| Cost Explorer | ce:GetCostAndUsage | Pull daily cost data, forecasts, RI and Savings Plans coverage, purchase recommendations, and cost-allocation tag inventory |
| ce:GetCostForecast |
| ce:GetDimensionValues |
| ce:GetTags |
| ce:GetReservationUtilization |
| ce:GetReservationCoverage |
| ce:GetReservationPurchaseRecommendation |
| ce:GetSavingsPlansUtilization |
| ce:GetSavingsPlansCoverage |
| ce:GetSavingsPlansPurchaseRecommendation |
| ce:ListCostAllocationTags |
| CloudWatch | cloudwatch:GetMetricData | Measure CPU, memory, throughput; inventory alarms and metric streams to detect idle and oversized resources |
| cloudwatch:GetMetricStatistics |
| cloudwatch:ListMetrics |
| cloudwatch:DescribeAlarms |
| cloudwatch:ListMetricStreams |
| cloudwatch:GetMetricStream |
| CloudWatch Logs | logs:DescribeLogGroups | Audit log retention; run Logs Insights queries for NAT and Lambda cost analysis |
| logs:DescribeLogStreams |
| logs:StartQuery |
| logs:GetQueryResults |
| EC2 | ec2:DescribeInstances | Inventory instances, volumes, NAT gateways, Elastic IPs, snapshots, AMIs, VPC/transit gateway/VPN topology, and route tables for waste detection |
| ec2:DescribeVolumes |
| ec2:DescribeFastSnapshotRestores |
| ec2:DescribeNatGateways |
| ec2:DescribeVpcEndpoints |
| ec2:DescribeVpcs |
| ec2:DescribeAddresses |
| ec2:DescribeSnapshots |
| ec2:DescribeImages |
| ec2:DescribeTransitGateways |
| ec2:DescribeTransitGatewayAttachments |
| ec2:DescribeVpnConnections |
| ec2:DescribePrefixLists |
| ec2:DescribeFlowLogs |
| ec2:DescribeRouteTables |
| ec2:DescribeSubnets |
| ec2:DescribeNetworkInterfaces |
| ec2:DescribeLaunchTemplateVersions |
| Lambda | lambda:ListFunctions | Check architecture (ARM64 vs x86), memory allocation, runtime, and provisioned concurrency settings |
| lambda:GetFunction |
| lambda:ListProvisionedConcurrencyConfigs |
| RDS | rds:DescribeDBInstances | Find idle databases, cluster sprawl, snapshot waste, reservation utilization, and previous-generation instance types. Also covers DocumentDB and Neptune, which read through the same RDS API. |
| rds:DescribeDBSnapshots |
| rds:DescribeDBClusterSnapshots |
| rds:DescribeDBClusters |
| rds:DescribeReservedDBInstances |
| rds:DescribeOrderableDBInstanceOptions |
| rds:ListTagsForResource |
| DynamoDB | dynamodb:ListTables | Audit capacity mode, TTL settings, backup config, tags, and usage patterns |
| dynamodb:DescribeTable |
| dynamodb:DescribeTimeToLive |
| dynamodb:DescribeContinuousBackups |
| dynamodb:ListTagsOfResource |
| S3 | s3:ListAllMyBuckets | Check lifecycle rules, encryption config, intelligent-tiering, incomplete multipart uploads, and storage class optimization |
| s3:GetBucketLocation |
| s3:GetBucketVersioning |
| s3:GetLifecycleConfiguration |
| s3:GetBucketTagging |
| s3:ListBucketMultipartUploads |
| s3:GetEncryptionConfiguration |
| s3:GetIntelligentTieringConfiguration |
| ELB | elasticloadbalancing:DescribeLoadBalancers | Find idle or unused load balancers and target groups |
| elasticloadbalancing:DescribeTargetGroups |
| elasticloadbalancing:DescribeTargetHealth |
| ECS | ecs:ListClusters | Inventory ECS services, task definitions, and Fargate configuration for ARM64 and ephemeral storage analysis |
| ecs:DescribeClusters |
| ecs:ListServices |
| ecs:DescribeServices |
| ecs:DescribeTaskDefinition |
| SageMaker | sagemaker:ListNotebookInstances | Find idle notebook instances and endpoints |
| sagemaker:DescribeNotebookInstance |
| sagemaker:ListEndpoints |
| sagemaker:DescribeEndpoint |
| ElastiCache | elasticache:DescribeCacheClusters | Audit cache clusters for idle nodes and Graviton/Valkey migration opportunities |
| elasticache:DescribeReplicationGroups |
| elasticache:DescribeReservedCacheNodes |
| API Gateway | apigateway:GET | Read REST API metadata to check stages and integrations |
