if tables_with_pitr else 'Unknown (no PITR)',
+ 'findings': findings,
+ 'recommendation': (
+ f"Enable Point-in-Time Recovery for {len(tables_without_pitr)} DynamoDB tables "
+ "to achieve 5-minute RPO. PITR provides continuous backups with 35-day retention."
+ ) if tables_without_pitr else 'All DynamoDB tables have PITR enabled.',
+ 'estimated_monthly_savings': 0.0
+ })
+
+ except Exception as e:
+ log.warning(f"Error analyzing DynamoDB backups: {e}")
+
+ return results
+
+ def _analyze_aws_backup(self) -> List[Dict[str, Any]]:
+ """Analyze AWS Backup plan coverage."""
+ results = []
+
+ try:
+ # List backup plans
+ plans_response = self.backup_client.list_backup_plans()
+ plans = plans_response.get('BackupPlansList', [])
+
+ # Get protected resources
+ protected_resources = []
+ try:
+ selections_response = self.backup_client.list_protected_resources()
+ protected_resources = selections_response.get('Results', [])
+ except Exception as e:
+ log.warning(f"Error listing protected resources: {e}")
+
+ findings = []
+ if not plans:
+ findings.append({
+ 'type': 'no_backup_plans',
+ 'severity': 'high',
+ 'message': 'No AWS Backup plans configured'
+ })
+
+ results.append({
+ 'resource_type': 'aws_backup_analysis',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'backup_plans': len(plans),
+ 'protected_resources': len(protected_resources),
+ 'plan_names': [p.get('BackupPlanName', 'Unknown') for p in plans],
+ 'findings': findings,
+ 'recommendation': (
+ "No AWS Backup plans detected. Create a backup plan to centralize "
+ "protection for EC2, RDS, EFS, DynamoDB, and other resources."
+ ) if not plans else (
+ f"{len(plans)} backup plan(s) protecting {len(protected_resources)} resources. "
+ "Review coverage to ensure all critical resources are included."
+ ),
+ 'estimated_monthly_savings': 0.0
+ })
+
+ except Exception as e:
+ log.warning(f"Error analyzing AWS Backup: {e}")
+
+ return results
+
+ def _generate_dr_summary(
+ self,
+ all_results: List[Dict[str, Any]]
+ ) -> Dict[str, Any]:
+ """Generate overall disaster recovery summary."""
+ # Count findings by severity
+ critical_count = 0
+ high_count = 0
+ medium_count = 0
+
+ for result in all_results:
+ for finding in result.get('findings', []):
+ severity = finding.get('severity', 'low')
+ if severity == 'critical':
+ critical_count += 1
+ elif severity == 'high':
+ high_count += 1
+ elif severity == 'medium':
+ medium_count += 1
+
+ # Determine overall DR readiness
+ if critical_count > 0:
+ dr_status = 'Critical'
+ dr_score = 'Poor'
+ elif high_count > 2:
+ dr_status = 'Needs Improvement'
+ dr_score = 'Fair'
+ elif high_count > 0 or medium_count > 3:
+ dr_status = 'Moderate'
+ dr_score = 'Good'
+ else:
+ dr_status = 'Good'
+ dr_score = 'Excellent'
+
+ return {
+ 'resource_type': 'dr_summary',
+ 'region': self.aws_config.region,
+ 'account_id': self.account_id,
+ 'dr_status': dr_status,
+ 'dr_score': dr_score,
+ 'critical_findings': critical_count,
+ 'high_findings': high_count,
+ 'medium_findings': medium_count,
+ 'total_findings': critical_count + high_count + medium_count,
+ 'recommendation': (
+ f"Overall DR Status: {dr_status}. "
+ f"Found {critical_count} critical, {high_count} high, and {medium_count} medium findings. "
+ "Address critical and high findings first to improve disaster recovery posture."
+ ),
+ 'estimated_monthly_savings': 0.0
+ }
diff --git a/ci/Jenkinsfile b/ci/Jenkinsfile
new file mode 100644
index 0000000..53d0bda
--- /dev/null
+++ b/ci/Jenkinsfile
@@ -0,0 +1,239 @@
+/**
+ * Dedo-Duro AWS Resource Analysis Pipeline
+ *
+ * This Jenkinsfile runs the Dedo-Duro analyzer to identify AWS cost
+ * optimization opportunities and generate reports.
