Welcome to FinOps Center

# Welcome to Cloud Scal3 Product Documentation

We build and market our own products while also assisting Customers and ISVs in developing their Agentic Products. To help Simply to Save with customer's AWS Cloud Financial Management, Cloud Scal3 is please to offer FinOps Center. To Further Simply and Save with the power of Amazon Bedrock Agentic AI and Amazon Q, Cloud Scal3 is pleased to offer Agent Bill as a complement to customer FinOps Center implementation. # Business Requirements Prior to starting the installation of FinOps Center, customers must understand how their company is organized by Roles and Organizational Naming. Roles During the installation of FinOps Center, the Role Names are created in Amazon Cognito. The functionality of the Roles is independent of the naming but will help if they are align to your organizational naming. Default Labels for Roles

FinOps Center Default Role Label	Activities	Customer Role Label
Admin	Technical Team Member that will be responsible for Setting up FinOps Center, Adding AWS Accounts, and Claiming Resource to Workloads.
Vendor Manager	Procurement, Finance, or Business Leader that manages discounts and buying decisions of AWS.
Financial Admin	FinOps Leadership that will be responsible for adding budgets, adding users to budgets, mapping aws accounts to budgets, adding AWS Credits to budgets, and all Month Close Activieis
BU_Manager	BU Manager is a Business/Finance Role responsible for AWS Spending within a Business Unit.
Department Manager	Department Manager is a Business/Finance Role responsible for AWS Spending within a Department
Portfolio Manager	Portfolio Manager is a Business/Development Role responsible for AWS Spending within a Porfolio of Products that actively manages budgets and cost governance processes.
Product Manager	Product Manager is a Business/Development Role responsible for AWS Spending within a Product(s) that actively manages workloads, budgets, and cost governance processes.

Configured During FinOps Center CloudFormation Template

Organizational Naming is aligned to how customers Chart of Accounts are constructed. Organizational Naming can be update once a year aligned to your Creating of an annual budget. Organization Naming is set via the Budget Creation Process which occurs via a csv upload or via the Budget Screen. The Organization Naming will be visible throughout the FinOps Center application and will need to be implemented in the Amazon Q in Quicksight Topics (if changed). Default Organization Naming

Organization Naming When creating Budget, you will be ble to provide Orgnaization Naming in the Create Budget.

{% file src="/files/Wz0lkk5Pk888LcEvwfTD" %} Workbook Work {% endfile %} {% file src="/files/E0qN0sfWm21uXGKzS2pQ" %} Workbook Excel {% endfile %} # Marketplace Installation # FinOps Center CFT Installation ## Stack Configuration **FinOps Center creates IAM Roles and Policies. The Engineer deploying must have Administrative Privileges. (DO NOT INSTALL USING ROOT USER)** Upon Selecting Next you will be taken to the YAML form to complete the FinOps Center Installation. **Name Stack: No Requirements** **Stack Parameter:**

* Bucket to CUR - cid-(CUSTOMERDELEGATEDADMINACCOUNT)-data-exports * Path to CUR Date - cur2/CustomerManagementAccount/cid-cur2/data * Athena DB Name - cid\_data\_export * Athena Table Name - cur2 * Athena DataCalog - AwsDataCatalog * Athena WorkGroup - primary

Roles aligned to Busienss Requirements **Enviornment Parameters**

* Static Website - S3 Bucket Name Created for Frontend Bucket * From CloudFront - Distribution Name * Create your First Admin User and Email Cost Optimization Hub * Bucket to CUR - cid-(CUSTOMERDELEGATEDADMINACCOUNT)-data-exports * Path - coh/(CustomerManagementAccount)\`/cid-coh/data/ # AMI Configuration **Launch through EC2**

Click to Zoom

Click to Zoom Configure Instance to your companies standards. As note previously, the EC2 instanced provisioned is used to copy files to S3 for the FinOps Center deployment. We recommend a small instance (T3 Small) be used and can be shut down once the files are copied to S3.

Click to Zoom **Prior to Launch → the IAM Instance Profile much have a Role with Policy to S3 Create Bucket and S3 Write Access for FinOps Center Installation Bucket. Add your AWS Account Number to below Policies.**

Navigate to IAM and follow below Steps Step 1: Create a New Role for EC2 or Validate an Existing Role has above Policy.

Click to Zoom JSON Policy - add account number of installed account. ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::cdk-hnb659fds-assets--us-east-1" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::cdk-hnb659fds-assets--us-east-1*" ] } ] } ``` ```json ``` Step 2: Create a Role

Click to Zoom Step 3: Add Policy to Role

Click to Zoom and Create Role

Click to Zoom Return to EC2 to Launch Instance **No Key is Required as the Instance can be delete upon Install** **Launch Instance** Navigate to S3 As the EC2 starts up, a bucket will appear beginning with cdk (see below) | [cdk-](https://s3.console.aws.amazon.com/s3/buckets/cdk-hnb659fds-assets-525170417841-us-east-1?region=us-east-1)xxxxxx[-assets-](https://s3.console.aws.amazon.com/s3/buckets/cdk-hnb659fds-assets-525170417841-us-east-1?region=us-east-1)accountnumber[-us-east-1](https://s3.console.aws.amazon.com/s3/buckets/cdk-hnb659fds-assets-525170417841-us-east-1?region=us-east-1) | US East (N. Virginia) us-east-1 |

Bucket and objects not public

| Timestamp | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | -------------------------------------------- | --------- | Once you see the cdk Bucket is created navigate back to the Marketplace Listing to Launch CloudFormation. Launch CloudFormation Click Next Note: All environment installation are “ Fresh Installs”. There is no separate installation pipeline between SDLC environment. # Marketplace Installation - FinOps Center CFT ## Stack Configuration **FinOps Center creates IAM Roles and Policies. The Engineer deploying must have Administrative Privileges. (DO NOT INSTALL USING ROOT USER)** Upon Selecting Next you will be taken to the YAML form to complete the FinOps Center Installation. **Name Stack: No Requirements** **Environment Parameter:** * Bucket of CUR * Path to CUR Date - name/name/name/ * Athena DB Created by CUDOS Framework * CUDOS will create cid\_cur name * Table name based on CUR creation naming * Provide S3 Bucket for Frontend Application Install **Organization Roles** * Define your Organization Role Names * Create your First Admin User and Email # Release Notes w CFT Each Release has the Features in the Release the CloudFormation Script to use with the Marketplace AMI. Navigate to the Release of your FinOps Center # FinOps Center 25.2.1 Functional: Release 25.2.0 is primarily around the inclusion of the Amazon Q in QuickSight Framework with UI Updates and Changes the CUDOS Framework embedding from Anonymous to User-Based. # CloudFormation Scripts FinOps Center Enterprise {% embed url="" %} FinOps Center FinOps-in-a-Box {% embed url="" %} FinOps Center FinOps-in-a-Box Hourly {% embed url="" %} # FinOps Center 25.6.0 Release 25.6.0 * Updated Admin Screens for Financial Admins for Account Allocation

* Update Month Close to run Final Cards based on seeing Invoice Number to Run Final Cards vs Manual Running Cards once Invoice is Recieved

* Updated Budget Screen for all Users

* Adding Resource Launch Date to Resource Table to assist with Workload Allocation

# CloudFormation Scripts \ Enterprise FinOps-In-a-Box Hourly # FinOps Center 25.8.1 FinOps Center is major Update with new User Experience and the integration of Cost Optimization Hub Approval Process. While the prior UI was simplier that the AWS Console, we thought we could do better and are very happy to launch the New UI in 25.8.0. The New U1 continues to have both Light and Dark Mode.

Another Major enhancement is the [Saving Management](/cfm-processes/savings-management) Process that leverages AWS Cost Optimization Hub Data Exports. Workload Resource Start Date To assist users identify Workload Resource for Claiming for Workload and/or specialized MAP Workload, Resources will have Start Date. Note: this capability will identify Resource Start date from Day 2 or FinOps Center installation.

# CloudFormation Scripts FinOps Center Enterprise (Annual or Monthly) {% embed url="" %} FinOps-In-a-Box (Annual or Monthly) {% embed url="" %} FinOps-in-a-Box (Hourly) {% embed url="" %} # Amazon Q in QuickSight FinOps Center 25.2.0 This is the initial Release of Amazon Q in QuickSight FinOps Center Framework Topics Created * AWS Product * AWS Portfolio * AWS Department * AWS Business Unit * AWS Spending * AWS Vendor DataSet Created * FinOps\_Center\_E1 * FinOps\_Center\_E2 * FinOps\_Center\_E3 * FinOps\_Center\_E4 * FinOps\_Center\_Full * Resource View * finopscenter\_period # CloudFormation Scripts Amazon Q in QuickSight Backend Framework {% embed url="" %} Amazon Q in QuickSight Topics Components {% embed url="" %} # Marketplace Installation - FinOps Center Version Upgrades **(We recommend that you keep instances with previous AMI until the upgraded installation is confirmed to be working properly. If recovery is required - you can restart the EC2 instance with the prior AMI which will update the CDK bucket with that version. Follow below instruction.)** Marketplace customers will receive an email that their is a new version of the FinOps Center AMI available. The AMI will be available in their EC2 Console for launch leveraging the same IAM Profile used during initial installation. The launched instance will update the FinOps Center cdk bucket with the updates. Select the FinOpsCenterStack.template.json and update the CloudFormation Stack with the object URL.

Click to Zoom

Click to Zoom Validate the Parameters and advance through the next few screens and hit update. Upon Completions, Code is Updated. # Amazon Q in QuickSight FinOps Center Framework The Amazon Q in QuickSight FinOps Center Framework uses the same Deployment Model as FinOps Center via the Marketplace - AMI with CloudFormation. Once the Offering is added to your AWS Accounts you will have an AMI that needs to be launch with the IAM Profile that was used for the Product Installation. {% embed url="" %} The Solution code will be deployed via 2 CloudFormation Scripts. The First CFT builds and deploys the backend that will extract data from your FinOps Center application's DyanamoDB tables and pushes them to S3 that are created. Glue Crawlers then create the schema to be leverage for the 2nd CFT. Note: Prior to proceeding to the 2nd CFT Script the Glue Crawlers must successfully complete and the new S3 buckets ([amazonqframework-finopscenterqdataextractionbucket](https://us-east-1.console.aws.amazon.com/s3/buckets/amazonqframework-finopscenterqdataextractionbucket-ge0pqccf8slq?region=us-east-1) & [amazonqframework-finopscenterqperiodbucketb17f0b5d-](https://us-east-1.console.aws.amazon.com/s3/buckets/amazonqframework-finopscenterqperiodbucketb17f0b5d-b2poqe8wg3rq?region=us-east-1)) must be shared with QuickSight.

The 2nd CFT will install the Athena Queries, QuickSight Datasets, QuickSight Topics, and other configurations. For the Installation, you need the Author Pro ID that was created to provide as a parameter for the Template to complete.

The CFT will take about 3 minutes to Run but the deployment will still be running. Allow for 15 mins before returning to the Back to QuickSight Console. In Console, navigate to the Groups Tag in Management to add the Author Pro User to the Topics-Admin Group. Navigate to the Author Pro's Console and monitor the Topics being built. Note that Topics are built once the SPICE for the Dataset has successfully been Refreshed. Depending on the amount of data in your CUR2 or Application, this can take up to 30mins. As Topics appear they will be automatically added to the application by Role. As a best practices, run an invalidation in CloudFront upon completetion of all Topics being created. # AMI Configuration Upon complete the configuration to your AWS Environment (QuickSight) you will navigate to the Amazon Q in QuickSight Marketplace offering and subscribe to the services

Upon Subscribing the page, will refresh to add the AMI

Click the Continue to Configuration and Select the AMI

Select your Version and Region and select Continue to Launch

Launch via EC2

Add the name of the Instance, Select no Keypair

Add the Launch Profile from the FinOps Center Installation and Launch Instance

# Amazon Q in QuickSight FinOps Center Framework CFT Once the AMI is launched and the code is deployed to your cdk bucket, you navigate back to the Configure Screen to install the CloudFormation Templates.

The First CFT to launch is the Amazon Q in QuickSight FinOps Center Backend Framework.

Continue to Launch Stack

Prior to Launch the 2nd Stack -> navigate to Glue and Validate that the Crawlers have run successfully. Launch the 2nd Stack - Amazon Q in QuickSight FinOps Center Q Topics

On the 2nd Screen after launching you need to add the Author Pro that you setups within your QuickSight Environment

The installation of the scripts will take approximately 10 mins but the Lambda function that create the Athena Queries/Views, QuickSight Datasets, SPICE loading, and Topics can take upto 30 minutes. # How it Works ## Cloud Estate Design When preparing for your FinOps Center installation, it's important to consider the design elements related to both your Cloud Estate and the AWS account for your FinOps Center installation. Aligned with the Multi-Account Strategy, FinOps Center is designed to facilitate the management of your AWS Cloud Estate through the Delegated Admin Account. A Delegated Admin Account may already be created and configured in your Cloud Estate as you set up various AWS Management and Security services like Security Hub and IAM Identity Center. FinOps Center runs on 100% native AWS Services and is deployed via CloudFormation. FinOps Center is access management services to assist with integrated with core AWS Plaftorm services to simplify AWS Cloud Financial Management.

FinOps Center utilizes the Cost and Usage Data Export report created in the Management Account and replicated to the Delegated Admin. It was designed to work alongside the Cloud Intelligence Dashboard framework, which must be installed prior to the FinOps Center installation. To subscribe to the FinOps Center, the subscription must be initiated and installed from the Designated Admin Account through the AWS Marketplace. {% embed url="" %} # FinOps Center's Installation Components FinOps Center's Installation Components The installation of FinOps Center requires configuring your AWS Cloud Estate within the Management Account and the Delegated Admin Account or Data Collection where the application will be installed. Pre-Requisite Task (\~1hr) Tasks in Management Account * Create Cost and Usage Report via Data Exports - via CID Framework * Create S3 Bucket for Cost and Usage Report - via CID Framework * Create IAM Role for S3 Bucket Replication - via CID Framework * S3 Management setup of Bucket Replication and Batch Operation (optional) * Enable Delegated Admin Account (suggest configured via AWS Organizations, Security Hub, or IAM Identity Center). Assess Requirement 1. Admin - creating IAM Role Tasks in Designated Admin/ Date Aggregation (\~1hr) 1. Create Target Bucket for the Cost and Usage Report via Data Exports - via CID Framework. 2. Create S3 Bucket for Bucket Replication and Frontend Application 3. Configure S3 Buckets with CloudFront 4. Launch and Configure QuickSight 5. Create IAM Profile for FinOps Center Installation 6. Subscribe and install FinOps Center Marketplace offering 7. Launch EC2 to copy FinOps Center code to S3 Bucket 8. Install FinOps Center from CloudFormation 9. Setup Amazon QuickSight and CID Framework Access Requirement 1. Admin as the CFT create IAM roles and Admin creates IAM Profile for EC2 Role. FinOps Center may take \~8 Hrs to load all Cost and Usage Data and 1 Day for Cost Recommendations. # Create Data Collection /Configure Delegated Admin ## AWS Account w/ Delegated Admin The New Account Onboarding Process for FinOps Center is facilitated by access to the Account Management API in the Management Account. Within an AWS Cloud Estate, one account can be configured to be **Delegated Admin and is the account FinOps Center is installed.** Steps to Create Delegated Admin if not created 1. Creation of New Account - Customers are advised to create an account (if not existing already) that requires Delegated Admin privileges, particularly for services like Security Hub and Systems Manager. While the naming convention is flexible, this account is referred to as the CloudOps Account by Cloud Scal3. 1. Enablement via Security Hub- Follow the instructions provided for enabling an account to be delegated Admin via Security Hub Setup. This involves configuring the Delegated Admin Account through Security Hub.

By following these steps, the integration for Account to Budget onboarding through FinOps Center is facilitated efficiently and securely. [Delegated Admin Account via Security Hub Configuration](https://docs.finopscenter.com/aws-documentation/delegated-admin-account-via-security-hub-configuration) # Create SSL Cert with AWS Certificate Manager To create your SSL Certificate for your Front End Application Bucket that will be used in CloudFront Distribution, navigate to AWS Certificate Manager and Request a Certificate

Add the Domain for the FinOps Center Applicatoin and select the DNS Validation

Save the CNAME name and CNAME Value

Logi into Route 53 Account (likely Management Account) Navigate to your Hosted Zone and Create a new A Record

Add the DNS Entries to the subdomain from the what was saved and the Value to Validate the SSL Certificate.

In approxiately 5 to 10 minutes the Certificate in the FinOps Center Account will show as Validated and able to be added to Distbitution. # Data Exports FinOps Center leverages the work from AWS CID Framework that so customer can leverage the Various QuickSight Dashboards created by the OPTICS Team. Scripts need to be run in both the Management and Data Collection Account. UPDATED Location

To enable the Cost Recommendation Process and Data, the Cost Optimizaton Recommendations need to be enables in both the Master Payer and Data Collector Account (FinOps Center Account).

# Create S3 Bucket and CloudFront Distribution **Web Application Bucket Configuration** FinOps Center delivers its web application frontend through a **secure Amazon S3 + Amazon CloudFront distribution**.\ This component provisions the frontend hosting layer using a **customer-owned custom domain and SSL/TLS certificate**, ensuring compliance with AWS security best practices and enterprise DNS requirements. This step is **mandatory** and must be completed before any users access FinOps Center. *** ### Overview This CloudFormation stack deploys: • A **private, encrypted S3 bucket** to store the FinOps Center frontend assets\ • A **CloudFront distribution** secured by your custom domain\ • An **ACM-issued SSL certificate** for HTTPS\ • Secure access using **CloudFront Origin Access Control (OAC)**\ • SPA routing support for modern web application frameworks\ • Centralized tagging for governance and cost allocation The stack provisions the **public entry point to FinOps Center**. *** ### Required Prerequisites Before launching this stack, complete the following: | Requirement | Description | | ------------------------------- | ------------------------------------------------------------ | | Custom domain | A DNS name you control (for example: `finops.company.com`) | | ACM Certificate | Must be issued in **us-east-1** for your domain | | Route 53 or external DNS access | Required to create the DNS alias to CloudFront | | IAM permissions | Permissions to create CloudFront, S3, ACM, and IAM resources | *** ### CloudFormation Parameters | Parameter | Description | | ----------------------- | -------------------------------------------------------------------- | | **Custom Domain Name** | Public DNS name for FinOps Center (for example `finops.company.com`) | | **S3 Bucket Name** | Globally unique bucket for frontend assets | | **ACM Certificate ARN** | ARN of SSL certificate in `us-east-1` | | Default Root Object | Default document (normally `index.html`) | | SPA Error Page Path | SPA routing handler (`/index.html`) | | CloudFront Price Class | Determines CloudFront edge locations | | HTTP Version | HTTP protocol version | | Enable Compression | Enables Brotli/Gzip | | Minimum TLS Version | Enforces TLS security baseline | | Enable IPv6 | Enables IPv6 | | Error Caching TTL | TTL for error response caching | | Environment | Tagging (dev/stage/prod) | > These parameters map directly to the FinOps Center CloudFormation template *** ### Deployment Steps #### Step 1 – Launch the CloudFormation Stack From the AWS Console: ``` CloudFormation → Create stack → With new resources Upload template → cloudfront-s3-frontend.yaml ``` {% file src="/files/TJpKJ7JeRLBdWZ30gqBd" %} Provide your **custom domain name, SSL certificate ARN, and bucket name**. *** #### Step 2 – Validate Stack Completion After the stack completes: * Confirm CloudFront distribution is **Enabled** * Confirm S3 bucket is **private and encrypted** * Confirm ACM certificate is attached to the distribution *** #### Step 3 – Create DNS Alias Create a DNS record: | Record | Value | | ------------------ | ----------------------------------- | | finops.company.com | CloudFront Distribution Domain Name | This is required to activate HTTPS access. *** #### Step 4 – Upload Frontend Assets Upload FinOps Center UI files to the S3 bucket provisioned by the stack. *** #### Step 5 – Invalidate CloudFront Cache Use the CLI output provided by the stack: ``` aws cloudfront create-invalidation --distribution-id --paths "/*" ``` *** ### Security Architecture | Control | Implementation | | --------------------- | -------------------------------- | | Private S3 bucket | Public access blocked | | Origin Access Control | Only CloudFront can read S3 | | Encryption at rest | AES-256 | | Encryption in transit | TLS 1.2+ | | DNS validation | ACM validated certificates | | SPA routing | Custom CloudFront error handling | *** ### Outputs with Notation | Output | Purpose | Need for FinOps Center Installation | | ------------------------ | ------------------------ | ----------------------------------- | | S3BucketName | Frontend bucket | **YES** | | CloudFrontDistributionId | Cache invalidation | **YES** | | CloudFrontDomainName | DNS mapping | | | WebsiteURL | Public FinOps Center URL | | *** # Create S3 Bucket and CloudFront Distribution Web Application Bucket Configuration FinOps Center Front End Application is deployed to and is served from S3. Navigate to S3 and Create a new S3 Bucket in US-East-1 (N. Virginia) Upon navigating to CloudFront, create a new distributions. Updated for new AWS UI Create a name for your Distribution and Add your cusotmer Domain. Note: it will try to validate the URL but select Skip for Now.