| Backup | backup:ListBackupVaults | Audit backup vaults, plans, and cross-region replication for non-production cost optimization |
| backup:ListBackupPlans |
| backup:GetBackupPlan |
| backup:ListTags |
| Budgets | budgets:DescribeBudgets | Verify cost guardrails exist and have alert notifications configured |
| budgets:DescribeNotificationsForBudget |
| CloudFront | cloudfront:ListDistributions | Inventory distributions for price class and origin optimization |
| CloudTrail | cloudtrail:DescribeTrails | Find duplicate trails and unnecessarily verbose data-event logging that inflate S3 + CloudTrail costs |
| cloudtrail:GetTrailStatus |
| cloudtrail:GetEventSelectors |
| Compute Optimizer | compute-optimizer:GetEC2InstanceRecommendations | Cross-check AWS's own rightsizing recommendations against scanner findings |
| AWS Config | config:DescribeConfigurationRecorders | Detect Config recorders running in regions with no real resources (common waste pattern) |
| config:DescribeConfigurationRecorderStatus |
| config:GetDiscoveredResourceCounts |
| GuardDuty | guardduty:ListDetectors | Audit detector feature flags (S3, EKS, RDS protection) for unnecessary spend |
| guardduty:GetDetector |
| Application Auto Scaling | application-autoscaling:DescribeScalableTargets | Read DynamoDB and ECS scaling targets and policies to detect over-provisioning |
| application-autoscaling:DescribeScalingPolicies |
| ECR | ecr:DescribeRepositories | Find repositories without lifecycle policies and inventory stored image data |
| ecr:GetLifecyclePolicy |
| ecr:DescribeImages |
| EFS | elasticfilesystem:DescribeFileSystems | Detect file systems with no lifecycle policy and over-provisioned throughput mode |
| elasticfilesystem:DescribeLifecycleConfiguration |
| EKS | eks:ListClusters | Inventory clusters and node groups for capacity right-sizing |
| eks:DescribeCluster |
| eks:ListNodegroups |
| eks:DescribeNodegroup |
| EMR | elasticmapreduce:ListClusters | Detect long-running clusters with idle instance groups |
| elasticmapreduce:ListInstanceGroups |
| Glue | glue:GetDevEndpoints | Find idle dev endpoints and analyze job DPU/run patterns for waste |
| glue:GetJobs |
| glue:GetJobRuns |
| Kafka (MSK) | kafka:ListClustersV2 | Inventory MSK clusters for sizing analysis |
| Keyspaces | keyspaces:ListKeyspaces | Inventory keyspaces and tables for capacity-mode analysis |
| keyspaces:ListTables |
| keyspaces:GetTable |
| Kinesis | kinesis:ListStreams | Inventory streams for shard-count and idle-stream analysis |
| kinesis:DescribeStreamSummary |
| KMS | kms:ListKeys | Detect S3 buckets using KMS encryption without bucket keys (a known cost driver) |
| kms:DescribeKey |
| kms:ListGrants |
| MemoryDB | memorydb:DescribeClusters | Find clusters where reserved-node coverage is missing |
| memorydb:DescribeReservedNodes |
| OpenSearch | es:ListDomainNames | Inventory domains and reservation utilization for right-sizing |
| es:DescribeDomain |
| es:DescribeReservedInstances |
| Redshift | redshift:DescribeClusters | Inventory provisioned clusters and Serverless workgroups |
| redshift-serverless:ListWorkgroups |
| Route 53 | route53:ListHostedZones | Detect empty zones and CNAME records that should be Alias records (free) |
| route53:GetHostedZone |
| route53:ListResourceRecordSets |
| Step Functions | states:ListStateMachines | Inventory state machines for execution-cost analysis |
| states:DescribeStateMachine |
| Timestream | timestream:ListDatabases | Inventory databases and tables for retention analysis |
| timestream:ListTables |
| Transfer Family | transfer:ListServers | Detect idle SFTP/FTPS servers |
| Organizations | organizations:DescribeOrganization | Detect org membership and enumerate member accounts for multi-account discovery |
| organizations:ListAccounts |
| IAM | iam:ListAccountAliases | Get account alias for environment classification (prod/staging) |