+ *
+ * Prerequisites:
+ * - AWS credentials configured (via IAM role or credentials plugin)
+ * - Python 3.9+ available on agent
+ * - pip installed
+ *
+ * Parameters:
+ * - AWS_REGION: Target AWS region (optional)
+ * - RESOURCE_TYPES: Comma-separated analyzer keys (optional)
+ * - OUTPUT_FORMAT: Report format (html, json, csv)
+ * - MULTI_REGION: Analyze all regions (boolean)
+ * - ENVIRONMENT_FILTER: Filter by environment tag (prod, test, dev)
+ */
+
+pipeline {
+ agent any
+
+ parameters {
+ string(
+ name: 'AWS_REGION',
+ defaultValue: '',
+ description: 'AWS region to analyze (leave empty for default)'
+ )
+ string(
+ name: 'RESOURCE_TYPES',
+ defaultValue: '',
+ description: 'Comma-separated list of analyzer keys (e.g., ec2,s3,rds)'
+ )
+ choice(
+ name: 'OUTPUT_FORMAT',
+ choices: ['html', 'json', 'csv'],
+ description: 'Report output format'
+ )
+ booleanParam(
+ name: 'MULTI_REGION',
+ defaultValue: false,
+ description: 'Analyze resources across all AWS regions'
+ )
+ string(
+ name: 'ENVIRONMENT_FILTER',
+ defaultValue: '',
+ description: 'Filter resources by environment (prod, test, dev)'
+ )
+ string(
+ name: 'S3_BUCKET',
+ defaultValue: '',
+ description: 'S3 bucket for report upload (optional)'
+ )
+ }
+
+ environment {
+ PYTHON_VERSION = '3.11'
+ REPORT_DIR = 'reports'
+ }
+
+ triggers {
+ // Run weekly on Monday at 6 AM
+ cron('H 6 * * 1')
+ }
+
+ options {
+ buildDiscarder(logRotator(numToKeepStr: '30'))
+ timestamps()
+ timeout(time: 60, unit: 'MINUTES')
+ disableConcurrentBuilds()
+ }
+
+ stages {
+ stage('Checkout') {
+ steps {
+ checkout scm
+ }
+ }
+
+ stage('Setup Python Environment') {
+ steps {
+ sh '''
+ python3 -m venv venv
+ . venv/bin/activate
+ pip install --upgrade pip
+ pip install -r requirements.txt
+ '''
+ }
+ }
+
+ stage('Validate Parameters') {
+ steps {
+ script {
+ // Validate region format if provided
+ if (params.AWS_REGION) {
+ if (!(params.AWS_REGION ==~ /^[a-z]{2}-[a-z]+-\d+$/)) {
+ error("Invalid AWS region format: ${params.AWS_REGION}")
+ }
+ }
+
+ // Validate resource types format if provided
+ if (params.RESOURCE_TYPES) {
+ if (!(params.RESOURCE_TYPES ==~ /^[a-zA-Z0-9_,]+$/)) {
+ error("Invalid resource types format: ${params.RESOURCE_TYPES}")
+ }
+ }
+
+ // Validate environment filter if provided
+ if (params.ENVIRONMENT_FILTER) {
+ def validEnvs = ['prod', 'production', 'test', 'testing', 'dev', 'development', 'staging', 'qa']
+ if (!(params.ENVIRONMENT_FILTER.toLowerCase() in validEnvs)) {
+ error("Invalid environment filter: ${params.ENVIRONMENT_FILTER}")
+ }
+ }
+ }
+ }
+ }
+
+ stage('Run Analysis') {
+ steps {
+ withAWS(credentials: 'aws-credentials', region: params.AWS_REGION ?: 'us-east-1') {
+ script {
+ def cmd = '. venv/bin/activate && python main.py'
+
+ // Add optional parameters
+ if (params.AWS_REGION) {
+ cmd += " --region ${params.AWS_REGION}"
+ }
+
+ if (params.RESOURCE_TYPES) {
+ cmd += " --resource-types ${params.RESOURCE_TYPES}"
+ }
+
+ cmd += " --output-format ${params.OUTPUT_FORMAT}"
+
+ if (params.MULTI_REGION) {
+ cmd += ' --multi-region'
+ }
+
+ if (params.ENVIRONMENT_FILTER) {
+ cmd += " --environment ${params.ENVIRONMENT_FILTER}"
+ }
+
+ sh cmd
+ }
+ }
+ }
+ }
+
+ stage('Archive Reports') {
+ steps {
+ script {
+ // Find and archive the report
+ def reportPattern = "aws-optimization-report.${params.OUTPUT_FORMAT}"
+
+ archiveArtifacts(
+ artifacts: reportPattern,
+ allowEmptyArchive: false,
+ fingerprint: true
+ )
+
+ // Publish HTML report if format is HTML
+ if (params.OUTPUT_FORMAT == 'html') {
+ publishHTML(target: [
+ allowMissing: false,