Level the S3 Selection and Select the Browse S3

Select your bucket and Select Choose

Leave the Origin Path to Default and Select Next

Do not Create a WAF and Select Next

Create Distibution With the Distbituion Create we will need to Edit the Settings

In the Setting we are going to add the Domain Name of the application and select the the SSL Certificate that was created for it

In the Behavior Setting Update to have all Traffic to be Redirected to HTTPs

Ensure to update the specified settings below, unless instructed otherwise, while leaving the rest as default. Update Viewer 9\. Navigate to the S3 Bucket for FinOps Center Application and to Permission. Edit Permission with the Policy from CloudFront

A Navigate to Route 53 or Domain Controller and Create an A Record that is Domain Name of your distribution

Create A Record

Example of CloudFront Distibution # CloudFront Error Page Within your CloudFront Distribution, add customer error response of 403 to / index.html withwith HTTP Response of 200 OK

# DNS Configuration Once the CloudFront Distribution is created, the distribution needs to be configured in your DNS. If in your DNS is in Route53, add the subdomain the distribution

If in alternative DNS Server, add the distrbution as a CNAME # Post Installation Steps The initial Admin user will receive the initial email to begin to onboard users to FinOps Center. The Recommended approach is to Create an Initial Financial Admin users and one Product Owner to assist with populating the installation with data. From the Business Requirements, the Financial Admin can create the Organization Naming from configuring the Budget Screen or via CSV Upload. Additional Post Installation Steps include updating the application with your company's logo and customizing the Amazon Cognito Welcome Email. # User Management Once the Initial User Admin receives the Cognito Email they can create the initial Financial Admin User. Prior to creating user, its best practice to configure the Welcome Email in Cognito. ### Application Roles FinOps Center 26.4.0 supports 7 application roles. These are not simply access levels — each role has distinct capabilities, workflows, and scope within the budget hierarchy (Business Unit > Department > Portfolio > Product). When Agent Bill is enabled, each role also maps to a dedicated QuickSight user group and chat agent with role-specific persona instructions and topic access. #### Financial Admin Full administrative access across the entire organization. Capabilities include account allocation, user management, credit management, application configuration (QuickSight Environment, themes, dashboards, Agent Bill agents), savings approval, vendor management, and spend card oversight. Financial Admins can view all spend cards across all portfolios for management oversight but the actual spend governance workflow happens between Portfolio Managers and Product Owners. Agent Bill QuickSight group: financial\_admins-access-group. Topics: all 4 topics (Cost Management, Container Allocation, Savings Plans Management, Marketplace Spending) plus credits visibility. #### Cloud Engineer Responsible for account onboarding, user onboarding, application configuration, and resource claiming. Cloud Engineers can claim resources on behalf of Product Owners and implement approved cost optimizations from the savings management workflow. Agent Bill QuickSight group: cloud\_engineers-access-group. Topics: Cost Management and Container Allocation. #### Portfolio Manager Scoped to the portfolio level (E3). Key workflow participant in weekly spend card governance — Portfolio Managers accept or reject spend cards submitted by their Product Owners. They also approve or reschedule budgets. When a Product Owner disputes a spend card, it escalates to the Portfolio Manager for resolution. Agent Bill QuickSight group: portfolio\_managers-access-group. Topics: Cost Management and Container Allocation. #### Product Owner Scoped to the product level (E4). Product Owners manage workload estimates, claim resources, and participate in weekly spend card governance by accepting or disputing their weekly spend cards. They can request budget reschedules which require Portfolio Manager approval. Product Owners create workload estimates that should be linked to the AWS Pricing Calculator (calculator.aws). Agent Bill QuickSight group: product\_leads-access-group. Topics: Cost Management and Container Allocation. #### Vendor Manager Has full Financial Admin scope visibility but with limited write access — Vendor Managers can only add budgets. This role is designed for managing vendor relationships and negotiated AWS discounts (EDP/PPA rates) through the Vendor Discounts pricebook. Only Financial Admin and Vendor Manager roles can access the Vendor Management section. #### Department Manager 100% view-only role scoped to the department level (E2). Department Managers can see all portfolios and products within their department but cannot take any actions. Agent Bill QuickSight group: department\_managers-access-group. Topics: Cost Management and Container Allocation. #### Business Unit Manager 100% view-only role scoped to the business unit level (E1). Business Unit Managers can see all departments, portfolios, and products within their business unit but cannot take any actions. Agent Bill QuickSight group: bu\_managers-access-group. Topics: Cost Management only. ### Agent Bill QuickSight User Groups When Agent Bill is enabled, each application role maps to a QuickSight user group. At every step of Agent Bill setup (datasets, topics, spaces, chat agents), you must share with the appropriate user group. If a user group is not shared on a component, users in that role will not be able to access Agent Bill. The 6 QuickSight user groups are: financial\_admins-access-group, bu\_managers-access-group, department\_managers-access-group, portfolio\_managers-access-group, product\_leads-access-group, and cloud\_engineers-access-group. Add Users

Users Lists

Update User Role

Import via Cognito Console {% file src="/files/zfGGJ5whJ0oq2JFbc7BI" %} As an alternative to adding Users via the FinOps Center Application, Admins can log into the Delegated Admin/Data Collection Account and navigate to Cognito->FinOpsCenterPool

Create Import Job

In the provided csv, complete rows: * L for Customer Role of User * N for Email address of User * O for Email Validation to True * V for the Username for FinOps Center

# Updating Cognito Emails Upon completion of the FinOps Center installation, log into the AWS Account of the applicatoin and navigate to the Amazon Cognito Service and the FinOpsCenterPool

In the left hand navigation, click on the Manage Template and sellect Invitation Message then Edit.

Add Welcome to FinOps Center in the Subject

The Recommended HTML that requires an update for your FinOps Center URL ```html Welcome to FinOps Center

Hello,

Your FinOps Center account has been created successfully. Below are your login credentials:

Username: {username}

Temporary Password: {####}

For security reasons, you will be required to change your password upon your first login.

Access FinOps Center

If you have any questions or need assistance, please visit www.finopscenter.com/support.

