This content originally appeared on DEV Community and was authored by Nat Thompson
I'm an AWS consultant. My clients always ask the same question: "Why is my AWS bill so high?"
The answer is always the same: idle resources, oversized instances, and services nobody remembered to turn off. So I built a tool to find them automatically.
The Architecture
Sharktooth connects to a customer's AWS account via a cross-account IAM role — the same pattern used by Datadog, CloudHealth, and AWS's own tools.
Customer AWS Account Sharktooth AWS Account
┌─────────────────┐ ┌──────────────────────┐
│ │ │ │
│ IAM Role ◄──────────────── STS AssumeRole │
│ (read-only) │ │ + ExternalId │
│ │ │ │
│ Cost Explorer │ │ Cost Analysis │
│ CloudWatch │────────► │ AI Recommendations │
│ EC2 Describe │ │ Dashboard │
│ RDS Describe │ │ │
└─────────────────┘ └──────────────────────┘
Step 1: Connect (5 minutes)
The customer creates a read-only IAM role with this trust policy:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam::SHARKTOOTH_ACCOUNT:root" },
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": { "sts:ExternalId": "UNIQUE_PER_CUSTOMER" }
}
}]
}
The ExternalId prevents confused deputy attacks — each customer gets a unique one.
Permissions requested:
ce:GetCostAndUsage
cloudwatch:GetMetricStatistics
ec2:DescribeInstances
ec2:DescribeInstanceTypes
rds:DescribeDBInstances
That's it. No write permissions. No S3, Lambda, or IAM access.
Step 2: Pull Cost Data
Using STS AssumeRole, we get temporary credentials (1-hour expiry) and call the Cost Explorer API:
- Monthly spend by service (last 6 months)
- Daily spend trend (last 30 days)
- Service breakdown with amounts
Step 3: Detect Idle Resources
For each running EC2 instance, we pull 7 days of CloudWatch CPUUtilization:
- Average CPU < 5% = flagged as idle
- Average CPU 5-20% = right-sizing candidate
For RDS, we check DatabaseConnections:
- 0 connections over 7 days = flagged as idle
Step 4: AI Analysis
This is where it gets interesting. We feed everything into Claude (via AWS Bedrock):
- Monthly spend total and service breakdown
- 30-day daily trend
- List of idle resources
- Right-sizing candidates
The AI returns structured JSON:
[
{
"title": "Right-size or consolidate Lightsail instances",
"description": "Lightsail represents 42.9% of total spend...",
"estimatedMonthlySavings": 45.36,
"priority": "high",
"effort": "medium"
}
]
Cost per AI analysis: ~$0.005 (half a cent) using Haiku.
Results
On my own account ($352/month), it found $135/month in savings:
- Consolidate Lightsail instances ($45/mo)
- Remove unused ELB ($20/mo)
- Audit WorkMail seats ($22/mo)
- Clean up VPC resources ($18/mo)
- Plus 6 more recommendations
That's 38% waste. On an AWS consultant's own account.
Tech Stack
- .NET 10 — Razor Pages + Minimal API
- SQLite — EF Core, lightweight and self-contained
- AWS Bedrock — Claude Haiku 4.5 for AI analysis
- Chart.js — Cost trend visualizations
- Stripe — Billing
The whole thing runs on a single Lightsail instance alongside 7 other .NET apps.
Try It
Free tier available at sharktoothproject.com. Pro ($19/mo) adds idle detection, right-sizing, and AI recommendations.
If you manage AWS for clients, the Team tier ($39/mo) covers unlimited accounts.
Built by Nat Thompson at Obsidian River. Questions? Find me on LinkedIn or drop a comment below.
This content originally appeared on DEV Community and was authored by Nat Thompson
Nat Thompson | Sciencx (2026-03-28T12:45:10+00:00) I Built an AI-Powered AWS Cost Optimizer — Here’s How It Works. Retrieved from https://www.scien.cx/2026/03/28/i-built-an-ai-powered-aws-cost-optimizer-heres-how-it-works-3/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.