+ alwaysLinkToLastBuild: true,
+ keepAll: true,
+ reportDir: '.',
+ reportFiles: 'aws-optimization-report.html',
+ reportName: 'Dedo-Duro Report'
+ ])
+ }
+ }
+ }
+ }
+
+ stage('Upload to S3') {
+ when {
+ expression { params.S3_BUCKET?.trim() }
+ }
+ steps {
+ withAWS(credentials: 'aws-credentials', region: params.AWS_REGION ?: 'us-east-1') {
+ script {
+ def timestamp = new Date().format('yyyy-MM-dd')
+ def reportFile = "aws-optimization-report.${params.OUTPUT_FORMAT}"
+ def s3Key = "dedo-duro-reports/${timestamp}/${reportFile}"
+
+ s3Upload(
+ bucket: params.S3_BUCKET,
+ file: reportFile,
+ path: s3Key
+ )
+
+ echo "Report uploaded to s3://${params.S3_BUCKET}/${s3Key}"
+ }
+ }
+ }
+ }
+ }
+
+ post {
+ always {
+ cleanWs()
+ }
+
+ success {
+ echo 'Dedo-Duro analysis completed successfully!'
+
+ // Send Slack notification if configured
+ script {
+ try {
+ slackSend(
+ channel: '#aws-cost-alerts',
+ color: 'good',
+ message: "Dedo-Duro Analysis Complete - ${env.BUILD_URL}"
+ )
+ } catch (Exception e) {
+ echo "Slack notification skipped: ${e.message}"
+ }
+ }
+ }
+
+ failure {
+ echo 'Dedo-Duro analysis failed!'
+
+ script {
+ try {
+ slackSend(
+ channel: '#aws-cost-alerts',
+ color: 'danger',
+ message: "Dedo-Duro Analysis Failed - ${env.BUILD_URL}"
+ )
+ } catch (Exception e) {
+ echo "Slack notification skipped: ${e.message}"
+ }
+ }
+ }
+ }
+}
diff --git a/complete_simulated_report.html b/complete_simulated_report.html
new file mode 100644
index 0000000..03bdba0
--- /dev/null
+++ b/complete_simulated_report.html
@@ -0,0 +1,391 @@
+
+
+
+
+
+
+ This report identifies potential cost-saving opportunities and security findings across your AWS resources.
+Interactive charts showing cost optimization opportunities and resource distribution.
+Focus on these items for the highest potential impact based on estimated monthly savings.
+| Rank | Resource Type | Identifier (ID/Name) | Current Config | Est. Monthly Savings | Recommendation |
|---|---|---|---|---|---|
| 1 | +Cost Explorer | +anomaly-6552 (Amazon EC2) | +N/A | +$13848.16 | +Investigate 140.0% cost increase | +
| 2 | +Cost Explorer | +anomaly-2328 (Amazon EC2) | +N/A | +$2541.51 | +Investigate 41.0% cost increase | +
| 3 | +Cost Explorer | +anomaly-4036 (AWS Lambda) | +N/A | +$2283.17 | +Investigate 64.0% cost increase | +
| 4 | +Cost Explorer | +anomaly-5958 (Amazon RDS) | +N/A | +$1775.38 | +Investigate 58.0% cost increase | +
| 5 | +Bedrock | +pt-claude-instant-prod (Claude Instant Production) | +N/A | +$1200.00 | +Consider on-demand pricing for variable workloads | +
| 6 | +Cost Explorer | +anomaly-9783 (Amazon RDS) | +N/A | +$1083.85 | +Investigate 85.0% cost increase | +
| 7 | +Ec2 | +i-0537d818 (dev-web-01) | +t3.medium | +$394.47 | +Consider stopping | +
| 8 | +Sagemaker | +notebook-experimentation-3 (notebook-3) | +ml.t3.medium | +$309.13 | +Stop idle notebook instance | +
| 9 | +Ec2 | +i-023f4017 (prod-api-02) | +m5.xlarge | +$216.67 | +Consider stopping | +
| 10 | +S3 | +bucket-3 | +N/A | +$212.01 | +Add lifecycle policy for cost optimization | +
| Account ID | Account Alias | Instance ID | Name | Region | Nike Owner | Current Type | Recommended Type | OS | CPU Utilization (%) | Network I/O (MB/s) | Status | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | i-00d8b28f | dev-web-01 | eu-west-1 | devops-team | t3.medium | t3.micro | Ubuntu 22.04 | 45.50% | 93.2 | Idle | Consider stopping | $394.47 |
| 123456789012 | simulated-account | i-035609e7 | prod-api-02 | eu-west-1 | platform-team | m5.xlarge | m6g.medium | Ubuntu 22.04 | 8.00% | 14.7 | Idle | Consider stopping | $216.67 |