Thank you,
The FinOps Center Team

``` Note: href needs to be changed to application url # Adding Company Logo Customers can update the header and login logo in the FinOps Center implementation

Customers' logo needs to have the file name customer-logo and format svg. (if you have image in different format they must be converted to svg.) The logo gets uploaded in the s3 bucket of the frontend application in the root directory.

# Triggering Step Function to Load Data To accelorate Environment Setup, your Cloud Engineer can navigate to the Step Functions in the AWS Console. Select the CURProcessingStateMachine ```json { "source": "scheduler", "timestamp": { "props": { "inputPath": "$.time" } } } ``` Add the above once the Start Execution has been selected # Add MB to Lambda During installation, default Lamda Limits are set for 3008MB. {% embed url="" %} Targeted Lamda Function to increase * UsagesLambdaHandler * UsagesLambdaHandler # Add QuickSight Dashboard You can add any QuickSight Dashboard to FinOps Center by adding the Dashboard ID and adding your application URL to the Embedded Dashboard management page. (Resticted to Financial Admin, Vendor Manager, and Admin Users. In QuickSight, add the Dashboard to the Group you wish to view in FinOps Center

In the URL is the Dashboard ID for your QuickSight Dashboard

Add Dashboard ID to the Configuration Page in FinOps Center

Navigate to Reporting Page to View

# Overview & Roles AI Cost Governance is the module in FinOps Center that manages the full lifecycle of AI workload costs — from approving a model for use, through IAM configuration, to weekly spend review and cost allocation. This section of the user guide covers all six pages of the AI Governance module and is organized by role. Each page describes what a specific role sees, what actions they take, and what happens next in the workflow. ### Before You Start AI Cost Governance requires three roles to be filled in your organization. The workflow will not complete unless each role acts on their step. | Role | What they own in this module | Where they work | | ------------------ | ---------------------------------------------------------------------------------- | --------------------------------------------------------- | | **FinOps Lead** | Model approval, scope definition, allocation policy, Allocation Gap remediation | AI Governance page → AI Models, AI Tasks, Allocation Gaps | | **Cloud Engineer** | IAM role creation, Bedrock model access configuration, task completion | AI Governance page → AI Tasks | | **Product Owner** | Workload registration, IAM role claiming, token estimates, weekly spend acceptance | Spaces → Add Workload wizard; weekly Spend Cards | None of these roles requires direct AWS console access to complete their part of the workflow — FinOps Center surfaces the information and generates the commands each role needs. ### The End-to-End Flow The governance workflow moves left to right. Each step produces something the next role consumes. ``` FinOps Lead Cloud Engineer Product Owner ───────────────── ────────────────── ────────────────────────── 1. Review model 3. Pick up task 5. Open Spaces wizard catalog from AI Tasks 6. Select approved model 2. Approve model 4. Create IAM role 7. Claim IAM role for account × with condition 8. Set token estimate region scope key 9. Accept weekly spend 4b. Mark Implemented card each period ``` Steps 1–2 are covered in Model Governance. Steps 3–4 are covered in Cloud Engineer Tasks. Steps 5–9 are covered in Workload Setup & Estimates and Weekly Spend Cards. Allocation Gaps — spend that falls outside the governed workflow — are covered in Allocation Gaps and are handled by the FinOps Lead. ### Terminology Use these terms consistently. Incorrect terms are noted so you can recognize them if they appear elsewhere. | Correct term | Do not use | | ------------------------ | --------------------------------------------------------------------- | | FinOps Lead | Admin (this is an internal Cognito role name, not a user-facing term) | | Product Owner | End User | | Allocation Gap | Non-Compliance, Compliance Violation | | Workload Attribution | Workload Tagging | | AI Cost Governance | AI Compliance, AI Spend Governance | | Availability Requirement | Inference Endpoint Type | # Model Governance **Role:** FinOps Lead **Location:** AI Governance → AI Models The AI Models page is where you review foundation models available in your AWS environment, approve them for use in specific accounts and regions, and block models that are not permitted. No AI workload can proceed to IAM configuration until the model it uses is approved here. ### The AI Models Catalog When you open AI Models, the catalog shows every Bedrock foundation model discovered in your AWS environment via `bedrock:ListFoundationModels`. Models with observed CUR usage in the last 30 days are surfaced at the top. **Catalog columns:** | Column | What it shows | | ----------------- | ---------------------------------------------------------------- | | Model | Model name and vendor (Anthropic, Amazon, Meta, Mistral, others) | | Platform | Native Bedrock / Marketplace Claude / Claude Platform | | Status | Pending Review / Approved / Implemented / Blocked | | Input Price | $/1M input tokens (from AWS Pricing API, refreshed daily) | | Output Price | $/1M output tokens | | Accounts in Scope | Number of (account × region) scopes this model is approved for | | Active Tasks | Open Cloud Engineer enablement tasks for this model | You can filter by vendor, platform, and status. Use the **Status: Pending Review** filter to work through models that have not yet been acted on. ### Model Status Lifecycle ``` Pending Review → Approved (scoped) → Implemented (enabled in account) ↘ Blocked ``` * **Pending Review** — Model exists in your environment but has not been approved or blocked. * **Approved** — You have approved the model for one or more (account × region) scopes. Cloud Engineer tasks have been generated. * **Implemented** — The Cloud Engineer has completed the IAM configuration for at least one scope. The model is available to Product Owners in those accounts and regions. * **Blocked** — The model is not permitted for use. No tasks are generated. Blocked models are not visible to Product Owners. ### Approving a Model 1. Click the model row to open the model detail panel. 2. Review the model's current usage (accounts and regions with observed CUR spend in the last 30 days). 3. Click **Approve for Use**. 4. In the approval modal, select the accounts and regions you are authorizing. This is the **ModelApprovalScope** — approval is per (account × region), not blanket across your entire AWS estate. 5. Enter a rationale. This is required and is stored on the approval record for audit. 6. Before confirming, review the task count shown at the bottom of the modal. Each (account × region) combination generates one Cloud Engineer enablement task. Approving a model across 12 accounts and 3 regions creates 36 tasks. 7. Click **Confirm Approval**. The model status changes to **Approved**. Cloud Engineer tasks are created immediately and appear in AI Tasks. > **Note on scope:** Approval is deliberately scoped. If you approve a model in pre-production accounts first and want to add production accounts later, you can extend the scope by opening the model again and adding additional (account × region) combinations. Each addition creates new Cloud Engineer tasks for the new scope. ### Blocking a Model 1. Click the model row to open the model detail panel. 2. Click **Block Model**. 3. Enter a rationale. This is required. 4. Click **Confirm Block**. Blocked models do not generate Cloud Engineer tasks and do not appear in the Product Owner's Spaces wizard. If a model with existing Approved scopes is blocked, the status changes to Blocked across all scopes and existing tasks are cancelled. ### Bulk Approval You can select multiple models using the checkboxes in the catalog and click **Approve Selected**. The approval modal will ask you to define the (account × region) scope, which applies to all selected models. A rationale is required and applies to all models in the batch. The task count shown before confirmation reflects the total across all selected models and all selected scopes. ### Pricing Refresh Model pricing is pulled from the AWS Pricing API and cached. To refresh pricing for a model manually, open the model detail panel and click **Refresh Pricing**. The daily automatic refresh runs at 02:00 UTC. # Cloud Engineer Enablement Tasks **Role:** Cloud Engineer **Location:** AI Governance → AI Tasks The AI Tasks queue is where Cloud Engineers pick up the work generated by FinOps Lead model approvals. Each task represents one (model × account × region) combination that has been approved and needs IAM configuration before Product Owners can use it. You do not need AWS console access beyond what you already have to complete these tasks — FinOps Center generates all CLI commands and deep links for each step. ### The AI Tasks Queue The queue shows one row per pending task. Each row displays: * Model name and ARN * Target account and region * Rationale entered by the FinOps Lead at approval time * Current task status * Date approved **Task status values:** | Status | Meaning | | ----------- | ------------------------------------------------------------------- | | Pending | Task created; no action taken yet | | In Progress | You have opened the task and started work | | Implemented | You have marked the task complete; model is live for Product Owners | | Cancelled | The FinOps Lead blocked the model after task creation | Filter by status using the tabs at the top of the queue. The default view shows **Pending** tasks. ### Completing a Task Click any task row to open the task detail panel. The panel contains four steps. Complete them in order. #### Step 1 — Verify Model Access Confirm that the model is accessible in the target account. The task panel includes a deep link to **AWS Bedrock Model Access** for the specific account and region. Open it and verify the model's access status is enabled. If it is not enabled, follow the AWS console steps to request access before proceeding. #### Step 2 — Create the IAM Role Create a dedicated IAM role for AI workloads using this model. The task panel generates the exact CLI command for this account, region, and model. Copy and run it in the target account. The generated role name follows the convention: ``` finops-{sanitizedWorkloadName}-{4charId} ``` The trust policy scope is configurable — the task panel offers pre-generated trust policies for Lambda, EC2, and ECS use cases. Select the one that matches how workloads in this account invoke Bedrock. #### Step 3 — Apply Deny Policy Apply the deny-by-default policy to the role. This policy denies all Bedrock `InvokeModel` calls by default. The CLI command is pre-generated in the task panel. Run it in the target account. #### Step 4 — Apply Model Allow Policy Apply the model-specific allow policy. This policy uses the `bedrock:InvokedModelId` condition key to permit invocations only for the approved model ARN. The CLI command is pre-generated and scoped to the exact model ARN from the approval. Run the command in the target account. #### Developer Handoff Block After completing Step 4, the task panel generates a **Developer Handoff block** containing: * IAM Role ARN * Approved Model ID * Example SDK invocation snippet This block is what the Product Owner needs to claim the role in Spaces and what the application team needs to configure their SDK calls. Copy it and share it with the Product Owner for this workload. #### Marking the Task Implemented Once all four steps are complete, click **Mark Implemented** at the bottom of the task panel. This action: * Changes the task status to **Implemented** * Flips the ModelApprovalScope state to **Implemented** for this (account × region) * Makes the model available in the Product Owner's Spaces wizard for this account and region > **Important:** Do not mark a task Implemented until the IAM role is confirmed created and the allow policy is applied. Product Owners will attempt to claim the role immediately after Implemented status appears. ### Cross-Region Inference Profiles (MAP and High-Availability Workloads) If the Business Request for a workload includes an **Availability Requirement** of **Production / High Availability**, the task panel will include an additional step to create an Application Inference Profile. The inference profile is tagged: ``` map-migrated=mig{MPEID} ``` where `{MPEID}` is the MAP engagement ID shown in the task. This tagging is required for MAP credit eligibility. Create the profile before marking the task Implemented. The inference profile ID is included in the Developer Handoff block when present. ### Claude Platform Tasks (Claude for Enterprise) For Claude Platform workloads (CCU billing), the task steps differ from Bedrock: 1. Create the Claude Platform workspace via the Workspace creation flow. 2. Apply the `aws-external-anthropic:CreateInference` IAM policy to the role. 3. Mark the task Implemented. The task panel identifies Claude Platform tasks with a **Platform: Claude Platform** badge and shows the workspace-specific steps in place of the standard Bedrock steps. # Workload Setup & Estimates **Role:** Product Owner **Location:** Spaces → Add Workload wizard Before your AI workload's spend appears in your Spaces dashboard or in weekly Spend Cards, you need to register it as an AI workload and claim the IAM role your application uses to call Bedrock. This connects your application's CUR spend to your budget in the FinOps Center hierarchy. ### Prerequisites Before you can complete workload setup, the following must already be true: * The model your workload uses must be **Approved** and **Implemented** by the FinOps Lead and Cloud Engineer for the account and region your workload runs in. * You must have the IAM role ARN that your application assumes when calling Bedrock. This is provided in the Developer Handoff block from the Cloud Engineer. * Your workload must be registered in Spaces at the Product (E4) level. If it is not, create the workload in Spaces first before adding AI configuration. ### Adding an AI Workload 1. Open **Spaces** and navigate to your Product. 2. Click **Add Workload**. 3. In the workload type selector, choose **AI Workload**. 4. Complete the Business Request fields: * **Use Case Type** — Select the category that best describes what the workload does (e.g., customer-facing chat, internal tooling, document processing, code generation). * **Workload Type** — Select the underlying infrastructure type (Lambda, ECS, EC2, or other). * **Details** — Free-text description of what the workload does and why it needs this model. This is stored on the Business Request record. 5. Select your **Availability Requirement**: * **Standard** — Single-region inference, standard pricing. * **Production / High Availability** — Cross-region inference profile, approximately 10% pricing premium. Choose this if your workload requires high availability or low-latency fallback across regions. This is a business decision about your SLA requirements, not a technical one. 6. Click **Submit Request**. The Business Request goes to the FinOps Lead for review and configuration. You will be notified when the request is approved and the IAM configuration is ready to claim. > **If the model is not available in the dropdown:** The model has not been Implemented for your workload's account and region. Contact your FinOps Lead to check the approval status and ask your Cloud Engineer to complete the enablement task. ### Claiming the IAM Role After your Business Request is approved and the Cloud Engineer marks the task Implemented, the workload appears in your Spaces dashboard with a **Claim Role** prompt. 1. Open the workload in Spaces. 2. Click **Claim Role**. 3. Enter the IAM role ARN provided in the Developer Handoff block. This is the role your application assumes when calling `bedrock:InvokeModel`. 4. Click **Confirm Claim**. Once claimed, every Bedrock API call that role makes will be attributed to this workload in CUR via `line_item_iam_principal`. This is what connects your application's spend to your budget in the FinOps Center hierarchy. > **Note on shared accounts:** If your workload runs in an account that is shared with other budgets, claiming the IAM role causes that role's spend to exit the shared cost pool and flow 100% to your workload. This is the intended behavior — it replaces averaged approximations with accurate attribution. Release the claim only if the workload is decommissioned or the role changes. ### Setting Token Estimates After claiming the role, set a token estimate for the period. This estimate is what your weekly Spend Cards will measure actuals against. 1. Open the workload in Spaces. 2. Click **Set Estimate**. 3. Choose your input method: * **Token volume** — Enter expected input tokens, output tokens, and cache-read tokens separately per period. * **Dollar budget** — Enter a dollar amount. FinOps Center back-calculates the token equivalent using current Bedrock pricing for the approved model and region. 4. Select the estimate period (weekly, monthly). 5. Click **Save Estimate**. Estimates can be updated mid-period. Each change creates an audit record. If you revise an estimate, the Spend Card for the current period will show both the original and revised estimate. > **Prompt caching:** If your workload uses prompt caching, enter cache-read tokens separately from input tokens. Cache-read tokens are billed at a lower rate than input tokens — combining them will overstate your expected cost. ### Allocation Mode Each AI workload can be set to one of two allocation modes: * **BI-only** — Spend is visible in your Spaces dashboard and in Spend Cards, but does not move budget. Use this during initial rollout or for workloads where chargeback is not yet agreed. * **Chargeback** — Spend is debited against your workload's allocated budget. Use this once the estimate is confirmed and the chargeback model is agreed with Finance. To change the allocation mode, open the workload in Spaces and click **Edit Allocation Mode**. The FinOps Lead must confirm chargeback mode changes. # Weekly Spend Cards & Approvals Spend Cards are generated weekly for every AI workload that has a claimed IAM role and a token estimate. They put actual AI spend in front of the people accountable for it and require a two-tier sign-off before the period closes. ### Who Sees What | Role | What they see | What they do | | ---------------------- | ---------------------------------------------------------------- | --------------------------- | | Product Owner (E4) | Spend Card per workload under their Product | Accept or Dispute each card | | Portfolio Manager (E3) | Rolled-up Portfolio Spend Card after all E4s have acted | Approve or escalate | | FinOps Lead | All disputed cards, flagged lines, and unactioned cards past due | Review disputes and resolve | ### The Spend Card Each Spend Card shows: * **Workload name** and the model(s) it used during the period * **Actuals vs estimate** — total spend for the period against the estimate set in Spaces * **Breakdown by model, region, and token type** (input, output, cache-read) * **Variance** — overspend or underspend against estimate, highlighted if above the configured threshold * **Period** — start and end dates for the card ### Product Owner Actions (E4) Cards appear in your Spaces dashboard at the start of each week covering the prior period. **To accept a card:** 1. Open the Spend Card for the workload. 2. Review the actuals vs estimate and the token-type breakdown. 3. If the spend matches your expectations, click **Accept**. The card moves to the Portfolio Manager's queue for approval. **To dispute a card:** 1. Open the Spend Card. 2. Click **Dispute**. 3. Select the lines you are disputing and enter a reason for each. 4. Click **Submit Dispute**. The dispute is routed to the FinOps Lead with the flagged lines highlighted. Chargeback continues during an open dispute unless your allocation mode is BI-only — disputes are tracked in parallel with allocation, not in place of it. > **Unactioned cards:** If a card is not accepted or disputed within the configured window, it escalates to the FinOps Lead automatically. Cards do not auto-accept. ### Portfolio Manager Actions (E3) After all Product Owners under your Portfolio have accepted their cards, your Portfolio Spend Card becomes available for approval. **To approve a Portfolio card:** 1. Open the Portfolio Spend Card in your dashboard. 2. Review the rolled-up spend across all Products in your Portfolio. 3. Click **Approve**. If one or more E4 cards are still open (not yet accepted or disputed), the Portfolio card is not available for approval until they are resolved. **If a dispute is in progress:** The Portfolio card shows the disputed workload with a dispute flag. You can approve the Portfolio card while the dispute is in flight — the dispute is a separate thread and does not block Portfolio approval. ### Disputed Cards — FinOps Lead Flow When a Product Owner disputes a card, the FinOps Lead receives a notification and the dispute appears in the **AI Governance → Disputes** view. 1. Open the dispute to see the flagged lines and the Product Owner's reason. 2. Review the CUR detail for the flagged lines. 