| 123456789012 | simulated-account | i-03358932 | prod-worker-03 | us-west-2 | data-team | m5.xlarge | m5.xlarge | Ubuntu 22.04 | 18.50% | 8.8 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-02ad82a3 | dev-worker-04 | eu-west-1 | ml-team | c5.xlarge | t3.micro | Windows Server 2022 | 32.50% | 7.4 | Oversized | Consider downsizing | $112.28 |
| 123456789012 | simulated-account | i-01114819 | prod-api-05 | us-west-2 | platform-team | t3.small | t3.small | Amazon Linux 2023 | 58.90% | 43.5 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-02d29aa0 | dev-api-06 | eu-west-1 | platform-team | r5.xlarge | r5.xlarge | Windows Server 2022 | 36.90% | 52.1 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-015221cd | staging-web-07 | us-east-1 | devops-team | m5.xlarge | m5.xlarge | RHEL 8 | 71.10% | 41.9 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-04abd119 | prod-db-08 | us-west-2 | devops-team | m5.large | m6g.large | Ubuntu 22.04 | 8.80% | 46.9 | Idle | Consider stopping | $168.20 |
| 123456789012 | simulated-account | i-05f074be | prod-api-09 | us-east-1 | backend-team | t3.small | t3.small | Amazon Linux 2 | 42.90% | 74.5 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-04923c56 | prod-api-10 | us-west-2 | ml-team | t3.small | t3.small | RHEL 8 | 22.50% | 121.2 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-03103acd | staging-worker-11 | us-east-1 | ml-team | r5.xlarge | r5.xlarge | Amazon Linux 2023 | 16.60% | 70.3 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-0407a0de | dev-db-12 | eu-west-1 | devops-team | r5.large | r5.large | Amazon Linux 2023 | 26.30% | 80.8 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-00b3ab99 | dev-worker-13 | us-east-1 | devops-team | r5.large | r5.large | RHEL 8 | 73.60% | 44.0 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-01d666b1 | dev-api-14 | us-west-2 | backend-team | t3.micro | t3.micro | Amazon Linux 2023 | 27.60% | 17.9 | Active | Consider no action needed | $0.00 |
| 123456789012 | simulated-account | i-01068c9a | dev-db-15 | eu-west-1 | platform-team | t3.medium | t3.medium | Amazon Linux 2023 | 53.80% | 89.8 | Active | Consider no action needed | $0.00 |
| Account ID | Account Alias | Volume ID | Name | Region | Nike Owner | Current Type | Size (GB) | IOPS | Throughput (MB/s) | Attached Instance | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | vol-031e9a90 | volume-temp-1 | us-west-2 | devops-team | gp3 | 1748 | 3102 | 405 | i-01f825df | OK | $0.00 |
| 123456789012 | simulated-account | vol-04d839c3 | volume-data-2 | us-east-1 | devops-team | gp2 | 956 | 790 | 161 | i-01ffeabb | Migrate to gp3 | $19.12 |
| 123456789012 | simulated-account | vol-05ecdf46 | volume-temp-3 | us-west-2 | devops-team | st1 | 1416 | 1375 | 65 | i-04d2a439 | OK | $0.00 |
| 123456789012 | simulated-account | vol-03764972 | volume-temp-4 | us-west-2 | backend-team | st1 | 1172 | 2510 | 154 | i-05cd53d3 | OK | $0.00 |
| 123456789012 | simulated-account | vol-040d127a | volume-backup-5 | us-west-2 | devops-team | io1 | 1202 | 7267 | 130 | i-029eb240 | OK | $0.00 |
| 123456789012 | simulated-account | vol-04daf759 | volume-backup-6 | us-east-1 | backend-team | sc1 | 1278 | 2148 | 158 | N/A | Delete or snapshot unattached volume | $102.24 |
| 123456789012 | simulated-account | vol-049a3f47 | volume-data-7 | us-west-2 | platform-team | gp2 | 604 | 1847 | 64 | i-02840dd9 | Migrate to gp3 | $12.08 |
| 123456789012 | simulated-account | vol-020a341c | volume-temp-8 | us-west-2 | backend-team | sc1 | 191 | 1418 | 136 | i-026f333f | OK | $0.00 |