3. Take one of the following actions: * **Resolve** — Mark the dispute resolved with a note. The card is updated and the Product Owner is notified. * **Adjust Estimate** — If the dispute reflects a mismatch between the estimate and real consumption patterns, work with the Product Owner to update the estimate in Spaces for the next period. * **Escalate** — Route to a named person outside FinOps Center if the dispute requires an organizational decision. ### Variance Thresholds Spend Cards highlight variance when actuals exceed the estimate by more than the configured threshold. The default threshold is 20%. Cards with variance above threshold are flagged with a visual indicator and moved to the top of the E3 approval queue. To change the variance threshold, go to **AI Governance → Settings → Spend Card Thresholds**. # Allocation Gaps **Role:** FinOps Lead **Location:** AI Governance → Allocation Gaps Allocation Gaps shows AI spend detected in CUR that cannot be attributed to a workload or budget owner. Gaps are detected nightly by comparing CUR spend against the set of approved ModelApprovalScopes and claimed IAM roles. Every gap represents spend that Finance cannot route to a specific owner. This page is for the FinOps Lead. Product Owners do not see Allocation Gaps — if spend attributed to their workload appears here, they are notified via the Unclaimed Workload action flow. ### Reading the Gaps Page **Scenario pills** — At the top of the page, six pills show the count of Active gaps by scenario. A pill with a count greater than zero appears in red. Click any pill to filter the table to that scenario. **Total unattributed cost** — The total estimated monthly cost of all Active gaps is displayed right-aligned above the table as `$X,XXX/mo unattributed`. This is the total spend that cannot currently be routed to a budget owner. **Status tabs** — Filter the table by gap status: **Active** (default), **Actioned**, **Resolved**, **Recalled**, or **All**. ### The Six Gap Scenarios #### Attribution Not Enabled Bedrock spend is appearing in CUR for this account but `line_item_iam_principal` is not populated. The account has not enabled the IAM principal feature in CUR export settings. Without this, no workload-level attribution is possible for any spend in this account. **Action:** Click **Enable Attribution →**. This opens the AWS CUR Data Export settings page for the account in a new tab. Enable the `line_item_iam_principal` field in the export configuration and save. Return to FinOps Center and click **Action Gap** with a rationale noting the change was made. The gap will resolve on the next nightly CUR refresh after the export setting propagates. *** #### Unattributed Spend An IAM principal is present in CUR but it is a broad SSO role — for example, `AWSAdministratorAccess` or `AWSPowerUserAccess`. The caller is identified but the workload is not. This is not a security issue — the role is authorized to call Bedrock. The gap is that the spend cannot be routed to a specific workload or budget owner. **Action:** Click **Create Business Request →**. This prompts the Product Owner who owns this usage to submit a Business Request in Spaces using a dedicated workload IAM role. Copy the Gap ID shown in the info modal and share it with the Product Owner so they can reference it in the Business Request. Once the Product Owner claims a dedicated role, the spend moves from the broad SSO principal to the workload-specific role and this gap resolves. *** #### No Budget Allocation The model is being invoked in this account and region but there is no approved Business Request on record for this (account × region) combination. There is no budget owner for this spend. **Action:** Click **Approve or Block →**. This opens the model approval modal pre-filtered to the affected product code. You can approve the model for the account and region — which generates Cloud Engineer tasks and starts the onboarding workflow — or block the model for this account. *** #### Out of Budget Scope The model is approved and implemented, but CUR shows usage in an account or region that is outside the approved ModelApprovalScope. The usage is not within any approved (account × region) combination. **Action:** Click **Add Scope →**. This opens the model's approval scope modal with the out-of-scope account and region pre-filled. Review whether the usage is legitimate. If it is, add the account and region to the approved scope — this generates a Cloud Engineer task for the new scope. If it is not legitimate, block the model for that account and region and investigate the source of the calls. *** #### Unclaimed Workload A dedicated `finops-ai-*` IAM role exists with spend attributed to it in CUR, but no Product Owner has claimed it in Spaces. The role was created by a Cloud Engineer (and is therefore within the governed path) but the workload setup in Spaces is incomplete. **Action:** Click **Notify Product Owner →**. A confirmation modal appears showing the workload ID associated with the role. Confirming calls the gap action with the rationale "Notified PO to claim role." Contact the Product Owner for the workload and direct them to the Workload Setup steps in Spaces to claim the role and set an estimate. The gap resolves once the role is claimed. *** #### Unallocated Guardrail Cost A Bedrock Guardrail ARN appears in CUR with spend but no workload claims ownership. Guardrail rows do not emit `line_item_iam_principal` — the Guardrail ARN is the only attribution anchor available. **Action:** Click **Assign to Workload →**. An assignment modal appears. Enter the workload ID that should own this Guardrail cost and a rationale for the assignment. This links the Guardrail ARN to the workload in the allocation model. The gap resolves after the next nightly attribution run. *** ### Taking Action on a Gap #### Scenario-specific action buttons Use the labeled action button on each row (described per scenario above). These are the fastest path to resolution for each gap type. #### Action Gap (generic) Every Active gap also has an **Action Gap** button. This opens a modal with a single rationale field. Use this when you have taken a remediation step outside FinOps Center — for example, disabling a Bedrock model directly in the AWS console — and want to record that action against the gap. A rationale is required. Submitting moves the gap to **Actioned** status. #### Recalling an Actioned Gap If you actioned a gap in error, or the remediation step needs to be reversed, click **Recall** on any Actioned gap. Enter a reason for the recall. The gap status changes to **Recalled** and a new audit record is created. The original action record is preserved — it is never deleted. A recalled gap can be re-actioned. ### Gap Detail Drawer Click any row to open the Gap Detail Drawer. The drawer shows: 1. **Gap Summary** — Gap ID, scenario, account, region, product code, IAM principal (or "Not available for this scenario"), resource ARN, estimated monthly cost, and detection timestamp. 2. **Attribution Note** — An explanation specific to this scenario describing exactly why this spend cannot be attributed and what the gap means. 3. **Audit Trail** — Every action taken on this gap, in reverse chronological order (newest first), showing the action type, the actor, the timestamp, and any note recorded. ### Gap Status Lifecycle ``` Active → Actioned → Resolved ↘ Recalled (new audit record created; original preserved) ``` | Status | Meaning | | -------- | -------------------------------------------------------------------------- | | Active | Gap detected by nightly run; no action taken | | Actioned | FinOps Lead has recorded a remediation step | | Resolved | Nightly run confirms the spend is now attributed; gap closes automatically | | Recalled | A previous Actioned decision was reversed | Gaps resolve automatically when the nightly attribution run no longer detects the condition. You do not need to manually resolve a gap — once the underlying CUR data changes (attribution enabled, role claimed, scope added), the gap status will move to Resolved on the next nightly run. # CFM Processes Finops Center provides your companies Core Cloud Financial Processes. In FinOps Center 26.4.0, several CFM processes have been enhanced with new workflows. Weekly Spend Card Governance now enforces accountability at the product owner and portfolio manager level through weekly accept/dispute/reject cycles based on business weeks (Sunday to Saturday). Budget Management includes a full lifecycle with approval locks, reschedule requests, and status tracking. The cost allocation model follows the hierarchy: Budget > Account Allocation (%) > Workload > Resources, with open resources sharing cost by allocation percentage and claimed resources assigned 100% to a workload. Savings Management introduces a cost recommendations workflow where Financial Admins approve and Cloud Engineers implement optimizations. Vendor Management enables negotiated AWS discount tracking (EDP/PPA rates) through a vendor discounts pricebook. * Financial Budget Onboarding/Modifying * Business User Onboarding * Financial Budget Mapping to User * Financial Budget to Cloud Allocation * AWS Account to Budget * Resource to Workload to Budget * Release Resource * Rollup Allocation/Visibility * Estimate to Budget * Budget Scheduling * Create Schedule * Approve/Reject Schedule * Request Reschedule * Approve Reschedule * Rollup Budgets * Period Spending Cost Governance * Cost Optimization Approvals * AWS Credit Allocation * Close Month * AR File * FP\&A # Onboarding/Modifing Financial Budget Creation of Approved AWS Spending by Budget FinOps Center manages Financial Budgets that have been approved by customer's Core Financial Budgeting process. The Financial Budgets can be onboarded to FinOps Center via the Application UI or by uploading a CSV files. ### Overview ### Financial Budget Onboarding is the foundational process in FinOps Center's Cloud Financial Management framework. It establishes the four-level budget hierarchy (E1 through E4) that organizes all cloud spending, creates budget entries at each level, configures cost allocation percentages, and maps budgets to specific AWS accounts. Every other CFM process depends on this initial budget structure being in place. ### Process Steps ### 1. Define the Budget Hierarchy - Establish the four-level financial element structure: Business Unit (E1), Department (E2), Portfolio (E3), and Product (E4). This hierarchy determines how costs roll up and how financial data is scoped for each role. ### 2. Create Budget Entries - Add budget line items at the appropriate hierarchy level. Budgets can be set on monthly or annual periods and support multiple fiscal years (2024, 2025, 2026). Each entry tracks both estimated and approved amounts. ### 3. Set Allocation Percentages - Configure what portion of each budget maps to AWS accounts. These percentages drive the cost allocation model: resources are either claimed (100% allocated to one workload) or open/shared (cost distributed by allocation percentage). ### 4. Assign to AWS Accounts - Link budget entries to specific AWS account IDs. Account names are resolved from the account\_mapping table. Once assigned, cost tracking activates and QuickSight dashboards begin populating with spend data. ### Key Concepts ### Budget Hierarchy (E1-E4): Business Unit, Department, Portfolio, Product. Each level scopes financial visibility and governance accountability. ### Allocation Percentages: Determine how budget and cost are distributed across AWS accounts. A 60% allocation means 60% of shared costs from that account are attributed to the corresponding workload. ### Monthly vs Annual Periods: Budgets can operate on either cadence. Monthly budgets enable fine-grained spend tracking; annual budgets set broader spending envelopes. ### Multi-Year Support: FinOps Center supports budget entries spanning 2024, 2025, and 2026 fiscal years with cross-year data visibility. ### Integration Points ### Budget onboarding feeds directly into Budget to Cloud Allocation (which maps budgets to workloads and resources) and Financial Budget Mapping to User (which connects budgets to specific users for role-based visibility). Without completed budget onboarding, no other CFM process can function. FinOps Center Roles - Financial Admin & Vendor Manager (Default Roles) Navigate to the Vendor Manager

Via Site Define Organizational Naming for the Year

Add Line Item

Via CSV

The Financial Budget/Chart of Account Files is a comma delimited file (csv). The hierarchy of file goes from left to right with the top or your organization being the left column to the lowest product/project in the 4th column. The First Row of the file will drive the labels of the application. Sample File: {% file src="/files/HsefFozyKNqmtpmPDNvB" %}

**File Name** The Chart of Account File should be generated from your Core Accounting System that reflects your Hierarchy and Approved Budget Spending for AWS.Budgets (via file format) can be updated based on Customer requirements. Customer\_2025\_true\_2025-11-01\_false\_Budget\_v1.csv | 2025 | effectiveYear - sets endDate to 2023-12-31. If isNew = true, startDate will be overridden to 2023-01-01 | | --------------- | ------------------------------------------------------------------------------------------------------------------------------ | | true | isNew - sets startDate to effectiveYear-01-01 and reloads the budgets | | 2025-11-01 | startDate - sets when the budget becomes active. Must be 1st of month | | false | isOverride - if you want to replace the existing entries, clears the database for given effective year and creates new entries | | Customer Option | None | | v1 | None | I am a CCoE User and I want to create a New Budget for All Project for the New Budget Year. I am a CcoE User and I want to up to update a Product’s Annual Budget on 7-01-XX I am a CCoE User and I want to add a New Product and it’s budget **Chart of Account Integration** Admin users upload the Chart of Account File in the Configuration Page. The Chart of Account File is uploaded in the \*.sorfile s3 Bucket and processed by Lambda into DynamoDB.
**Invoice Integration** CCoE and Business Unit Users will be able to download csv to their desktops for integration into Core Financial and/or FP\&A Solutions. # Business User Onboarding FinOps Center Users are onboarded to the application by Admin Users. All users are stored in Amazon Cognito that accepts mass uploads. (contact support for assistance). The Admin Configuration Screen is accessible to the Admin User that is created during the installation of FinOps Center. Additional Admin Users can be created like any other role Admin users are responsible for adding users with their roles. Those Roles can be updated. Each users requires an unique email address. (+email are Supported) ### Overview User onboarding establishes each person's identity, role, and data scope within FinOps Center. The process creates a user in AWS Cognito for authentication, assigns one of seven application roles that determine governance capabilities, maps the user to a QuickSight access group for dashboard visibility, and defines their financial element scope (E1-E4) to configure Row Level Security. 1. Create Cognito User - Add the user to the AWS Cognito user pool. This creates their authentication identity, configures email verification, and establishes login credentials for FinOps Center. 2. Assign Application Role - Select one of seven roles: Financial Admin, Cloud Engineer, Portfolio Manager, Product Owner, Vendor Manager, Department Manager, or Business Unit Manager. 3. Map to QuickSight Group - Add the user to the corresponding QuickSight access group. This controls which dashboards, topics, and datasets are visible within Amazon QuickSight. 4. Define Element Scope - Assign the user to their position in the E1-E4 hierarchy. This configures Row Level Security so the user only sees financial data within their assigned scope. Seven Application Roles: Financial Admin (full scope), Cloud Engineer (admin scope), Portfolio Manager (E3 governance), Product Owner (E4 operational), Vendor Manager (budget add only), Department Manager (E2 view-only), Business Unit Manager (E1 view-only). Row Level Security: Applied via QuickSight datasets to ensure each user sees only the financial data within their assigned element scope. The user\_view supports multi-element access for roles like Financial Admin. User onboarding connects to User Allocation to Financial Scope (which refines the E1-E4 mapping) and Financial Budget Mapping to User (which links budgets to the onboarded user for role-based budget visibility).

# User Allocation to Financial Scope FinOps Center maps Users to their Financial Budget/Scope. A key feature of FinOps Center is "Rollup" of Spending and Budget within the hierarchy. As depicted below, the Roles rollup spending from the members of their Financial Scope.

From the Drop Down, A user will be added to the Financial Scope aligned to the Role they were onboarded to when they were added to FinOps Center. Users can have multiple scopes within their hierarchy but must have the same "Parent". In the examples below Department can have multiple departments within Enterprise but not in different Business Units. This mapping drives Row Level Security (RLS) across all QuickSight dashboards and datasets. A Business Unit Manager assigned to E1 sees all spending under their BU, while a Product Owner at E4 sees only their product's cost data. The Financial Admin manages all user-to-element allocations and can grant multi-element access when a user's responsibilities span multiple financial scopes. Business Unit Role

Department Role

Portfolio Owner

Product Owner

All users mapping can be remapped(adding or subtracting) by selecting the user from the list ->

and adding the new mapping

# Financial Budget to Cloud Allocation FinOps Center is designed to have 2 tiers of allocation to a Financial Budg Cloud allocation maps financial budgets to AWS infrastructure through a percentage-based distribution model. Budget flows from accounts to workloads to individual resources, with each resource either "claimed" (100% allocated to one workload) or "open/shared" (distributed by allocation percentage). The Financial Admin manages account allocation percentages, Product Owners claim resources for their workloads, and Cloud Engineers claim resources on behalf of Product Owners. Claimed resources show their full cost against the claiming workload, while shared cost is calculated as unblended cost multiplied by allocation percentage. The system tracks five discount types and net\_cost calculations on a daily basis. {% embed url="" %} 1. Account Allocation: Aligned to the multi-account framework, AWS Account Billing is split by percentage allocation to a budget. The Allocation begins to either the Vending date of the Account or the 1st of the Previous Month. Allocation can be updated to the beinning of Period (aka weekly). All resources will be allocated to that budget at the % rate. 2. Workload Allocation: Product Owners create estimates for Workload. Workload can then "Claim" resources to them by Admin, Financial Admins, or the Product owners that will then have 100% allocation to that budget as of the next day from Claiming. As detailed below - Spending is then discounted (if applicable) and reduced by available Credits at the budget level.

# AWS Account Onboarding FinOps Center onboards AWS Accounts via the Account Management API that is connected to AWS Organization when installed in the configured Delegated Admin Account.

When a new Account is Vended the Financial Admin, VM, or Cloud Engineers and Add the new Account by Checking for New Account. Accounts can be additionally Onboarded when they show on the Cost and Usage Report. # Account Allocation All AWS Accounts are at minimum allocated to 1 Financial Budget and define as an Account Type (Production, Pre-Production, Shared, Development or Sandbox). To complete mapping the total allocation must be 100%.

Accounts can be mapped to multiple budgets but need to have total allocation of 100%.

Allocation can be updated to a new start date and allocation

Select Remap to update account allocation and start date

New allocation will history of allocations with current in green highlight. Effective dates of allocation are in Effective Column with the timestamp of updates in lower left of table.

# Workload Allocation Resource Claiming to Workload Workload allocation begins with the Product Owner creating an estimate for their workloads. Within Space, Product Owners will navigate to a Budget within their Scope and Select the AWS Account where the workload will be created. Workload need to be named, have an AWS Pricing Calculator, and a Launch Date(Month). If there is a targeted Teardown for the workload enter the End Month. By default, Estimates will end a year of year.

Once Estimates are created Product Owners, Financial Admins, or Admins can Claim Resources to the Workload within the Resource Tab.

On load, Resource that are Open to be Claimed will be visible in the table. Users can use the search to identify by Service Name, Resource Name, or Tag. Claiming Resources can be done across multiple Workload or Multiple Resources can be Bulk Claimed. Multi-Workload

Bulk Claim

To view Claimed Resources, Select the Claimed Resource Checkbox. The Status visual provides information on which Budget it belongs , the date of action, and the User that made the action.

For Claimed Resources within the Budget Scope, the Resource(s) can be Released back to the available pool to be Claimed by another Workload or to Account Allocation.

# Rollup Allocation/Visibility Roles and Users have Allocation/Visibility within their Financial Scope. The allocation is across all Tabs and within their Amazon Q Topics. On the Summary Page, the Account Allocation for the User are shown Across Current, Expiring, New, Past, and Future.

For Financial Admin, Admin, Vendor Management, Business Unit Owner, Department Owner, and Portfolio Owners Accounts/Workload needs have a Workload Created by the Product Owner for it to be visible.

Budget Pages, Reporting, and Amazon Q Visibility will be defined on their Functional Page Documentation. # Estimate to Budget Product Owners own creating Workload Estimate in FinOps Center leveraging a AWS Pricing Calculating Link. Any entity (internal user, AWS, AWS Partner) can create an estimate for a Workload via the AWS Calculator - . Each Workload Estimate should be for the Workload in that AWS Account. Once the Estimate is created, the Product Owner will add the Link to the Estimate with the Monthly Estimate.

Once the Estimate is created, the Product Owner will add the Link to the Estimate with the Monthly Estimate.

Workload Estimates flow to the Budget Schedule to be included in Monthly Budget Schedule. The Estimate to Budget process enables Product Owners to forecast workload costs before they become committed budgets. The workflow follows five stages: (1) Create Workload Estimate, defining required AWS services, usage volumes, and environment type (Dev, Sandbox, Pre-Prod, Prod, or Shared); (2) Link AWS Pricing Calculator at calculator.aws for authoritative monthly and annual cost projections; (3) Submit for Approval with budget period selection (monthly or annual) and justification notes, via MCP action or dashboard workflow; (4) Portfolio Manager Review against portfolio budget capacity and strategic alignment; and (5) Convert to Active Budget, where approved estimates automatically become budget line items with cost tracking, weekly spend card generation (W1-W6), and QuickSight dashboard visibility. The Product Owner is the primary operator, while the Portfolio Manager serves as the approval gate ensuring estimates align with organizational priorities before becoming committed budgets.

# Budget Scheduling Product Owners need to own their Monthly budgets that are scheduled from their Annual Approved AWS Budgets. Working with their Portfolio Management, their Monthly Budgets will be Accepted so that all Users understanding spending within the expected Spending Run Rate. Monthly Budgets, can be updated via the Rescheduling Process. Budget Scheduling is FinOps Center's weekly spend governance mechanism that replaces traditional monthly bill shock with granular weekly accountability. Each business week (running Sunday through Saturday, not Monday through Sunday) generates a spend card that follows a clear governance cycle. Product Owners review their weekly spend cards and either accept them (confirming the costs are expected) or dispute them (flagging unexpected charges). Portfolio Managers then approve or reject the spend cards, providing final authority on cost acceptance. The weekly cadence supports up to six weeks per month (W1-W6), with the first week starting on the 1st and ending at the first Saturday midnight. Spend card statuses progress through: Open, Accepted/Disputed (by Product Owner), Approved/Rejected (by Portfolio Manager), and finally Resolved. When a Portfolio Manager locks a budget after approval, Product Owners cannot modify it directly and must request a reschedule, which the Portfolio Manager then approves or denies. The Financial Admin has management oversight visibility into all spend card activity. This weekly governance model ensures cost discrepancies are caught within days rather than discovered at month-end reconciliation. # Create Schedule Product Owners will navigate to their Budget Page and select the Product Budget that they want to schedule.

Within the Budget, Complete Schedule

Once Schedule is Completed, Product Owner Submit for Approvals and see the Budget Status as Pending.

# Approve/Reject Budget A submitted Budget will then be sent to the Portfolio User to Approve or Reject. From their Summary Page they will see they have a Budget Task to take action.

From the Budget Page, the Portfolio Owner will be guided to the Budget Requiring Action.

Porfolio Owner select and Take Action to Approve/Reject Budget Schedule

Upon Approval, the Budget Card will show approved for both Product and Portfolio User.

# Request Reschedule As new Workload are added to Budgets, Monthly Schedules will need to be updated through a 2 Step Process. First there is a Request to Reschedule the Budget by the Product Owner.

# Budgets with Rollups FinOps Center budgets Rollup through Roles and User Based on their Financial Scope. For Budgets to be shown with Variance they must have Status **Approved.** The Product Budget Status show the Product Budget Status.

Additionally the Reporting -> Variance Report shows Variance by Product.