| 123456789012 | simulated-account | vol-05229e60 | volume-data-9 | us-east-1 | devops-team | io1 | 1500 | 14110 | 189 | i-04fc40d0 | OK | $0.00 |
| 123456789012 | simulated-account | vol-011417cb | volume-temp-10 | us-west-2 | data-team | io2 | 1429 | 4546 | 208 | N/A | Delete or snapshot unattached volume | $114.32 |
| 123456789012 | simulated-account | vol-00de0275 | volume-temp-11 | us-west-2 | data-team | io1 | 1599 | 14538 | 55 | i-03d7b010 | OK | $0.00 |
| 123456789012 | simulated-account | vol-0176441a | volume-root-12 | us-west-2 | platform-team | sc1 | 1221 | 386 | 170 | i-0135cdc5 | OK | $0.00 |
| Account ID | Account Alias | Bucket Name | Region | Nike Owner | Storage (GB) | Lifecycle Policy | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | prod-logs-5399 | us-east-1 | platform-team | 43485 | Configured | Well configured | $0.00 |
| 123456789012 | simulated-account | prod-static-assets-9432 | us-east-1 | backend-team | 24597 | Configured | Well configured | $0.00 |
| 123456789012 | simulated-account | prod-temp-9053 | us-east-1 | data-team | 15363 | Not Configured | Add lifecycle policy for cost optimization | $212.01 |
| 123456789012 | simulated-account | prod-backups-5866 | us-east-1 | devops-team | 8898 | Not Configured | Add lifecycle policy for cost optimization | $122.79 |
| 123456789012 | simulated-account | dev-archives-3333 | us-east-1 | platform-team | 17386 | Configured | Well configured | $0.00 |
| 123456789012 | simulated-account | prod-backups-1289 | us-east-1 | platform-team | 43061 | Configured | Well configured | $0.00 |
| 123456789012 | simulated-account | prod-temp-8289 | us-east-1 | platform-team | 17821 | Configured | Well configured | $0.00 |
| 123456789012 | simulated-account | dev-archives-4799 | us-east-1 | platform-team | 22562 | Configured | Well configured | $0.00 |
| 123456789012 | simulated-account | staging-backups-5279 | us-east-1 | devops-team | 14901 | Configured | Well configured | $0.00 |
| 123456789012 | simulated-account | prod-data-lake-9344 | us-east-1 | platform-team | 12395 | Not Configured | Add lifecycle policy for cost optimization | $171.05 |
| Account ID | Account Alias | DB Instance | Name | Region | Nike Owner | Current Type | Storage (GB) | CPU Utilization (%) | Connections | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | db-prod-replica-01 | database-1 | us-west-2 | data-team | db.t3.medium | 345 | 47.00% | 301 | Well utilized | $0.00 |
| 123456789012 | simulated-account | db-staging-main-02 | database-2 | us-west-2 | data-team | db.t3.small | 49 | 71.20% | 385 | Well utilized | $0.00 |
| 123456789012 | simulated-account | db-prod-replica-03 | database-3 | us-east-1 | analytics-team | db.r5.xlarge | 600 | 35.50% | 169 | Well utilized | $0.00 |
| 123456789012 | simulated-account | db-dev-analytics-04 | database-4 | us-east-1 | backend-team | db.r5.large | 257 | 49.60% | 52 | Well utilized | $0.00 |
| 123456789012 | simulated-account | db-dev-analytics-05 | database-5 | us-west-2 | analytics-team | db.m5.xlarge | 207 | 49.40% | 260 | Well utilized | $0.00 |
| 123456789012 | simulated-account | db-dev-analytics-06 | database-6 | us-west-2 | data-team | db.t3.micro | 552 | 56.90% | 178 | Well utilized | $0.00 |
| 123456789012 | simulated-account | db-prod-main-07 | database-7 | us-west-2 | platform-team | db.t3.micro | 663 | 17.60% | 223 | Consider downsizing instance class | $42.03 |
| 123456789012 | simulated-account | db-dev-analytics-08 | database-8 | us-east-1 | backend-team | db.t3.medium | 444 | 33.50% | 336 | Well utilized | $0.00 |
Analysis of SageMaker endpoint and notebook instance usage.