# Financial Admin & Vendor Manager Financial Admin and Vendor Manager Roles have access to all spending data. Within Budgets Tables, their visuals are layered and can be navigated down to the Monthly Schedule per Budget. The Page can be toggled Monthly vs Annual with all visuals updating on selection. The Heat Map Chart on the left scales to the contribution of total spending across the financial scope with the color representing spending to budget. If area is Gray, that individual budget is not approved.

Below the Top Visual are the individual Business Units Spending. To drill down on a Business Unit Select the Details of the Departments

Each Department is visible within the Business Unit with the ability to view Portfolios within that Department

Each Portfolio shows all of the Product Budget with the corresponding Monthly Schedule including the cumulative Workload Estimates.

# Business Unit Business Unit Roles have access to all spending data within the Business Unit(S) the have Financial Scope. Within Budgets Tables, their visuals are layered and can be navigated down to the Monthly Schedule per Budget. The Page can be toggled Monthly vs Annual with all visuals updating on selection. The Heat Map Chart on the left scales to the contribution of total spending across the financial scope with the color representing spending to budget. If area is Gray, that individual budget is not approved.

# Spend Cards for Cost Governance For maximum accountability, customers need their budet owners and their management to actively manage their spending during the billing cycle with approvals in that cycle. With FinOps Center, we introduce the capability for Spend Cards that are created at the end of ever period. Spend Card are created every Monday during the billing month with the last Card being created when the Cost and Usage Report includes the AWS Monthly invoice number indicating that the Billing Cycle has been finalized. # Product Owners Spend Cards are created every Monday. Each Product Owner will see their Cards to Approve or Dispute

Status will Change once Action is taken.

# Portfolio Users To insure that their is oversight on Spending, Portfolio Owners need to Approve, Reject Accepted Cards and Resolve Rejected. While Spend Cards are Open, Portfolio have no Action

Portfolio Owner need to Approve, Reject, or Resolve Submitted Spend Cards

# Management Users Management Users (Financial Admins, Vendor Management, Business Unit, & Department) can monitor the Cards in their Financial Scope with the capability to identify the Product and Portfolio Users that own the Card Approvals.

# Savings Management FinOps Center leverages AWS Cost Optimization Hub(CoH) Recommendations via Data Exports. CoH Data is integrated into FinOps Center and made available to Finance CCoE and Vendor Management Users to Approve or Ignore the Recommendations with Top Optimizations presended on Summary Page.

Financial Admins and Vendor Management make Approval and Ignore decisions on which Recommendations are to be Implemented by Cloud Engineers.

Cloud Engineers view the Recommendations that they are to take action on and then Mark that the Approved Recommendation has been taken action on and then mark as Implemented.

# AWS Credit Allocation Adding and Managing AWS Credits can be very time consuming to FinOps teams. Customers are awarded credits aligned to a new AWS PoC or aligned to programs like the Migration Acceleration Program (MAP). FinOps Center enables Financial Admins and Vendor Management to add Credits to be tracked for accrual at a Budget Level.

When a new Credit is available, the Financial Admin or VM add with the Credit information to FinOps Center

The Credit and Balance are available to users within Spaces and accounted for during the Month Close Process.

# Month Close At the end of each Bill Period, Approved Spending needs to be integrated back to Core Financial Systems to both Pay your AWS Bill and Accrue Spending to Budgetary systems for FP\&A or other KPI reconciliation. To Create File, the Venofr, PO, Invoice, and Internal Memo must be complete. FinOps Center generates the Account Payable Files for integration at the E1 Level (Default Business Unit). Note: Credits are applied for all of the Credits applied by AWS to your Cloud Estate within the CUR.

FinOps Center generates Budget level Accruals with Credits applied witihin FinOps Center.

# Personas/Roles Activities As of FinOps Center 25.2.0, FinOps Center has 7 roles with specific Daily, Weekly, and Monthly Activies.

# Financial Admin Financial Admins are the primary managers of the AWS Cloud Estate. View Application * All Financial Scope Amazon Q in QuickSight Topics / CUDOS Access * Topics: AWS Vendor, AWS Spending * CUDOS Daily Activities * Adding/modifying Budgets * Adding/modifying Users to Budgets * Adding/modifying AWS Account Allocation to Budgets * Adding AWS Credits to Budgets * Claiming/Unclaiming Resources to Workloads * Adding QuickSight Dashbaords/Topics * Monitoring Spending to Budgets * Approves/Ignore Cost Recommendations Weekly Activities * Monitoring Spend Approvals Monthly * Close Month * Download/Upload AP and FP\&A Files # Vendor Manager Vendor Manager Role deals around Buying and Discounts Activities. View Application * All Financial Scope Amazon Q in QuickSight Topics / CUDOS Access * Topics: AWS Vendor, AWS Spending * CUDOS Daily Activities * Adding/Modifying Discounts * Adding/Modifying Budgets * Approves/Ignore Spending Recommendations Weekly Activities * Monitoring Spend Approvals # Cloud Engineer Financial Admins are the primary managers of the AWS Cloud Estate. View Application * None Amazon Q in QuickSight Topics / CUDOS Access * Topics: AWS Vendor, AWS Spending * CUDOS Daily Activities * Add/Manage Users * Add initial AWS Account Allocation to Budgets * Claiming/Unclaiming Resources to Workloads * Adding QuickSight Dashbaords/Topics * Makes Cost Reommendations Platform Updates Weekly Activities * Monitoring Spend Approvals Monthly * Close Month * Download/Upload AP and FP\&A Files # Business Unit Owner Business Unit Owners can manage one or multiple BUs. View Application * Financial Scope in Business Unit(s) Amazon Q in QuickSight Topics / CUDOS Access * Topics: AWS Spending - Business Unit Daily Activities * Monitoring Spending to Budgets Weekly Activities * Monitoring Spend Approvals Monthly * Download FP\&A Files for Business # Department Owner Department Owners can manage one or multiple Departmentss. View Application * Financial Scope of Department(s) Amazon Q in QuickSight Topics / CUDOS Access * Topics: AWS Spending - Department Daily Activities * Monitoring Spending to Budgets Weekly Activities * Monitoring Spend Approvals # Portfolio Owner Portfolio Owners can manage one or multiple Portfolios. View Application * All Financial Scope within Portfolios Amazon Q in QuickSight Topics / CUDOS Access * Topics: AWS Spending - Portfolio Daily Activities * Approve/Reject Budget Schedules Weekly Activities * Approve/Reject Spend Cards Submissions # Product Owner Product Owners can manage one or multiple Products. View Application * All Financial Scope within Portfolios Amazon Q in QuickSight Topics / CUDOS Access * Topics: AWS Spending - Product Daily Activities * Create/Modify Budget * Create Workload * Claim/Unclaim Resources Weekly Activities * Approve/Reject Spend Cards # Support Customer Support is initiated via [https://www.](https://www.finopscenter.com/support)cloudscal3.com (footer) Support Tiers | Tier | Method | SLA | Pricing | | ----------------- | ----------------------- | --------------------------------------- | ----------------------------- | | Free Trial | Blogs | N/A | Free | | Subscription | Emails and Web | <8Hrs during EST Business Hours 8AM-6PM | With Marketplace Subscription | | Business Critical | Direct Customer Success | <2Hrs during EST Business Hours 8AM-6PM | Contact Sales | # Agent Bill Amazon QuickChat for FinOps Center **Agent Bill** Agent Bill is the AI layer inside FinOps Center that makes AWS cost management accessible to every team in your organization — in plain language, without the AWS Console, without raising a ticket, and without waiting for someone technical to get back to you. {% embed url="" %} ### What Agent Bill Does AWS cost management has always required a technical intermediary. A Product Owner who wants to know if their workload is on budget has to ask a Cloud Engineer. A Finance Admin who needs to understand what drove a cost spike has to wait for a FinOps specialist to pull and interpret Cost Explorer data. A VP who wants a spending update gets a spreadsheet built the night before. Agent Bill removes that dependency. As an embedded AI assistant inside every FinOps Center workspace, Agent Bill understands your organization's specific context — your AWS account structure, your budget hierarchy, your team names, your cost allocation tags, and your commercial agreements. When a user asks a question, Agent Bill doesn't return generic AWS data. It returns an answer scoped to that user's role, their accounts, and their budgets — automatically. *** ### Who Agent Bill Is For Agent Bill is not a tool for Cloud Engineers. Cloud Engineers already have AWS Console access and Cost Explorer. Agent Bill is built for the people who don't have that access — and shouldn't need it to do their jobs. | Persona | What Agent Bill gives them | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------- | | **Finance Admin** | Real-time answers about spend vs. budget, chargeback status, and month-end close readiness — without waiting for a report | | **Product Owner** | Workload-specific cost visibility, tier-level breakdowns, and AI component spend — in plain language, on demand | | **Department Manager** | Budget tracking and trend answers scoped to their department — without navigating the AWS Console | | **Business Unit Leader** | Cross-account spend summaries and budget status for their entire business unit — self-service | | **Portfolio Manager** | Rolled-up spend visibility across all products and teams in their portfolio | | **VP / Executive** | Plain-language spending summaries and commitment tracking for management reporting | *** ### What You Can Ask Agent Bill Agent Bill is designed to answer the questions your teams ask most — and the ones they've stopped asking because getting an answer was too hard. #### Finance & Budget Questions * *"Which workloads are over budget this month?"* * *"What is our current spend vs. budget across all accounts?"* * *"How much have we spent against our annual AWS commitment?"* * *"Which cost centers have the highest variance from forecast this month?"* * *"Is our month-end close data ready for the AP file?"* #### Workload & Product Questions * *"How much did my application cost to run last week?"* * *"What's driving the cost increase in the database tier this month?"* * *"How much did my AI components cost in March vs. February?"* * *"Which of my environments — Dev, Test, or Prod — is spending the most?"* * *"Am I on track against my quarterly budget?"* #### AI & Bedrock Questions * *"How much have we spent on Amazon Bedrock this month?"* * *"Which model is consuming the most tokens across our workloads?"* * *"What is the cost per request for my Bedrock integration?"* * *"Which team is driving the most AI spend?"* #### Management & Reporting Questions * *"Give me a summary of AWS spending this month for my management report."* * *"How does this month's spend compare to last month?"* * *"Which product teams are on track and which are at risk?"* * *"What is our projected spend for the end of the month?"* * *"How are we tracking against our Savings Plans commitments?"* *** ### How Agent Bill Knows Your Data Agent Bill is not a generic AI assistant. It is scoped entirely to your organization's FinOps Center environment. This means: **It knows your structure.** Agent Bill understands your AWS account hierarchy, your budget structure, and how accounts map to teams, products, and business units — because that structure is configured in FinOps Center. **It uses your naming conventions.** When you ask about "the Payments application" or "the US East team," Agent Bill recognizes those names because they are your names — not generic AWS service names. **It only shows you your data.** Every user's Agent Bill experience is scoped to their role and their accounts through Row Level Security. A Product Owner asking about "my workload" sees only their workload's data. A Finance Admin sees organization-wide data. A Department Manager sees only their department. No configuration is required from the user — it is automatic. **It understands your budget context.** Questions about budget status are answered against your actual budget targets set in FinOps Center — not against AWS service limits or generic thresholds. *** ### What Agent Bill Is Not Understanding the boundaries of Agent Bill helps set the right expectations for your users. **Agent Bill is not a real-time cost alert system.** It answers questions based on FinOps Center's data refresh cycle. For real-time anomaly alerting, use the FinOps Center budget alert and anomaly detection workflows. **Agent Bill does not execute actions.** In its current implementation, Agent Bill answers questions and surfaces insights. Actions — budget approvals, savings plan purchases, optimization ticket creation — are taken through the FinOps Center workflow layer. **Agent Bill does not have access to data outside FinOps Center.** It cannot query systems outside your FinOps Center environment — ERP systems, ITSM tools, or external financial systems — unless that data has been integrated into FinOps Center. *** ### How Agent Bill Is Configured Agent Bill's capabilities are determined by how FinOps Center is configured for your organization. The richer your FinOps Center setup — budget hierarchy, cost allocation tags, account-to-team mapping, persona workspaces — the more specific and useful Agent Bill's answers will be. The Functional section of this documentation covers the configuration steps that shape Agent Bill's behavior: * **Quick Topics** — the pre-built question libraries available to each persona * **QuickChat Personas** — how Agent Bill's data scope is configured per role * **Custom Instructions** — how to tailor Agent Bill's responses to your organization * **Row Level Security** — how data scoping per persona is enforced * **Dataset Calculated Fields** — how custom metrics are surfaced in Agent Bill responses * **Forecasting** — how Agent Bill answers forward-looking cost questions * **Persona Instructions Guide** — how to optimize Agent Bill prompts per role *** ### Getting the Most From Agent Bill A few principles that help users get better answers: **Be specific about scope.** "What did we spend?" is harder for Agent Bill to answer usefully than "What did the Payments application spend in March?" The more context in the question, the more precise the answer. **Use your organization's naming conventions.** Agent Bill recognizes the team names, account names, and application names configured in your FinOps Center environment. Use those names in your questions. **Ask follow-up questions.** Agent Bill maintains context within a session. If the first answer raises a new question, ask it — Agent Bill will use the context of the prior exchange to give a more relevant answer. **If an answer seems incomplete, check the data refresh.** Agent Bill answers are based on the most recent FinOps Center data refresh. If you are asking about very recent activity, confirm the dataset has refreshed before escalating. *** ### Next Steps → Quick Topics — See the pre-built question libraries available per persona → QuickChat Personas — Understand how Agent Bill's data scope is configured per role → Persona Instructions Guide — Optimize Agent Bill for each persona in your organization → Row Level Security — Configure data scoping so every user sees only their data # Functional Agent Bill is the embedded Data Assistant to FinOps Center that leverages Amazon Q in QuickSight.

# Quick Topics Agent Bill 2.0 uses 4 QuickSight Topics as its semantic data layer. Each topic defines a set of fields (dimensions and measures) with friendly names, synonyms, and default aggregations that Agent Bill uses to answer user queries. Topics are assigned to roles via the persona instruction system — not all roles have access to all topics. When a user asks about a topic they don't have access to, Agent Bill redirects them to the FinOps team. The Cost Management topic is the primary (default) topic for all roles. The table below shows which topics are available to each role, followed by detailed field definitions for each topic. Topics for Roles within Quick Chat Personas


Role	Scope	Topics
E4 Product Owner	Product	Cost Management, Container
E3 Portfolio Owner	Portfolio	Cost Management, Container
E2 Department Owner	Department	Cost Management only
E1 Business Unit Owner	Business Unit	Cost Management, Container, Savings Plans, Marketplace
Financial Admin/FinOps, Vendor Management	Cloud Estate	Cost Management, Container, Savings Plans, Marketplace


Topic	Field Name	Type	Friendly Name	Include	Suggest	Default Aggregation	Non Additive	Format	Synonyms
Cost Management	cost	Measure	Total Cost	Yes	Yes	Sum	No	Currency	spend, spending, how much, what did we spend, total spend, expenditure, price, expense
Cost Management	usage_date	Dimension	Usage Date	Yes	Yes				date, when, period, month
Cost Management	aws_product	Dimension	AWS Product	Yes	Yes				aws service, service name, cloud service, resource
Cost Management	service	Dimension	Service	Yes	Yes				aws service code, service code
Cost Management	account_name	Dimension	Account Name	Yes	Yes				account, aws account
Cost Management	element1_id	Dimension	Business Unit	Yes	Yes				bu, division, org, e1
Cost Management	element2_id	Dimension	Department	Yes	Yes				dept, team, e2
Cost Management	element3_id	Dimension	Portfolio	Yes	Yes				program, e3
Cost Management	element4_id	Dimension	Product	Yes	Yes				project, cost center, e4, budget
Cost Management	region	Dimension	Region	Yes	Yes				location, geography, az
Cost Management	charge_type	Dimension	Charge Type	Yes	Yes				charge type
Cost Management	pricing_term	Dimension	Pricing Term	Yes	No				on demand, reserved, spot
Cost Management	instance_type	Dimension	Instance Type	Yes	No				instance size, machine type
Cost Management	product_family	Dimension	Product Family	Yes	No				product family
Cost Management	operation	Dimension	Operation	Yes	No				operation
Cost Management	usage_type	Dimension	Usage Type	Yes	No				usage type
Cost Management	billing_entity	Dimension	Vendor	Yes	No				billing entity, provider, source, seller
Cost Management	spending_type	Dimension	Spending Type	Yes	No				spending type
Cost Management	account_type	Dimension	Account Type	Yes	No				environment, prod, dev
Cost Management	workload	Dimension	Workload	Yes	No				workload
Cost Management	Spending Source	Dimension	Spending Source	Yes	No				aws vs marketplace, source
Cost Management	usage_quantity	Measure	Usage Quantity	Yes	No	Sum	No		usage amount, quantity, consumption
Cost Management	element2map	Dimension		No
Cost Management	element3map	Dimension		No
Cost Management	element4map	Dimension		No
Cost Management	net_cost	Measure		No
Cost Management	unblended_cost	Measure		No
Cost Management	credit	Measure		Yes
Cost Management	fee	Measure		No
Cost Management	tax	Measure		No
Cost Management	ri_fee	Measure		No
Cost Management	discounted_usage	Measure		No
Cost Management	savings_plan_negation	Measure		No
Cost Management	saving_plan_recurring_fee	Measure		No
Cost Management	refund	Measure		No
Cost Management	saving_plan_upfront_fee	Measure		No
Cost Management	distributor_discount	Measure		No
Cost Management	bundled_discount	Measure		No
Cost Management	private_rate_discount	Measure		No
Cost Management	edp_discount	Measure		No
Cost Management	spp_discount	Measure		No
Cost Management	percentage	Measure		No

Topic

Field

Name

Type

Friendly Name

Include

Suggest

Default Aggregation

Non Additive

Format

Synonyms

Cost Management

cost

Measure

Total Cost

Yes

Sum

Currency

spend, spending, how much, what did we spend, total spend, expenditure, price, expense

Cost Management

usage_date

Dimension

Usage Date

Yes

date, when, period, month

Cost Management

aws_product

Dimension

AWS Product

Yes

aws service, service name, cloud service, resource

Cost Management

service

Dimension

Service

Yes

aws service code, service code

Cost Management

account_name

Dimension

Account Name

Yes

account, aws account

Cost Management

element1_id

Dimension

Business Unit

Yes

bu, division, org, e1

Cost Management

element2_id

Dimension

Department

Yes

dept, team, e2

Cost Management

element3_id

Dimension

Portfolio

Yes

program, e3

Cost Management

element4_id

Dimension

Product

Yes

project, cost center, e4, budget

Cost Management

region

Dimension

Region

Yes

location, geography, az

Cost Management

charge_type

Dimension

Charge Type

Yes

charge type

Cost Management

pricing_term

Dimension

Pricing Term

Yes

on demand, reserved, spot

Cost Management

instance_type

Dimension

Instance Type

Yes

instance size, machine type

Cost Management

product_family

Dimension

Product Family

Yes

product family

Cost Management

operation

Dimension

Operation

Yes

operation

Cost Management

usage_type

Dimension

Usage Type

Yes

usage type

Cost Management

billing_entity

Dimension

Vendor

Yes

billing entity, provider, source, seller

Cost Management

spending_type

Dimension

Spending Type

Yes

spending type

Cost Management

account_type

Dimension

Account Type

Yes

environment, prod, dev

Cost Management

workload

Dimension

Workload

Yes

workload

Cost Management

Spending Source

Dimension

Spending Source

Yes

aws vs marketplace, source

Cost Management

usage_quantity

Measure

Usage Quantity

Yes

Sum

usage amount, quantity, consumption

Cost Management

element2map

Dimension

Cost Management

element3map

Dimension

Cost Management

element4map

Dimension

Cost Management

net_cost

Measure

Cost Management

unblended_cost

Measure

Cost Management

credit

Measure

Yes

Cost Management

fee

Measure

Cost Management

tax

Measure

Cost Management

ri_fee

Measure

Cost Management

discounted_usage

Measure

Cost Management

savings_plan_negation

Measure

Cost Management

saving_plan_recurring_fee

Measure

Cost Management

refund

Measure

Cost Management

saving_plan_upfront_fee

Measure

Cost Management

distributor_discount

Measure

Cost Management

bundled_discount

Measure

Cost Management

private_rate_discount

Measure

Cost Management

edp_discount

Measure

Cost Management

spp_discount

Measure

Cost Management

percentage

Measure


Marketplace Spending	Marketplace Total Cost	Measure	Marketplace Total Cost	Yes	Yes	Sum	No	Currency	marketplace spend, third party cost, total marketplace, all marketplace cost, marketplace spending
Marketplace Spending	Marketplace Usage Cost	Measure	Marketplace Usage Cost	Yes	Yes	Sum	No	Currency	marketplace consumption, marketplace api cost, bedrock cost
Marketplace Spending	Marketplace Subscription Cost	Measure	Marketplace Subscription Cost	Yes	Yes	Sum	No	Currency	marketplace subscriptions, saas licenses, marketplace fees, subscription fees
Marketplace Spending	AWS Platform Cost	Measure	AWS Platform Cost	Yes	No	Sum	No	Currency	aws spend, platform spend, native aws cost, first party
Marketplace Spending	Is Third Party	Dimension	Is Third Party	Yes	No				is marketplace, third party
Marketplace Spending	Spending Source	Dimension	Spending Source	Yes	Yes				aws vs marketplace, source, vendor type
Marketplace Spending	legal_entity	Dimension	Vendor Name	Yes	Yes				vendor, marketplace vendor, saas vendor, external vendor, seller name
Marketplace Spending	aws_product	Dimension	Marketplace Product	Yes	Yes				marketplace solution, saas product, third party product
Marketplace Spending	usage_date	Dimension	Usage Date	Yes	Yes				date, when, period
Marketplace Spending	account_name	Dimension	Account Name	Yes	Yes				account
Marketplace Spending	element1_id	Dimension	Business Unit	Yes	Yes				bu, division, e1
Marketplace Spending	element2_id	Dimension	Department	Yes	Yes				dept, team, e2
Marketplace Spending	element3_id	Dimension	Portfolio	Yes	Yes				program, e3
Marketplace Spending	element4_id	Dimension	Product	Yes	Yes				project, cost center, e4
Marketplace Spending	charge_type	Dimension	Charge Type	Yes	No				usage vs fee, charge type
Marketplace Spending	region	Dimension	Region	Yes	No				location

Marketplace Spending

Marketplace Total Cost

Measure

Marketplace Total Cost

Yes

Sum

Currency

marketplace spend, third party cost, total marketplace, all marketplace cost, marketplace spending

Marketplace Spending

Marketplace Usage Cost

Measure

Marketplace Usage Cost

Yes

Sum

Currency

marketplace consumption, marketplace api cost, bedrock cost

Marketplace Spending

Marketplace Subscription Cost

Measure

Marketplace Subscription Cost

Yes

Sum

Currency

marketplace subscriptions, saas licenses, marketplace fees, subscription fees

Marketplace Spending

AWS Platform Cost

Measure

AWS Platform Cost

Yes

Sum

Currency

aws spend, platform spend, native aws cost, first party

Marketplace Spending

Is Third Party

Dimension

Is Third Party

Yes

is marketplace, third party

Marketplace Spending

Spending Source

Dimension

Spending Source

Yes

aws vs marketplace, source, vendor type

Marketplace Spending

legal_entity

Dimension

Vendor Name

Yes

vendor, marketplace vendor, saas vendor, external vendor, seller name

Marketplace Spending

aws_product

Dimension

Marketplace Product

Yes

marketplace solution, saas product, third party product

Marketplace Spending

usage_date

Dimension

Usage Date

Yes

date, when, period

Marketplace Spending

account_name

Dimension

Account Name

Yes

account

Marketplace Spending

element1_id

Dimension

Business Unit

Yes

bu, division, e1

Marketplace Spending

element2_id

Dimension

Department

Yes

dept, team, e2

Marketplace Spending

element3_id

Dimension

Portfolio

Yes

program, e3

Marketplace Spending

element4_id

Dimension

Product

Yes

project, cost center, e4

Marketplace Spending

charge_type

Dimension

Charge Type

Yes

usage vs fee, charge type

Marketplace Spending

region

Dimension

Region

Yes

location


Container Allocation	split_cost	Measure	Container Cost	Yes	Yes	Sum	No	Currency	pod cost, task cost, eks cost, ecs cost, kubernetes cost, container spend
Container Allocation	split_unused_cost	Measure	Container Unused Cost	Yes	Yes	Sum	No	Currency	wasted container cost, unallocated pod cost, idle container cost, unused pod cost
Container Allocation	Container Utilization Rate	Measure	Container Utilization Rate	Yes	Yes	Average	Yes	Percent	pod efficiency, container efficiency, eks utilization, ecs utilization, container usage rate, utilization percentage
Container Allocation	split_usage	Measure	Container Usage	Yes	No	Sum	No		pod usage, task usage, container consumption
Container Allocation	split_actual_usage	Measure	Container Actual Usage	Yes	No	Sum	No		pod actual usage, task actual usage, actual container usage
Container Allocation	split_reserved_usage	Measure	Container Reserved Usage	Yes	No	Sum	No		pod requested usage, container request, task reserved
Container Allocation	Is Container Resource	Dimension	Is Container Resource	Yes	No				is pod, is container, has container data
Container Allocation	split_parent_resource_id	Dimension	Parent Instance	Yes	No				ec2 host, parent ec2, host instance, parent resource
Container Allocation	resourceid	Dimension	Resource ID	Yes	No				pod arn, task arn, resource
Container Allocation	aws_product	Dimension	AWS Product	Yes	Yes				service, eks, ecs
Container Allocation	operation	Dimension	Operation	Yes	Yes				operation, eks operation
Container Allocation	usage_date	Dimension	Usage Date	Yes	Yes				date, when, period
Container Allocation	account_name	Dimension	Account Name	Yes	Yes				account
Container Allocation	workload	Dimension	Workload	Yes	Yes				workload
Container Allocation	element1_id	Dimension	Business Unit	Yes	Yes				bu, division, e1
Container Allocation	element2_id	Dimension	Department	Yes	Yes				dept, team, e2
Container Allocation	element3_id	Dimension	Portfolio	Yes	Yes				program, e3
Container Allocation	element4_id	Dimension	Product	Yes	Yes				project, cost center, e4
Container Allocation	region	Dimension	Region	Yes	No				location

Container Allocation

split_cost

Measure

Container Cost

Yes

Sum

Currency

pod cost, task cost, eks cost, ecs cost, kubernetes cost, container spend

Container Allocation

split_unused_cost

Measure

Container Unused Cost

Yes

Sum

Currency

wasted container cost, unallocated pod cost, idle container cost, unused pod cost

Container Allocation

Container Utilization Rate

Measure

Container Utilization Rate

Yes

Average

Yes

Percent

pod efficiency, container efficiency, eks utilization, ecs utilization, container usage rate, utilization percentage

Container Allocation

split_usage

Measure

Container Usage

Yes

Sum

pod usage, task usage, container consumption

Container Allocation

split_actual_usage

Measure

Container Actual Usage

Yes

Sum

pod actual usage, task actual usage, actual container usage

Container Allocation

split_reserved_usage

Measure

Container Reserved Usage

Yes

Sum

pod requested usage, container request, task reserved

Container Allocation

Is Container Resource

Dimension

Is Container Resource

Yes

is pod, is container, has container data

Container Allocation

split_parent_resource_id

Dimension

Parent Instance

Yes

ec2 host, parent ec2, host instance, parent resource

Container Allocation

resourceid

Dimension

Resource ID

Yes

pod arn, task arn, resource

Container Allocation

aws_product

Dimension

AWS Product

Yes

service, eks, ecs

Container Allocation

operation

Dimension

Operation

Yes

operation, eks operation

Container Allocation

usage_date

Dimension

Usage Date

Yes

date, when, period

Container Allocation

account_name

Dimension

Account Name

Yes

account

Container Allocation

workload

Dimension

Workload

Yes

workload

Container Allocation

element1_id

Dimension

Business Unit

Yes

bu, division, e1

Container Allocation

element2_id

Dimension

Department

Yes

dept, team, e2

Container Allocation

element3_id

Dimension

Portfolio

Yes

program, e3

Container Allocation

element4_id

Dimension

Product

Yes

project, cost center, e4

Container Allocation

region

Dimension

Region

Yes

location


Savings Plans Management	SP Coverage Rate	Measure	SP Coverage Rate	Yes	Yes	Average	Yes	Percent	savings plan coverage, sp utilization, coverage rate, percent covered, how much is covered, sp coverage percentage
Savings Plans Management	SP Savings Amount	Measure	SP Savings Amount	Yes	Yes	Sum	No	Currency	sp savings, how much saved, savings plan savings, dollar savings, amount saved
Savings Plans Management	savings_plan_effective_cost	Measure	SP Effective Cost	Yes	Yes	Sum	No	Currency	sp effective cost, actual sp cost, what we paid, sp cost
Savings Plans Management	savings_plan_coverage	Measure	SP Covered Usage	Yes	Yes	Sum	No	Currency	covered usage, sp covered cost, covered amount
Savings Plans Management	saving_plan_recurring_fee	Measure	SP Recurring Fee	Yes	No	Sum	No	Currency	sp recurring fee, monthly sp fee, sp monthly cost
Savings Plans Management	saving_plan_upfront_fee	Measure	SP Upfront Fee	Yes	No	Sum	No	Currency	sp upfront fee, upfront payment, sp upfront cost
Savings Plans Management	savings_plan_rate	Measure	SP Rate	Yes	No				sp rate, discount rate, sp discount
Savings Plans Management	savings_plan_negation	Measure	SP Negation	Yes	No	Sum	No	Currency	sp negation, sp offset
Savings Plans Management	cost	Measure	On-Demand Cost	Yes	No	Sum	No	Currency	base cost, cost without sp, on demand cost
Savings Plans Management	Is SP Covered	Dimension	Is SP Covered	Yes	Yes				has savings plan, is covered, using sp, sp covered
Savings Plans Management	savings_plan_a_r_n	Dimension	Savings Plan ARN	Yes	No				sp arn, savings plan id, sp identifier
Savings Plans Management	savings_plan_payment_option	Dimension	SP Payment Option	Yes	Yes				payment option, all upfront, partial upfront, no upfront, payment type
Savings Plans Management	savings_plan_offering_type	Dimension	SP Offering Type	Yes	Yes				sp type, compute sp, ec2 sp, offering type
Savings Plans Management	savings_plan_purchase_term	Dimension	SP Purchase Term	Yes	Yes				sp term, 1 year, 3 year, term length
Savings Plans Management	charge_type	Dimension	Charge Type	Yes	No				charge type
Savings Plans Management	usage_date	Dimension	Usage Date	Yes	Yes				date, when, period
Savings Plans Management	service	Dimension	Service	Yes	Yes				aws service, service code
Savings Plans Management	aws_product	Dimension	AWS Product	Yes	Yes				aws service name, product
Savings Plans Management	account_name	Dimension	Account Name	Yes	Yes				account
Savings Plans Management	region	Dimension	Region	Yes	No				location
Savings Plans Management	element1_id	Dimension	Business Unit	Yes	Yes				bu, division, e1
Savings Plans Management	element2_id	Dimension	Department	Yes	Yes				dept, team, e2
Savings Plans Management	element3_id	Dimension	Portfolio	Yes	Yes				program, e3
Savings Plans Management	element4_id	Dimension	Product	Yes	Yes				project, cost center, e4

Savings Plans Management

SP Coverage Rate

Measure

SP Coverage Rate

Yes

Average

Yes

Percent

savings plan coverage, sp utilization, coverage rate, percent covered, how much is covered, sp coverage percentage

Savings Plans Management

SP Savings Amount

Measure

SP Savings Amount

Yes

Sum

Currency

sp savings, how much saved, savings plan savings, dollar savings, amount saved

Savings Plans Management

savings_plan_effective_cost

Measure

SP Effective Cost

Yes

Sum

Currency

sp effective cost, actual sp cost, what we paid, sp cost

Savings Plans Management

savings_plan_coverage

Measure

SP Covered Usage

Yes

Sum

Currency

covered usage, sp covered cost, covered amount

Savings Plans Management

saving_plan_recurring_fee

Measure

SP Recurring Fee

Yes

Sum

Currency

sp recurring fee, monthly sp fee, sp monthly cost

Savings Plans Management

saving_plan_upfront_fee

Measure

SP Upfront Fee

Yes

Sum

Currency

sp upfront fee, upfront payment, sp upfront cost

Savings Plans Management

savings_plan_rate

Measure

SP Rate

Yes

sp rate, discount rate, sp discount

Savings Plans Management

savings_plan_negation

Measure

SP Negation

Yes

Sum

Currency

sp negation, sp offset

Savings Plans Management

cost

Measure

On-Demand Cost

Yes

Sum

Currency

base cost, cost without sp, on demand cost

Savings Plans Management

Is SP Covered

Dimension

Is SP Covered

Yes

has savings plan, is covered, using sp, sp covered

Savings Plans Management

savings_plan_a_r_n

Dimension

Savings Plan ARN

Yes

sp arn, savings plan id, sp identifier

Savings Plans Management

savings_plan_payment_option

Dimension

SP Payment Option

Yes

payment option, all upfront, partial upfront, no upfront, payment type

Savings Plans Management

savings_plan_offering_type

Dimension

SP Offering Type

Yes

sp type, compute sp, ec2 sp, offering type

Savings Plans Management

savings_plan_purchase_term

Dimension

SP Purchase Term

Yes

sp term, 1 year, 3 year, term length

Savings Plans Management

charge_type

Dimension

Charge Type

Yes

charge type

Savings Plans Management

usage_date

Dimension

Usage Date

Yes

date, when, period

Savings Plans Management

service

Dimension

Service

Yes

aws service, service code

Savings Plans Management

aws_product

Dimension

AWS Product

Yes

aws service name, product

Savings Plans Management

account_name

Dimension

Account Name

Yes

account

Savings Plans Management

region

Dimension

Region

Yes

location

Savings Plans Management

element1_id

Dimension

Business Unit

Yes

bu, division, e1

Savings Plans Management

element2_id

Dimension

Department

Yes

dept, team, e2

Savings Plans Management

element3_id

Dimension

Portfolio

Yes

program, e3

Savings Plans Management

element4_id

Dimension

Product

Yes

project, cost center, e4

# QuickChat Personas **Agent Bill uses role-based QuickChat personas to deliver tailored AI assistance to each user type in FinOps Center. Each persona is implemented as a dedicated QuickSight Chat Agent with its own agent ID, view ID, and QuickSight user group. The persona instruction system controls which topics are available to each role, how queries are routed (data queries via Q Topics, workflow actions via MCP Server, or combined), and what business context is provided to the AI.** **There are 6 QuickSight user groups, each mapped to a dedicated chat agent:** * financial\_admins-access-group — All topics (Cost Management, Container Allocation, Marketplace Spending, Savings Plans Management) plus full credits visibility * bu\_managers-access-group — Cost Management only, business unit scope, no credits * department\_managers-access-group — Cost Management + Container Allocation, department scope * portfolio\_managers-access-group — Cost Management + Container Allocation, portfolio scope * product\_leads-access-group — Cost Management + Container Allocation, product scope, MCP actions (accept spend cards, submit budgets) * cloud\_engineers-access-group — Cost Management + Container Allocation, MCP actions (claim resources, implement optimizations) Sharing requirement: At every step of the Agent Bill setup pipeline (dataset, topic, space, chat agent, embedded chat), you must share with the appropriate QuickSight user group. Failing to share at any step will result in the persona not being available to that role. **Financial Admins** **Agent Identity** ``` You are assisting a FinOps Leader who has full visibility into cloud spending, credits, savings plans, container costs, and marketplace spending across the entire organization. They need comprehensive cost analysis across all dimensions and have access to all financial details including credits and discounts. ``` **Persona Instruction** ``` ==================================================================== TOPIC ROUTING (CRITICAL) ==================================================================== - DEFAULT to "Cost Management" for all general spending/cost questions - ONLY use "Container Allocation" when user explicitly mentions: container, pod, task, EKS, ECS, Kubernetes, k8s - ONLY use "Marketplace Spending" when user explicitly mentions: marketplace, third party, SaaS, vendor, external software - ONLY use "Savings Plans Management" when user explicitly mentions: savings plan, SP coverage, SP savings, commitment, reserved capacity Do NOT mix topics unless explicitly requested. Each topic has its own cost fields. ==================================================================== COST MANAGEMENT TOPIC ==================================================================== PRIMARY METRICS: Total Cost, AI Cost COST FIELDS: - "Total Cost" is the primary metric for ALL general spending questions - "AI Cost" is for AI/Bedrock specific questions (automatically excludes non-AI spend) - You have full visibility across all Business Units, Departments, Portfolios, and Products CREDITS HANDLING (CRITICAL): - By DEFAULT, never include or mention credits unless the user explicitly asks - "Total Cost" is ALWAYS the answer for spending questions - do NOT subtract credits - Credits are a SEPARATE concept from spending/cost WHEN TO IGNORE CREDITS (most questions): - "What's my cost?" → Total Cost only, do NOT mention credits - "Spending by department" → Total Cost only - "How much did we spend?" → Total Cost only - "Cost trend this month" → Total Cost only WHEN TO INCLUDE CREDITS (only if user explicitly asks): - "What are my credits?" → Show Credits field - "Cost after credits" → Show Total Cost + Credits - "Net cost" → Show Total Cost + Credits - "What credits did we receive?" → Show Credits field - "Credit source" or "where did credits come from" → Show Credit Source field CREDIT RESPONSE FORMAT (when explicitly asked): - Credits are negative values (they reduce the bill) - Credit Source shows the description/reason for each credit - When showing credits: "Credits of -$X reduce your bill" - When showing net cost: "Total Cost ($X) + Credits (-$Y) = Net Cost ($Z)" NEVER proactively mention credits unless user explicitly uses words like: credits, net cost, after credits, credit source AI / BEDROCK QUERIES: - "AI cost" or "Bedrock cost" = use AI Cost field - "Claude cost" = filter Aws Product containing "Claude" - "Nova cost" = filter Aws Product containing "Nova" - "Anthropic cost" = filter Vendor Name = "Anthropic, PBC" - "by model" = group by Aws Product, filter to AI - "AI cost by business unit" = use AI Cost, group by Business Unit - "AI cost by department" = use AI Cost, group by Department TOKEN ANALYSIS: - "input tokens" or "prompt cost" = filter Token Type = Input - "output tokens" or "response cost" = filter Token Type = Output - "cache write" = filter Token Type = Cache Write - "cache read" or "cached tokens" = filter Token Type = Cache Read - "input vs output" = group by Token Type - Cache Write = tokens written to prompt cache (higher cost) - Cache Read = tokens read from prompt cache (lower cost) AI OPERATION ANALYSIS: - "inference cost" = filter AI Operation Type = Inference - "guardrail cost" = filter AI Operation Type = Guardrail - "knowledge base cost" = filter AI Operation Type = Knowledge Base - "training cost" = filter AI Operation Type = Training (SageMaker) - "by operation type" = group by AI Operation Type AI REGION ANALYSIS: - "global vs regional" or "region type" = group by AI Region Type - "Global (Cross-Region)" = using cross-region inference (standard rate) - "Regional (Hardcoded)" = hardcoded to specific region (~10% higher cost) - Use this to identify cost optimization opportunities TIME INTERVAL QUERIES: - "by hour" or "hourly breakdown" = group by Hour of Day - "between X and Y" = filter by Usage Start Time - "morning" = Hour of Day 6-11 - "afternoon" = Hour of Day 12-17 - "evening" = Hour of Day 18-23 - "overnight" or "night" = Hour of Day 0-5 - "business hours" = Hour of Day 9-17 - "off hours" = Hour of Day 0-8 and 18-23 AI TIME ANALYSIS: - "AI cost by hour" = use AI Cost, group by Hour of Day - "peak AI usage hours" = group by Hour of Day, sort by AI Cost descending AI DATA FRESHNESS: - AI cost data updates 2-3x daily; not real-time - For "today's" AI cost, data may be 4-8 hours delayed ==================================================================== CONTAINER ALLOCATION TOPIC ==================================================================== PRIMARY METRIC: Container Cost USE ONLY WHEN user mentions: container, pod, task, EKS, ECS, Kubernetes, k8s CONTAINER FIELDS: - "Container Cost" = allocated cost for EKS pods or ECS tasks - "Container Unused Cost" = unallocated/wasted container capacity - "Container Utilization Rate" = efficiency percentage (0-100%) - "Parent Instance" = EC2 host running the containers CONTAINER QUERIES: - "pod cost" or "task cost" = Container Cost - "wasted container cost" or "idle cost" = Container Unused Cost - "container efficiency" or "utilization" = Container Utilization Rate - "container cost by business unit" = group by Business Unit - "container cost by department" = group by Department - "which department has lowest utilization" = group by Department, sort by Container Utilization Rate IMPORTANT: - Container Cost is SEPARATE from Total Cost - do not combine - Only resources with EKS/ECS workloads will show container data ==================================================================== MARKETPLACE SPENDING TOPIC ==================================================================== PRIMARY METRIC: Marketplace Total Cost USE ONLY WHEN user mentions: marketplace, third party, SaaS, vendor, external software MARKETPLACE FIELDS: - "Marketplace Total Cost" = all third-party software spending - "Marketplace Usage Cost" = consumption-based charges (API calls, usage) - "Marketplace Subscription Cost" = license fees, subscriptions - "Vendor Name" = third-party vendor (legal entity) - "Is Third Party" = Yes/No flag MARKETPLACE QUERIES: - "marketplace spend" or "third party cost" = Marketplace Total Cost - "SaaS subscriptions" or "license fees" = Marketplace Subscription Cost - "Bedrock consumption" or "API costs" = Marketplace Usage Cost - "vendor breakdown" or "by vendor" = group by Vendor Name IMPORTANT: - Marketplace costs are SEPARATE from AWS Platform costs - Some products have both Usage and Fee charges ==================================================================== SAVINGS PLANS MANAGEMENT TOPIC ==================================================================== PRIMARY METRICS: SP Coverage Rate, SP Savings Amount USE ONLY WHEN user mentions: savings plan, SP coverage, SP savings, commitment, reserved SAVINGS PLAN FIELDS: - "SP Coverage Rate" = percentage of eligible usage covered (target 70-90%) - "SP Savings Amount" = dollars saved vs on-demand pricing - "SP Effective Cost" = actual cost after discount - "Is SP Covered" = Yes/No flag SAVINGS PLAN QUERIES: - "savings plan coverage" = SP Coverage Rate - "how much did we save" = SP Savings Amount - "which services are covered" = group by Service, filter Is SP Covered = Yes - "uncovered usage" = filter Is SP Covered = No IMPORTANT: - SP Coverage Rate is a percentage - SP Savings Amount is in dollars - Do not combine SP metrics with general Total Cost ==================================================================== TERMINOLOGY ==================================================================== ORGANIZATIONAL HIERARCHY: - Business Unit = Element 1 (E1) - top level - Department = Element 2 (E2) - Portfolio = Element 3 (E3) - Product = Element 4 (E4) - most granular YOUR SCOPE: - Full visibility across all organizational levels - Can drill down from Business Unit to Product - Can see all cost types including credits and discounts COMMON TERMS: - "resource" = AWS resource (NOT container unless specified) - "Vendor" = AWS or AWS Marketplace - "service" = AWS service code (AmazonEC2, AmazonS3, etc.) - "Aws Product" = friendly service/product name ==================================================================== RESPONSE GUIDELINES ==================================================================== - Always specify time period in responses - Default to current month if no date specified - Show costs in USD - Use ONLY the relevant topic for the question - Do NOT mention credits unless explicitly asked - For percentage metrics (SP Coverage Rate, Container Utilization), show as % - Provide strategic insights across the organization - Proactively offer drill-down options ==================================================================== WEEK DEFINITIONS ==================================================================== CRITICAL RULE: All weeks run SUNDAY to SATURDAY. WEEK LOOKUP RULE: - Do NOT calculate week dates - use exact dates from definitions below - "3rd week of January 2026" = EXACTLY January 11-17 JANUARY 2026: - Week 1 = Jan 1-3 (partial) - Week 2 = Jan 4-10 - Week 3 = Jan 11-17 - Week 4 = Jan 18-24 - Week 5 = Jan 25-31 FEBRUARY 2026: - Week 1 = Feb 1-7 - Week 2 = Feb 8-14 - Week 3 = Feb 15-21 - Week 4 = Feb 22-28 ``` **Business Unit (E4)** **Agent Idenity** ``` You are assisting a Business Unit Owner who manages cloud spending for their assigned Business Unit(s). All data is pre-filtered to show only their Business Unit-level costs. They can see breakdown by Department (E2), Portfolio (E3), and Product (E4) within their Business Unit and need visibility into spending trends and AI costs at a strategic level. ``` **Persona Instruction** ``` ==================================================================== TOPIC ROUTING (CRITICAL) ==================================================================== - Use "Cost Management" for ALL questions - This is the ONLY topic available UNAVAILABLE TOPICS: - Container Allocation - Not available. If asked, explain this is managed by Platform/DevOps teams. - Marketplace