| Account ID | Account Alias | Resource ARN | Name | Region | Nike Owner | Type | Status | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | arn:aws:sagemaker:us-east-1:123456789012:notebook-instance/notebook-data-science-1 | notebook-1 | us-east-1 | ml-team | Notebook Instance | Idle | Stop idle notebook instance | $0.00 |
| 123456789012 | simulated-account | arn:aws:sagemaker:us-east-1:123456789012:notebook-instance/notebook-data-science-2 | notebook-2 | us-east-1 | ml-team | Notebook Instance | Idle | Stop idle notebook instance | $0.00 |
| 123456789012 | simulated-account | arn:aws:sagemaker:us-east-1:123456789012:notebook-instance/notebook-experimentation-3 | notebook-3 | us-east-1 | ml-team | Notebook Instance | Idle | Stop idle notebook instance | $309.13 |
| 123456789012 | simulated-account | arn:aws:sagemaker:us-east-1:123456789012:endpoint/endpoint-prediction-1 | endpoint-1 | us-east-1 | ml-team | Inference Endpoint | Active | Well utilized endpoint | $0.00 |
| 123456789012 | simulated-account | arn:aws:sagemaker:us-east-1:123456789012:endpoint/endpoint-inference-2 | endpoint-2 | us-east-1 | ml-team | Inference Endpoint | Active | Well utilized endpoint | $0.00 |
Analysis of Lambda function configurations and usage.
| Account ID | Account Alias | Function Name | Region | Nike Owner | Runtime | Memory Size (MB) | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | prod-worker-1 | us-east-1 | backend-team | java17 | 1024 | OK | $0.00 |
| 123456789012 | simulated-account | dev-handler-2 | us-east-1 | data-team | go1.x | 512 | OK | $0.00 |
| 123456789012 | simulated-account | dev-processor-3 | us-east-1 | data-team | go1.x | 3072 | OK | $0.00 |
| 123456789012 | simulated-account | prod-api-4 | us-east-1 | backend-team | nodejs18.x | 3072 | OK | $0.00 |
| 123456789012 | simulated-account | prod-handler-5 | us-east-1 | ml-team | python3.9 | 3072 | OK | $0.00 |
| 123456789012 | simulated-account | dev-handler-6 | us-east-1 | data-team | python3.9 | 128 | OK | $0.00 |
| 123456789012 | simulated-account | dev-handler-7 | us-east-1 | backend-team | java17 | 3072 | Reduce memory allocation | $47.33 |
| 123456789012 | simulated-account | dev-processor-8 | us-east-1 | backend-team | nodejs20.x | 512 | OK | $0.00 |
| 123456789012 | simulated-account | dev-api-9 | us-east-1 | backend-team | python3.9 | 512 | OK | $0.00 |
| 123456789012 | simulated-account | prod-api-10 | us-east-1 | ml-team | nodejs18.x | 512 | OK | $0.00 |
| Account ID | Account Alias | Resource ID | Name | Region | Nike Owner | Details | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | pt-claude-instant-prod | Claude Instant Production | us-east-1 | ml-team | N/A | Consider on-demand pricing for variable workloads | $1,200.00 |
| Account ID | Account Alias | Resource ID | Name | Region | Nike Owner | Details | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | anomaly-4036 | AWS Lambda | us-east-1 | finops-team | N/A | Investigate 64.0% cost increase | $2,283.17 |
| 123456789012 | simulated-account | anomaly-5958 | Amazon RDS | us-east-1 | finops-team | N/A | Investigate 58.0% cost increase | $1,775.38 |
| 123456789012 | simulated-account | anomaly-6552 | Amazon EC2 | us-east-1 | finops-team | N/A | Investigate 140.0% cost increase | $13,848.16 |
| 123456789012 | simulated-account | anomaly-9783 | Amazon RDS | us-east-1 | finops-team | N/A | Investigate 85.0% cost increase | $1,083.85 |
| 123456789012 | simulated-account | anomaly-2328 | Amazon EC2 | us-east-1 | finops-team | N/A | Investigate 41.0% cost increase | $2,541.51 |
| Account ID | Account Alias | Resource ID | Name | Region | Nike Owner | Details | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | prod-frontend | frontend | us-east-1 | frontend-team | N/A | Deployment healthy | $0.00 |