Spending - Not available. If asked, explain this is managed by the FinOps team. - Savings Plans Management - Not available. If asked, explain this is managed by the FinOps team. ==================================================================== COST MANAGEMENT TOPIC ==================================================================== PRIMARY METRICS: Total Cost, AI Cost COST FIELDS: - "Total Cost" is the primary metric for ALL general spending questions - "AI Cost" is for AI/Bedrock specific questions (automatically excludes non-AI spend) - All data is pre-filtered to your Business Unit(s) - you see only your costs DRILL-DOWN CAPABILITY: - You can break down costs by Department (E2), Portfolio (E3), and Product (E4) - "cost by department" = shows spending by each Department in your Business Unit - "cost by portfolio" = shows spending by each Portfolio - "cost by product" = shows spending by each Product - Use this to identify which Departments/Portfolios/Products are driving costs IMPORTANT - NO CREDITS: - Credits information is not available in this view - If asked about credits, explain: "Credit details are managed by the FinOps team. Please contact them for credit information." - Do NOT attempt to show or calculate credits AI / BEDROCK QUERIES: - "AI cost" or "Bedrock cost" = use AI Cost field - "Claude cost" = filter Aws Product containing "Claude" - "Nova cost" = filter Aws Product containing "Nova" - "Anthropic cost" = filter Vendor Name = "Anthropic, PBC" - "by model" = group by Aws Product, filter to AI - "AI cost by department" = use AI Cost, group by Department - "AI cost by portfolio" = use AI Cost, group by Portfolio - "AI cost by product" = use AI Cost, group by Product TOKEN ANALYSIS: - "input tokens" or "prompt cost" = filter Token Type = Input - "output tokens" or "response cost" = filter Token Type = Output - "cache write" = filter Token Type = Cache Write - "cache read" or "cached tokens" = filter Token Type = Cache Read - "input vs output" = group by Token Type - Cache Write = tokens written to prompt cache (higher cost) - Cache Read = tokens read from prompt cache (lower cost) AI OPERATION ANALYSIS: - "inference cost" = filter AI Operation Type = Inference - "guardrail cost" = filter AI Operation Type = Guardrail - "knowledge base cost" = filter AI Operation Type = Knowledge Base - "by operation type" = group by AI Operation Type TIME INTERVAL QUERIES: - "by hour" or "hourly breakdown" = group by Hour of Day - "between X and Y" = filter by Usage Start Time - "morning" = Hour of Day 6-11 - "afternoon" = Hour of Day 12-17 - "evening" = Hour of Day 18-23 - "overnight" or "night" = Hour of Day 0-5 - "business hours" = Hour of Day 9-17 - "off hours" = Hour of Day 0-8 and 18-23 AI REGION ANALYSIS: - "global vs regional" or "region type" = group by AI Region Type - "Global (Cross-Region)" = using cross-region inference (standard rate) - "Regional (Hardcoded)" = hardcoded to specific region (~10% higher cost) - Use this to identify cost optimization opportunities AI TIME ANALYSIS: - "AI cost by hour" = use AI Cost, group by Hour of Day - "peak AI usage hours" = group by Hour of Day, sort by AI Cost descending - "AI cost by department by hour" = use AI Cost, group by Department and Hour of Day AI DATA FRESHNESS: - AI cost data updates 2-3x daily; not real-time - For "today's" AI cost, data may be 4-8 hours delayed ==================================================================== TERMINOLOGY ==================================================================== ORGANIZATIONAL HIERARCHY: - Business Unit = Element 1 (E1) - YOUR level - Department = Element 2 (E2) - you can drill down to this - Portfolio = Element 3 (E3) - you can drill down to this - Product = Element 4 (E4) - you can drill down to this YOUR SCOPE: - All data is pre-filtered to your Business Unit(s) - "Total cost" means YOUR Business Unit's total cost - You CAN see breakdown by Department, Portfolio, and Product - You cannot see other Business Units COMMON TERMS: - "resource" = AWS resource - "service" = AWS service code (AmazonEC2, AmazonS3, etc.) - "Aws Product" = friendly service/product name ==================================================================== RESPONSE GUIDELINES ==================================================================== - Always specify time period in responses - Default to current month if no date specified - Show costs in USD - Offer Department, Portfolio, and Product-level breakdown when relevant - Highlight which Departments are driving cost changes - Provide strategic insights appropriate for executive-level review - Do NOT mention credits - they are not available in this view ==================================================================== WEEK DEFINITIONS ==================================================================== CRITICAL RULE: All weeks run SUNDAY to SATURDAY. WEEK LOOKUP RULE: - Do NOT calculate week dates - use exact dates from definitions below - "3rd week of January 2026" = EXACTLY January 11-17 JANUARY 2026: - Week 1 = Jan 1-3 (partial) - Week 2 = Jan 4-10 - Week 3 = Jan 11-17 - Week 4 = Jan 18-24 - Week 5 = Jan 25-31 FEBRUARY 2026: - Week 1 = Feb 1-7 - Week 2 = Feb 8-14 - Week 3 = Feb 15-21 - Week 4 = Feb 22-28 ``` **Department (E3)** **Agent Identity** ``` You are assisting a Department Owner who manages cloud spending and container costs for their assigned Department(s). All data is pre-filtered to show only their Department-level costs. They can see breakdown by Portfolio (E3) and Product (E4) within their Department and need visibility into spending trends, AI costs, and container efficiency. ``` **Persona Instruction** ``` ==================================================================== TOPIC ROUTING (CRITICAL) ==================================================================== - DEFAULT to "Cost Management" for all spending/cost questions - ONLY use "Container Allocation" when user explicitly mentions: container, pod, task, EKS, ECS, Kubernetes, k8s Do NOT mix topics. Each topic has its own cost fields. UNAVAILABLE TOPICS: - Marketplace Spending - Not available. If asked, explain this is managed by the FinOps team. - Savings Plans Management - Not available. If asked, explain this is managed by the FinOps team. ==================================================================== COST MANAGEMENT TOPIC ==================================================================== PRIMARY METRICS: Total Cost, AI Cost COST FIELDS: - "Total Cost" is the primary metric for ALL general spending questions - "AI Cost" is for AI/Bedrock specific questions (automatically excludes non-AI spend) - All data is pre-filtered to your Department(s) - you see only your costs DRILL-DOWN CAPABILITY: - You can break down costs by Portfolio (E3) and Product (E4) - "cost by portfolio" = shows spending by each Portfolio in your Department - "cost by product" = shows spending by each Product - Use this to identify which Portfolios/Products are driving costs IMPORTANT - NO CREDITS: - Credits information is not available in this view - If asked about credits, explain: "Credit details are managed by the FinOps team. Please contact them for credit information." - Do NOT attempt to show or calculate credits AI / BEDROCK QUERIES: - "AI cost" or "Bedrock cost" = use AI Cost field - "Claude cost" = filter Aws Product containing "Claude" - "Nova cost" = filter Aws Product containing "Nova" - "Anthropic cost" = filter Vendor Name = "Anthropic, PBC" - "by model" = group by Aws Product, filter to AI - "AI cost by portfolio" = use AI Cost, group by Portfolio - "AI cost by product" = use AI Cost, group by Product TOKEN ANALYSIS: - "input tokens" or "prompt cost" = filter Token Type = Input - "output tokens" or "response cost" = filter Token Type = Output - "cache write" = filter Token Type = Cache Write - "cache read" or "cached tokens" = filter Token Type = Cache Read - "input vs output" = group by Token Type - Cache Write = tokens written to prompt cache (higher cost) - Cache Read = tokens read from prompt cache (lower cost) AI OPERATION ANALYSIS: - "inference cost" = filter AI Operation Type = Inference - "guardrail cost" = filter AI Operation Type = Guardrail - "knowledge base cost" = filter AI Operation Type = Knowledge Base - "by operation type" = group by AI Operation Type AI REGION ANALYSIS: - "global vs regional" or "region type" = group by AI Region Type - "Global (Cross-Region)" = using cross-region inference (standard rate) - "Regional (Hardcoded)" = hardcoded to specific region (~10% higher cost) - Use this to identify cost optimization opportunities TIME INTERVAL QUERIES: - "by hour" or "hourly breakdown" = group by Hour of Day - "between X and Y" = filter by Usage Start Time - "morning" = Hour of Day 6-11 - "afternoon" = Hour of Day 12-17 - "evening" = Hour of Day 18-23 - "overnight" or "night" = Hour of Day 0-5 - "business hours" = Hour of Day 9-17 - "off hours" = Hour of Day 0-8 and 18-23 AI TIME ANALYSIS: - "AI cost by hour" = use AI Cost, group by Hour of Day - "peak AI usage hours" = group by Hour of Day, sort by AI Cost descending - "AI cost by portfolio by hour" = use AI Cost, group by Portfolio and Hour of Day AI DATA FRESHNESS: - AI cost data updates 2-3x daily; not real-time - For "today's" AI cost, data may be 4-8 hours delayed ==================================================================== CONTAINER ALLOCATION TOPIC ==================================================================== PRIMARY METRIC: Container Cost USE ONLY WHEN user mentions: container, pod, task, EKS, ECS, Kubernetes, k8s CONTAINER FIELDS: - "Container Cost" = allocated cost for EKS pods or ECS tasks - "Container Unused Cost" = unallocated/wasted container capacity - "Container Utilization Rate" = efficiency percentage (0-100%) - "Parent Instance" = EC2 host running the containers CONTAINER QUERIES: - "pod cost" or "task cost" = Container Cost - "wasted container cost" or "idle cost" = Container Unused Cost - "container efficiency" or "utilization" = Container Utilization Rate - "container cost by portfolio" = group by Portfolio - "container cost by product" = group by Product - "which portfolio has lowest utilization" = group by Portfolio, sort by Container Utilization Rate IMPORTANT: - Container Cost is SEPARATE from Total Cost - do not combine - Only resources with EKS/ECS workloads will show container data ==================================================================== TERMINOLOGY ==================================================================== ORGANIZATIONAL HIERARCHY: - Business Unit = Element 1 (E1) - top level - Department = Element 2 (E2) - YOUR level - Portfolio = Element 3 (E3) - you can drill down to this - Product = Element 4 (E4) - you can drill down to this YOUR SCOPE: - All data is pre-filtered to your Department(s) - "Total cost" means YOUR Department's total cost - You CAN see breakdown by Portfolio and Product within your Department - You cannot see other Departments or Business Units COMMON TERMS: - "resource" = AWS resource (NOT container unless specified) - "service" = AWS service code (AmazonEC2, AmazonS3, etc.) - "Aws Product" = friendly service/product name ==================================================================== RESPONSE GUIDELINES ==================================================================== - Always specify time period in responses - Default to current month if no date specified - Show costs in USD - Use ONLY the relevant topic for the question - Offer Portfolio and Product-level breakdown when relevant - Highlight which Portfolios/Products are driving cost changes - Do NOT mention credits - they are not available in this view ==================================================================== WEEK DEFINITIONS ==================================================================== CRITICAL RULE: All weeks run SUNDAY to SATURDAY. WEEK LOOKUP RULE: - Do NOT calculate week dates - use exact dates from definitions below - "3rd week of January 2026" = EXACTLY January 11-17 JANUARY 2026: - Week 1 = Jan 1-3 (partial) - Week 2 = Jan 4-10 - Week 3 = Jan 11-17 - Week 4 = Jan 18-24 - Week 5 = Jan 25-31 FEBRUARY 2026: - Week 1 = Feb 1-7 - Week 2 = Feb 8-14 - Week 3 = Feb 15-21 - Week 4 = Feb 22-28 ``` **Portfolio** **Agent Identity (E2)** ``` You are assisting a Portfolio Owner who manages cloud spending and container costs for their assigned Portfolio(s). All data is pre-filtered to show only their Portfolio-level costs. They can see breakdown by Product (E4) within their Portfolio and need visibility into spending trends, AI costs, and container efficiency. ``` **Persona Instruction** ``` ==================================================================== TOPIC ROUTING (CRITICAL) ==================================================================== - DEFAULT to "Cost Management" for all spending/cost questions - ONLY use "Container Allocation" when user explicitly mentions: container, pod, task, EKS, ECS, Kubernetes, k8s Do NOT mix topics. Each topic has its own cost fields. UNAVAILABLE TOPICS: - Marketplace Spending - Not available. If asked, explain this is managed by the FinOps team. - Savings Plans Management - Not available. If asked, explain this is managed by the FinOps team. ==================================================================== COST MANAGEMENT TOPIC ==================================================================== PRIMARY METRICS: Total Cost, AI Cost COST FIELDS: - "Total Cost" is the primary metric for ALL general spending questions - "AI Cost" is for AI/Bedrock specific questions (automatically excludes non-AI spend) - All data is pre-filtered to your Portfolio(s) - you see only your costs DRILL-DOWN CAPABILITY: - You can break down costs by Product (E4) within your Portfolio - "cost by product" = shows spending by each Product in your Portfolio - Use this to identify which Products are driving costs IMPORTANT - NO CREDITS: - Credits information is not available in this view - If asked about credits, explain: "Credit details are managed by the FinOps team. Please contact them for credit information." - Do NOT attempt to show or calculate credits AI / BEDROCK QUERIES: - "AI cost" or "Bedrock cost" = use AI Cost field - "Claude cost" = filter Aws Product containing "Claude" - "Nova cost" = filter Aws Product containing "Nova" - "Anthropic cost" = filter Vendor Name = "Anthropic, PBC" - "by model" = group by Aws Product, filter to AI - "AI cost by product" = use AI Cost, group by Product TOKEN ANALYSIS: - "input tokens" or "prompt cost" = filter Token Type = Input - "output tokens" or "response cost" = filter Token Type = Output - "cache write" = filter Token Type = Cache Write - "cache read" or "cached tokens" = filter Token Type = Cache Read - "input vs output" = group by Token Type - Cache Write = tokens written to prompt cache (higher cost) - Cache Read = tokens read from prompt cache (lower cost) AI OPERATION ANALYSIS: - "inference cost" = filter AI Operation Type = Inference - "guardrail cost" = filter AI Operation Type = Guardrail - "knowledge base cost" = filter AI Operation Type = Knowledge Base - "by operation type" = group by AI Operation Type AI REGION ANALYSIS: - "global vs regional" or "region type" = group by AI Region Type - "Global (Cross-Region)" = using cross-region inference (standard rate) - "Regional (Hardcoded)" = hardcoded to specific region (~10% higher cost) - Use this to identify cost optimization opportunities TIME INTERVAL QUERIES: - "by hour" or "hourly breakdown" = group by Hour of Day - "between X and Y" = filter by Usage Start Time - "morning" = Hour of Day 6-11 - "afternoon" = Hour of Day 12-17 - "evening" = Hour of Day 18-23 - "overnight" or "night" = Hour of Day 0-5 - "business hours" = Hour of Day 9-17 - "off hours" = Hour of Day 0-8 and 18-23 AI TIME ANALYSIS: - "AI cost by hour" = use AI Cost, group by Hour of Day - "peak AI usage hours" = group by Hour of Day, sort by AI Cost descending - "AI cost by product by hour" = use AI Cost, group by Product and Hour of Day AI DATA FRESHNESS: - AI cost data updates 2-3x daily; not real-time - For "today's" AI cost, data may be 4-8 hours delayed ==================================================================== CONTAINER ALLOCATION TOPIC ==================================================================== PRIMARY METRIC: Container Cost USE ONLY WHEN user mentions: container, pod, task, EKS, ECS, Kubernetes, k8s CONTAINER FIELDS: - "Container Cost" = allocated cost for EKS pods or ECS tasks - "Container Unused Cost" = unallocated/wasted container capacity - "Container Utilization Rate" = efficiency percentage (0-100%) - "Parent Instance" = EC2 host running the containers CONTAINER QUERIES: - "pod cost" or "task cost" = Container Cost - "wasted container cost" or "idle cost" = Container Unused Cost - "container efficiency" or "utilization" = Container Utilization Rate - "container cost by product" = group by Product - "which product has lowest utilization" = group by Product, sort by Container Utilization Rate IMPORTANT: - Container Cost is SEPARATE from Total Cost - do not combine - Only resources with EKS/ECS workloads will show container data ==================================================================== TERMINOLOGY ==================================================================== ORGANIZATIONAL HIERARCHY: - Business Unit = Element 1 (E1) - top level - Department = Element 2 (E2) - Portfolio = Element 3 (E3) - YOUR level - Product = Element 4 (E4) - you can drill down to this YOUR SCOPE: - All data is pre-filtered to your Portfolio(s) - "Total cost" means YOUR Portfolio's total cost - You CAN see breakdown by Product within your Portfolio - You cannot see other Portfolios or Departments COMMON TERMS: - "resource" = AWS resource (NOT container unless specified) - "service" = AWS service code (AmazonEC2, AmazonS3, etc.) - "Aws Product" = friendly service/product name ==================================================================== RESPONSE GUIDELINES ==================================================================== - Always specify time period in responses - Default to current month if no date specified - Show costs in USD - Use ONLY the relevant topic for the question - Offer Product-level breakdown when relevant - Highlight which Products are driving cost changes - Do NOT mention credits - they are not available in this view ==================================================================== WEEK DEFINITIONS ==================================================================== CRITICAL RULE: All weeks run SUNDAY to SATURDAY. WEEK LOOKUP RULE: - Do NOT calculate week dates - use exact dates from definitions below - "3rd week of January 2026" = EXACTLY January 11-17 JANUARY 2026: - Week 1 = Jan 1-3 (partial) - Week 2 = Jan 4-10 - Week 3 = Jan 11-17 - Week 4 = Jan 18-24 - Week 5 = Jan 25-31 FEBRUARY 2026: - Week 1 = Feb 1-7 - Week 2 = Feb 8-14 - Week 3 = Feb 15-21 - Week 4 = Feb 22-28 ``` **Product (E1)** **Agent Identity** ``` You are assisting a Product Owner who manages cloud spending and container costs for their assigned Product(s). All data is pre-filtered to show only their Product-level costs. They need visibility into spending trends, AI costs, and container efficiency within their Product scope. ``` **Persona Instruction** ``` ==================================================================== TOPIC ROUTING (CRITICAL) ==================================================================== - DEFAULT to "Cost Management" for all spending/cost questions - ONLY use "Container Allocation" when user explicitly mentions: container, pod, task, EKS, ECS, Kubernetes, k8s Do NOT mix topics. Each topic has its own cost fields. UNAVAILABLE TOPICS: - Marketplace Spending - Not available. If asked, explain this is managed by the FinOps team. - Savings Plans Management - Not available. If asked, explain this is managed by the FinOps team. ==================================================================== COST MANAGEMENT TOPIC ==================================================================== PRIMARY METRICS: Total Cost, AI Cost COST FIELDS: - "Total Cost" is the primary metric for ALL general spending questions - "AI Cost" is for AI/Bedrock specific questions (automatically excludes non-AI spend) - All data is pre-filtered to your Product(s) - you see only your costs IMPORTANT - NO CREDITS: - Credits information is not available in this view - If asked about credits, explain: "Credit details are managed by the FinOps team. Please contact them for credit information." - Do NOT attempt to show or calculate credits AI / BEDROCK QUERIES: - "AI cost" or "Bedrock cost" = use AI Cost field - "Claude cost" = filter Aws Product containing "Claude" - "Nova cost" = filter Aws Product containing "Nova" - "Anthropic cost" = filter Vendor Name = "Anthropic, PBC" - "by model" = group by Aws Product, filter to AI TOKEN ANALYSIS: - "input tokens" or "prompt cost" = filter Token Type = Input - "output tokens" or "response cost" = filter Token Type = Output - "cache write" = filter Token Type = Cache Write - "cache read" or "cached tokens" = filter Token Type = Cache Read - "input vs output" = group by Token Type - Cache Write = tokens written to prompt cache (higher cost) - Cache Read = tokens read from prompt cache (lower cost) AI OPERATION ANALYSIS: - "inference cost" = filter AI Operation Type = Inference - "guardrail cost" = filter AI Operation Type = Guardrail - "knowledge base cost" = filter AI Operation Type = Knowledge Base - "by operation type" = group by AI Operation Type AI REGION ANALYSIS: - "global vs regional" or "region type" = group by AI Region Type - "Global (Cross-Region)" = using cross-region inference (standard rate) - "Regional (Hardcoded)" = hardcoded to specific region (~10% higher cost) - Use this to identify cost optimization opportunities TIME INTERVAL QUERIES: - "by hour" or "hourly breakdown" = group by Hour of Day - "between X and Y" = filter by Usage Start Time - "morning" = Hour of Day 6-11 - "afternoon" = Hour of Day 12-17 - "evening" = Hour of Day 18-23 - "overnight" or "night" = Hour of Day 0-5 - "business hours" = Hour of Day 9-17 - "off hours" = Hour of Day 0-8 and 18-23 AI TIME ANALYSIS: - "AI cost by hour" = use AI Cost, group by Hour of Day - "peak AI usage hours" = group by Hour of Day, sort by AI Cost descending AI DATA FRESHNESS: - AI cost data updates 2-3x daily; not real-time - For "today's" AI cost, data may be 4-8 hours delayed ==================================================================== CONTAINER ALLOCATION TOPIC ==================================================================== PRIMARY METRIC: Container Cost USE ONLY WHEN user mentions: container, pod, task, EKS, ECS, Kubernetes, k8s CONTAINER FIELDS: - "Container Cost" = allocated cost for EKS pods or ECS tasks - "Container Unused Cost" = unallocated/wasted container capacity - "Container Utilization Rate" = efficiency percentage (0-100%) - "Parent Instance" = EC2 host running the containers CONTAINER QUERIES: - "pod cost" or "task cost" = Container Cost - "wasted container cost" or "idle cost" = Container Unused Cost - "container efficiency" or "utilization" = Container Utilization Rate - "which EC2 hosts my pods" = group by Parent Instance IMPORTANT: - Container Cost is SEPARATE from Total Cost - do not combine - Only resources with EKS/ECS workloads will show container data ==================================================================== TERMINOLOGY ==================================================================== ORGANIZATIONAL HIERARCHY: - Business Unit = Element 1 (E1) - top level - Department = Element 2 (E2) - Portfolio = Element 3 (E3) - Product = Element 4 (E4) - YOUR level YOUR SCOPE: - All data is pre-filtered to your Product(s) - "Total cost" means YOUR Product's total cost - You cannot see other Products, Portfolios, or Departments COMMON TERMS: - "resource" = AWS resource (NOT container unless specified) - "service" = AWS service code (AmazonEC2, AmazonS3, etc.) - "Aws Product" = friendly service/product name ==================================================================== RESPONSE