| 123456789012 | simulated-account | prod-backend-api | backend-api | us-east-1 | platform-team | N/A | Investigate restart issues | $0.00 |
| 123456789012 | simulated-account | prod-worker | worker | us-east-1 | devops-team | N/A | Deployment healthy | $0.00 |
| 123456789012 | simulated-account | staging-scheduler | scheduler | us-east-1 | frontend-team | N/A | Review and update stale deployment | $0.00 |
| 123456789012 | simulated-account | staging-gateway | gateway | us-east-1 | platform-team | N/A | Investigate restart issues | $0.00 |
| Account ID | Account Alias | Resource ID | Name | Region | Nike Owner | Details | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | session-313248 | staging-cluster-session-1 | us-east-1 | devops-team | N/A | Review long-running session for security | $0.00 |
| 123456789012 | simulated-account | session-800338 | dev-cluster-session-2 | us-east-1 | devops-team | N/A | Review long-running session for security | $0.00 |
| 123456789012 | simulated-account | session-228980 | staging-cluster-session-3 | us-east-1 | devops-team | N/A | Review long-running session for security | $0.00 |
| 123456789012 | simulated-account | session-256279 | prod-cluster-session-4 | us-east-1 | devops-team | N/A | Normal session activity | $0.00 |
| 123456789012 | simulated-account | session-127425 | dev-cluster-session-5 | us-east-1 | devops-team | N/A | Review long-running session for security | $0.00 |
| 123456789012 | simulated-account | session-559543 | prod-cluster-session-6 | us-east-1 | devops-team | N/A | Review long-running session for security | $0.00 |
| Account ID | Account Alias | Resource ID | Name | Region | Nike Owner | Details | Recommendation | Est. Monthly Savings |
|---|---|---|---|---|---|---|---|---|
| 123456789012 | simulated-account | db-prod-1 | database-1 | us-east-1 | data-team | N/A | Enable cross-region backup for disaster recovery | $0.00 |
| 123456789012 | simulated-account | db-staging-2 | database-2 | us-east-1 | platform-team | N/A | Enable cross-region backup for disaster recovery | $0.00 |
| 123456789012 | simulated-account | db-staging-3 | database-3 | us-east-1 | devops-team | N/A | Backup configuration adequate | $0.00 |
| 123456789012 | simulated-account | db-staging-4 | database-4 | us-east-1 | platform-team | N/A | Backup configuration adequate | $0.00 |
| 123456789012 | simulated-account | bucket-critical-1 | critical-data-bucket-1 | us-east-1 | data-team | N/A | Enable cross-region replication for critical data | $0.00 |
| 123456789012 | simulated-account | bucket-critical-2 | critical-data-bucket-2 | us-east-1 | platform-team | N/A | Enable cross-region replication for critical data | $0.00 |
| 123456789012 | simulated-account | bucket-critical-3 | critical-data-bucket-3 | us-east-1 | data-team | N/A | Replication configured | $0.00 |
The CloudWatch Agent allows for more detailed metrics collection, including memory utilization, which can improve the accuracy of EC2 efficiency recommendations from both the EC2 Efficiency analyzer and AWS Compute Optimizer.
+Refer to the official AWS documentation for installing and configuring the CloudWatch Agent:
+ +Ensure the necessary IAM permissions are granted to your EC2 instances to send metrics and logs to CloudWatch.
+Review the security findings identified during the analysis. Detailed findings are listed under the 'Security and Privacy' section if available.
+AWS Resource Utilization Analyzer
+API Documentation:
+Start an analysis via the API:
+POST /api/analysis
+{
+ "region": "us-east-1",
+ "output_format": "html"
+}
+ Or use the command line:
+python main.py --region us-east-1 --output-format html+