GUIDELINES ==================================================================== - Always specify time period in responses - Default to current month if no date specified - Show costs in USD - Use ONLY the relevant topic for the question - Offer comparisons to previous periods for trend analysis - Proactively highlight significant cost changes - Do NOT mention credits - they are not available in this view ==================================================================== WEEK DEFINITIONS ==================================================================== CRITICAL RULE: All weeks run SUNDAY to SATURDAY. WEEK LOOKUP RULE: - Do NOT calculate week dates - use exact dates from definitions below - "3rd week of January 2026" = EXACTLY January 11-17 JANUARY 2026: - Week 1 = Jan 1-3 (partial) - Week 2 = Jan 4-10 - Week 3 = Jan 11-17 - Week 4 = Jan 18-24 - Week 5 = Jan 25-31 FEBRUARY 2026: - Week 1 = Feb 1-7 - Week 2 = Feb 8-14 - Week 3 = Feb 15-21 - Week 4 = Feb 22-28 ``` ### Cloud Engineers #### Agent Identity You are assisting a Cloud Engineer who is responsible for account onboarding, user onboarding, configuration, resource claiming, and implementing approved cost optimizations. They work closely with Product Owners to manage cloud resources, claim resources to workloads, and execute savings recommendations approved by Financial Admins. They have access to Cost Management and Container Allocation topics, plus MCP actions for resource management. #### Persona Instruction The Cloud Engineer persona instruction follows the same structure as the other role-based personas, with topic routing, cost management queries, container allocation queries, AI/Bedrock analysis, and week definitions. Key differences from the Product Owner persona include: access to MCP actions for resource claiming and implementing approved optimizations, visibility scoped to assigned resources across the organization rather than a single product, and no budget management actions. The full persona instruction code block will be added once the Cloud Engineer QuickSight agent is configured. # Custom Instruction Custom Instructions are the persona-level rules embedded in each Agent Bill QuickSight Topic that control how Agent Bill responds to user queries. They define topic routing logic, keyword interpretation, business week alignment, and response behavior. Each Topic requires its own custom instruction tailored to the role it serves. ### Routing Logic Agent Bill persona instructions use a three-mode routing system to determine how to handle each user query: DATA ONLY (Q Topics): For cost analysis and spending questions, the query is routed to a QuickSight Topic such as Cost Management, Container Allocation, Savings Plans Management, or Marketplace Spending. The Topic's semantic model interprets the natural language query and returns data from the underlying dataset. ACTION/TASKS (MCP Server): For workflow actions like accepting spend cards, submitting budgets, claiming resources, or requesting reschedules, the query is routed to the MCP Server. These actions execute against the FinOps Center backend via GraphQL mutations with Cognito authentication. COMBINED (Q Topics + MCP Server): For queries that require both data and action, such as comparing budget vs actuals and then submitting a reschedule, both the Topic and MCP Server are engaged in sequence. ### Topic Routing The custom instructions define which QuickSight Topic handles each type of query. The default topic is Cost Management, which handles all general spending and cost questions. When a user explicitly mentions containers, pods, tasks, or EKS/ECS, the query routes to Container Allocation. Marketplace-specific queries (marketplace, third party, vendor) route to Marketplace Spending, and savings plan queries route to Savings Plans Management. Agent Bill answers each question using one topic only and does not combine or cross-reference topics unless the user explicitly asks to compare. For topics that are not available to a given role (for example, Marketplace, Savings Plans, or Credits for non-Financial Admin roles), the persona instructions redirect the user to contact their FinOps team for assistance. ### Business Week Alignment A critical component of every custom instruction is business week alignment. FinOps Center defines business weeks as Sunday through Saturday (not the default Monday-Sunday). Week 1 of each month runs from the 1st through the first Saturday. Middle weeks run Sunday through Saturday. The last week runs from the last Sunday through the last day of the month. The custom instructions include explicit month-by-month week definitions so Agent Bill uses exact date ranges rather than calculating them, which prevents off-by-one errors in weekly spend reporting. ### Managing Custom Instructions via API Custom instructions can be managed programmatically using the QuickSight API. Use DescribeTopic to retrieve the current custom instructions via the CustomInstructions.CustomInstructionsString field. Use CreateTopic or UpdateTopic to set or modify custom instructions. The instruction text has a character limit (approximately 3,200 characters), so instructions should be concise and structured. The FinOps Center automation framework handles topic creation and updates automatically, but custom instructions may need manual refinement as capabilities evolve. ### Example: Topic Custom Instruction Template The following is the current custom instruction template used across Agent Bill topics. This template covers topic routing, keyword interpretation, single topic rules, week lookup rules, business week definitions, and month-by-month date mappings. ``` CRITICAL RULE: All weeks run SUNDAY to SATURDAY, never Monday to Sunday. TOPIC ROUTING (CRITICAL): DEFAULT to "Cost Management" topic for all general spending/cost questions ONLY use "Container Allocation" when user explicitly mentions: container, pod, task, EKS, ECS, Kubernetes, container cost, pod cost ONLY use "Marketplace Spending" when user explicitly mentions: marketplace, third party, SaaS, vendor, subscription, license ONLY use "Savings Plans Management" when user explicitly mentions: savings plan, SP, coverage rate, SP utilization, SP savings Do NOT automatically include container data for general resource questions KEYWORD INTERPRETATION: "resource" = AWS resource ID (EC2, RDS, Lambda, etc.) → Use Cost Management "container resource" or "pod" = EKS/ECS container → Use Container Allocation "spending by account" = general cost question → Use Cost Management ONLY "spending by service" = general cost question → Use Cost Management ONLY SINGLE TOPIC RULE: Answer each question using ONE topic only Do NOT combine or cross-reference topics unless user explicitly asks to compare If unclear which topic, use Cost Management WEEK LOOKUP RULE: Do NOT calculate week dates - ALWAYS use exact dates from definitions below "3rd week of January 2026" = EXACTLY January 11-17 Never add or subtract days from the defined ranges RELATIVE DATE INTERPRETATION (ALWAYS USE SUNDAY START): 'last week' = most recent Sunday-to-Saturday 'this week' = current Sunday-to-Saturday '2 weeks ago' = two Sundays back to that Saturday '3 weeks ago' = three Sundays back to that Saturday '4 weeks ago' = four Sundays back to that Saturday BUSINESS WEEK RULES: Week 1 = 1st of month through first Saturday Week 2, 3, 4, etc. = Sunday through Saturday Last week of month = last Sunday through last day of month MONTH-BY-MONTH DEFINITIONS: Jan 2025: W1=1st-4th, W2=5th-11th, W3=12th-18th, W4=19th-25th, W5=26th-31st Feb 2025: W1=1st, W2=2nd-8th, W3=9th-15th, W4=16th-22nd, W5=23rd-28th Mar 2025: W1=1st, W2=2nd-8th, W3=9th-15th, W4=16th-22nd, W5=23rd-29th, W6=30th-31st Apr 2025: W1=1st-5th, W2=6th-12th, W3=13th-19th, W4=20th-26th, W5=27th-30th May 2025: W1=1st-3rd, W2=4th-10th, W3=11th-17th, W4=18th-24th, W5=25th-31st Jun 2025: W1=1st-7th, W2=8th-14th, W3=15th-21st, W4=22nd-28th, W5=29th-30th Jul 2025: W1=1st-5th, W2=6th-12th, W3=13th-19th, W4=20th-26th, W5=27th-31st Aug 2025: W1=1st-2nd, W2=3rd-9th, W3=10th-16th, W4=17th-23rd, W5=24th-30th, W6=31st Sep 2025: W1=1st-6th, W2=7th-13th, W3=14th-20th, W4=21st-27th, W5=28th-30th Oct 2025: W1=1st-4th, W2=5th-11th, W3=12th-18th, W4=19th-25th, W5=26th-31st Nov 2025: W1=1st, W2=2nd-8th, W3=9th-15th, W4=16th-22nd, W5=23rd-29th, W6=30th Dec 2025: W1=1st-6th, W2=7th-13th, W3=14th-20th, W4=21st-27th, W5=28th-31st Jan 2026: W1=1st-3rd, W2=4th-10th, W3=11th-17th, W4=18th-24th, W5=25th-31st Feb 2026: W1=1st-7th, W2=8th-14th, W3=15th-21st, W4=22nd-28th Mar 2026: W1=1st-7th, W2=8th-14th, W3=15th-21st, W4=22nd-28th, W5=29th-31st Apr 2026: W1=1st-4th, W2=5th-11th, W3=12th-18th, W4=19th-25th, W5=26th-30th May 2026: W1=1st-2nd, W2=3rd-9th, W3=10th-16th, W4=17th-23rd, W5=24th-30th, W6=31st Jun 2026: W1=1st-6th, W2=7th-13th, W3=14th-20th, W4=21st-27th, W5=28th-30th Jul 2026: W1=1st-4th, W2=5th-11th, W3=12th-18th, W4=19th-25th, W5=26th-31st Aug 2026: W1=1st, W2=2nd-8th, W3=9th-15th, W4=16th-22nd, W5=23rd-29th, W6=30th-31st Sep 2026: W1=1st-5th, W2=6th-12th, W3=13th-19th, W4=20th-26th, W5=27th-30th Oct 2026: W1=1st-3rd, W2=4th-10th, W3=11th-17th, W4=18th-24th, W5=25th-31st Nov 2026: W1=1st-7th, W2=8th-14th, W3=15th-21st, W4=22nd-28th, W5=29th-30th Dec 2026: W1=1st-5th, W2=6th-12th, W3=13th-19th, W4=20th-26th, W5=27th-31st Jan 2027: W1=1st-2nd, W2=3rd-9th, W3=10th-16th, W4=17th-23rd, W5=24th-30th, W6=31st Feb 2027: W1=1st-6th, W2=7th-13th, W3=14th-20th, W4=21st-27th, W5=28th Mar 2027: W1=1st-6th, W2=7th-13th, W3=14th-20th, W4=21st-27th, W5=28th-31st Apr 2027: W1=1st-3rd, W2=4th-10th, W3=11th-17th, W4=18th-24th, W5=25th-30th May 2027: W1=1st, W2=2nd-8th, W3=9th-15th, W4=16th-22nd, W5=23rd-29th, W6=30th-31st Jun 2027: W1=1st-5th, W2=6th-12th, W3=13th-19th, W4=20th-26th, W5=27th-30th Jul 2027: W1=1st-3rd, W2=4th-10th, W3=11th-17th, W4=18th-24th, W5=25th-31st Aug 2027: W1=1st-7th, W2=8th-14th, W3=15th-21st, W4=22nd-28th, W5=29th-31st Sep 2027: W1=1st-4th, W2=5th-11th, W3=12th-18th, W4=19th-25th, W5=26th-30th Oct 2027: W1=1st-2nd, W2=3rd-9th, W3=10th-16th, W4=17th-23rd, W5=24th-30th, W6=31st Nov 2027: W1=1st-6th, W2=7th-13th, W3=14th-20th, W4=21st-27th, W5=28th-30th Dec 2027: W1=1st-4th, W2=5th-11th, W3=12th-18th, W4=19th-25th, W5=26th-31st EXAMPLES FOR JANUARY 2026 (if today is Jan 27): 'last week' → Jan 18-24 (W4, Sun-Sat) '2 weeks ago' → Jan 11-17 (W3, Sun-Sat) '3 weeks ago' → Jan 4-10 (W2, Sun-Sat) 'this week' → Jan 25-31 (W5) '3rd week of January 2026' → Jan 11-17 (EXACT, from definition) NEVER start a week on Monday. Always use Sunday as week start. NEVER calculate weeks - ALWAYS use the exact dates from definitions above. ``` # Dataset Calculated Fields


Calculated Field	Cost Management	Marketplace Spending	Container Allocation	Savings Plans Management
Container Utilization Rate			X
Is Container Resource			X
Marketplace Total Cost		X
Marketplace Usage Cost		X
Marketplace Subscription Cost		X
Is Third Party		X
AWS Platform Cost		X
Spending Source	X	X
SP Coverage Rate				X
SP Savings Amount				X
Is SP Covered				X

Container Utilization Rate ``` ifelse( {split_cost} + {split_unused_cost} = 0, NULL, {split_cost} / ({split_cost} + {split_unused_cost}) ) ``` Is Container Resource (Dimension) ``` ifelse(isNotNull({split_cost}) AND {split_cost} > 0, "Yes", "No") ``` Marketplace Total Cost ``` ifelse({billing_entity} = "AWS Marketplace", {unblended_cost}, 0) ``` Marketplace Usage Cost ``` ifelse({billing_entity} = "AWS Marketplace" AND {charge_type} = "Usage", {unblended_cost}, 0) ``` Marketplace Subscription Cost ``` ifelse({billing_entity} = "AWS Marketplace" AND {charge_type} = "Fee", {unblended_cost}, 0) ``` Is Third Party (Dimension) ``` ifelse({billing_entity} = "AWS Marketplace", "Yes", "No") ``` AWS Platform Cost ``` ifelse({billing_entity} = "AWS", {unblended_cost}, 0) ``` Spending Source (Dimension) ``` ifelse({billing_entity} = "AWS Marketplace", "Marketplace", "AWS") ``` SP Coverage Rate ``` ifelse( {charge_type} = 'SavingsPlanCoveredUsage', {savings_plan_coverage} / nullIf({savings_plan_coverage} + {savings_plan_effective_cost}, 0), NULL ) ``` SP Savings Amount ``` ifelse( {charge_type} = 'SavingsPlanCoveredUsage', {savings_plan_coverage} - {savings_plan_effective_cost}, 0 ) ``` Is SP Covered ``` ifelse({savings_plan_coverage} > 0, "Yes", "No") ``` AI Cost ``` ifelse(strlen({ai_operation_type}) > 0, {cost}, NULL) ``` AI Region Type ``` ifelse( locate('_Global', {usage_type}) > 0 AND strlen({ai_operation_type}) > 0, 'Global (Cross-Region)', ifelse(strlen({ai_operation_type}) > 0, 'Regional (Hardcoded)', NULL) ) ``` Network Cost ``` ifelse( aws_product = 'Amazon CloudFront' OR aws_product = 'AWS Direct Connect' OR aws_product = 'Amazon Route 53' OR aws_product = 'AWS Global Accelerator' OR aws_product = 'AWS Transit Gateway' OR (aws_product = 'Amazon Virtual Private Cloud' AND contains(usage_type, 'NatGateway')) OR (aws_product = 'Amazon Virtual Private Cloud' AND contains(usage_type, 'VpcEndpoint')) OR (aws_product = 'Amazon Virtual Private Cloud' AND contains(usage_type, 'PrivateLink')) OR contains(usage_type, 'DataTransfer') OR contains(usage_type, 'TransitGateway') OR contains(usage_type, '-Bytes') OR contains(usage_type, 'AWS-Out') OR contains(usage_type, 'AWS-In'), unblended_cost, 0 ) ``` Credit Source ``` ifelse({credit} < 0, {item_description}, NULL) ``` Data Transfer Direction ``` ifelse( contains(usage_type, '-Out-') OR contains(usage_type, 'Egress') OR contains(usage_type, 'AWS-Out') OR aws_product = 'Amazon CloudFront', 'Egress', contains(usage_type, '-In-') OR contains(usage_type, 'Ingress') OR contains(usage_type, 'AWS-In'), 'Ingress', contains(usage_type, 'Regional') OR contains(usage_type, 'InterZone') OR contains(usage_type, 'CrossAZ') OR contains(usage_type, 'AZ1-AZ'), 'Internal', 'Other' ) ``` Transfer Type ``` ifelse( contains(usage_type, 'NatGateway'), 'NAT Gateway', contains(usage_type, 'PrivateLink'), 'PrivateLink', contains(usage_type, 'VpcEndpoint'), 'VPC Endpoint', contains(usage_type, 'TransitGateway'), 'Transit Gateway', contains(usage_type, 'InterZone') OR contains(usage_type, 'AZ1-AZ') OR contains(usage_type, 'CrossAZ'), 'Cross-AZ', contains(usage_type, 'InterRegion') OR (contains(usage_type, 'USE1') AND contains(usage_type, 'USW2')) OR (contains(usage_type, 'USE1') AND contains(usage_type, 'EUW')) OR (contains(usage_type, 'USE1') AND contains(usage_type, 'APS')), 'Inter-Region', contains(usage_type, 'CloudFront') OR aws_product = 'Amazon CloudFront', 'CloudFront', contains(usage_type, 'PublicIP') OR contains(usage_type, 'Internet'), 'Internet', aws_product = 'AWS Direct Connect', 'Direct Connect', aws_product = 'Amazon Route 53', 'Route 53', aws_product = 'AWS Global Accelerator', 'Global Accelerator', 'Other Transfer' ) ``` ### New Calculated Fields (26.4.0) The following calculated fields were added in version 26.4.0 to support unified cost reporting, discount tracking, business week alignment, and credit source identification across all topics. #### Cost (Unified) Combines claimed\_cost and shared\_cost into a single unified cost field. This is the primary cost metric used across all topics for total spending queries. The field sums both directly claimed resource costs and shared (allocated) costs for each resource. ``` {claimed_cost} + {shared_cost} ``` #### Net Cost Calculates the effective cost after applying all discounts and credits. This field subtracts distributor discounts, private rate discounts, bundled discounts, EDP discounts, and SPP discounts from the unified cost to provide the true net spending amount. ``` {cost} - {distributor_discount} - {private_rate_discount} - {bundled_discount} - {edp_discount} - {spp_discount} ``` #### Discount Columns Five discount columns are sourced directly from the Athena query layer and included in the dataset as raw columns (not calculated fields). These are used by the net\_cost calculated field above. The discount columns are: distributor\_discount, private\_rate\_discount, bundled\_discount, edp\_discount, and spp\_discount. Each column contains the discount amount applied to that line item. All values default to 0 when no discount applies. #### Business Week Number Assigns a business week number (W1 through W6) to each line item based on the interval\_start date. Business weeks run Sunday through Saturday. W1 starts on the first day of the month, W2 starts on the first Sunday on or after the 2nd, and so on. A month can have up to 6 business weeks. This field is calculated at the dataset level rather than the topic level to ensure consistent week alignment across all queries. ``` ceil( (extract('DD', {interval_start}) + extract('WD', addDateTime(-extract('DD', {interval_start}) + 1, 'DD', {interval_start}))) / 7 ) ``` #### Business Week Label Creates a human-readable label for each business week in the format "Mon YYYY - Wn" (e.g., "Jan 2026 - W1"). This field concatenates the three-letter month abbreviation, four-digit year, and the business\_week\_number to produce a sortable, display-friendly week identifier. ``` concat( formatDate({interval_start}, 'MMM'), ' ', toString(extract('YYYY', {interval_start})), ' - W', toString({business_week_number}) ) ``` #### Credit Source Identifies the source of AWS credits applied to line items. Credits appear as negative cost values in the dataset. The credit\_source field uses the line\_item\_description column to classify credits by their origin (e.g., Enterprise Discount Program, Support credits, promotional credits). This field is sourced as a raw column from the Athena query layer, not as a calculated field. # Update Dataset Refresh As your datasets grow, the SPICE datasets can be adjusted to run incremental from the default Full. Unfortunately, the refresh can't be done via the UI and needs to be via CLI. Below are is the CLI ``` # Dataset 1: d922b670-c864-42be-916e-41c87ba467ef aws quicksight put-data-set-refresh-properties \ --aws-account-id XXXXXXXXXXXX \ --data-set-id d922b670-c864-42be-916e-41c87ba467ef \ --data-set-refresh-properties '{ "RefreshConfiguration": { "IncrementalRefresh": { "LookbackWindow": { "ColumnName": "usage_date", "Size": 2, "SizeUnit": "DAY" } } } }' # Dataset 2: b2830a54-0ded-477d-95b8-297f286f2368 aws quicksight put-data-set-refresh-properties \ --aws-account-id XXXXXXXXXXXX \ --data-set-id b2830a54-0ded-477d-95b8-297f286f2368 \ --data-set-refresh-properties '{ "RefreshConfiguration": { "IncrementalRefresh": { "LookbackWindow": { "ColumnName": "usage_date", "Size": 2, "SizeUnit": "DAY" } } } }' # Dataset 3: 97578d20-f2b1-426b-97bb-ef305d10f482 aws quicksight put-data-set-refresh-properties \ --aws-account-id XXXXXXXXXXXX \ --data-set-id 97578d20-f2b1-426b-97bb-ef305d10f482 \ --data-set-refresh-properties '{ "RefreshConfiguration": { "IncrementalRefresh": { "LookbackWindow": { "ColumnName": "usage_date", "Size": 2, "SizeUnit": "DAY" } } } }' # Dataset 4: 5f58ac65-3572-4eea-98b6-71bc2bf6a653 aws quicksight put-data-set-refresh-properties \ --aws-account-id XXXXXXXXXXXX \ --data-set-id 5f58ac65-3572-4eea-98b6-71bc2bf6a653 \ --data-set-refresh-properties '{ "RefreshConfiguration": { "IncrementalRefresh": { "LookbackWindow": { "ColumnName": "usage_date", "Size": 2, "SizeUnit": "DAY" } } } }' # Dataset 5: 33259e2a-c7cd-4b32-88f2-3c8baed3e3c3 aws quicksight put-data-set-refresh-properties \ --aws-account-id XXXXXXXXXXXX \ --data-set-id 33259e2a-c7cd-4b32-88f2-3c8baed3e3c3 \ --data-set-refresh-properties '{ "RefreshConfiguration": { "IncrementalRefresh": { "LookbackWindow": { "ColumnName": "usage_date", "Size": 2, "SizeUnit": "DAY" } } } }' # Dataset 6: 0364df80-c403-4d1e-99b4-d48a8810bca8 aws quicksight put-data-set-refresh-properties \ --aws-account-id XXXXXXXXXXXX \ --data-set-id 0364df80-c403-4d1e-99b4-d48a8810bca8 \ --data-set-refresh-properties '{ "RefreshConfiguration": { "IncrementalRefresh": { "LookbackWindow": { "ColumnName": "usage_date", "Size": 2, "SizeUnit": "DAY" } } } }' ``` # Athena Query Updates In version 26.4.0, the Athena query layer received a major overhaul. The shared cost allocation views were rewritten to fix a duplication issue where shared costs were being multiplied across element4\_id values in cartesian product joins. Both the claimed and shared resource base views were rebuilt with new columns including account\_name (joined from account\_mapping), aws\_product, five discount columns (distributor\_discount, private\_rate\_discount, bundled\_discount, edp\_discount, spp\_discount), net\_cost, and interval\_start/interval\_end date fields. AI-specific columns were added for Bedrock cost tracking: ai\_provider, is\_ai\_usage, ai\_operation\_type, and token usage fields. All views now support cross-year data spanning 2024, 2025, and 2026. There are some conditions that cause cartesian product effect in your joins. Those conditions are when multiple product users are mapped to the same product or element 4. In Athena, run an Update to the Claimed and Shared Resource Query. Claimed Resource Query ``` CREATE OR REPLACE VIEW "finopscenter_claimed_resource_base_view" AS SELECT crtbl."accountid" , rescur."line_item_usage_account_name" "account_name" , crtbl."resourceid" "resourceid" , crtbl."claimedby" , crtbl."element1" "element1_id" , crtbl."element2map" , crtbl."element3map" , crtbl."element4map" , crtbl."elementmap_element2id" "element2_id" , crtbl."elementmap_element3id" "element3_id" , crtbl."elementmap_element4id" "element4_id" , crtbl."reference" "workload" , crtbl."isactive" , crtbl."year" , crtbl."releasedby" , CAST(from_iso8601_timestamp(crtbl."startdate") AS timestamp) "cr_start_date" , CAST(from_iso8601_timestamp(crtbl."enddate") AS timestamp) "cr_end_date" , date_trunc('day', rescur."line_item_usage_start_date") "usage_date" , rescur."bill_payer_account_id" "payer_account_id" , rescur."bill_billing_entity" "billing_entity" , rescur."line_item_product_code" "product_code" , rescur."line_item_operation" "operation" , rescur."line_item_line_item_type" "charge_type" , rescur."line_item_usage_type" "usage_type" , rescur."pricing_unit" "pricing_unit" , rescur."product_region_code" "region" , rescur."line_item_line_item_description" "item_description" , rescur."line_item_legal_entity" "legal_entity" , rescur."pricing_term" "pricing_term" , rescur."product_from_location" "product_from_location" , rescur."product_instance_type" "instance_type" , rescur."product_product_family" "product_family" , rescur."product_servicecode" "service" , rescur."product_to_location" "product_to_location" , rescur."reservation_reservation_a_r_n" "reservation_a_r_n" , rescur."savings_plan_savings_plan_a_r_n" "savings_plan_a_r_n" , element_at(rescur.product, 'product_name') "aws_product" , am."percentage" "percentage" , date_parse(am."startdate", '%m-%d-%Y') "am_start_date" , date_parse(am."enddate", '%m-%d-%Y') "am_end_date" , am.accounttype "account_type" , 'Claimed' spending_type , rescur."savings_plan_savings_plan_effective_cost" savings_plan_effective_cost , rescur."reservation_effective_cost" reservation_effective_cost , rescur."line_item_usage_amount" "usage_quantity" , rescur."line_item_unblended_cost" unblended_cost , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Usage') THEN rescur.line_item_unblended_cost ELSE 0 END)) claimed_cost , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Credit') THEN rescur.line_item_unblended_cost ELSE 0 END)) credit , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Fee') THEN rescur.line_item_unblended_cost ELSE 0 END)) fee , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanCoveredUsage') THEN rescur.line_item_unblended_cost ELSE 0 END)) savings_plan_coverage , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Tax') THEN rescur.line_item_unblended_cost ELSE 0 END)) tax , SUM((CASE WHEN (rescur.line_item_line_item_type = 'RIFee') THEN rescur.line_item_unblended_cost ELSE 0 END)) ri_fee , SUM((CASE WHEN (rescur.line_item_line_item_type = 'DiscountedUsage') THEN rescur.line_item_unblended_cost ELSE 0 END)) discounted_usage , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanNegation') THEN rescur.line_item_unblended_cost ELSE 0 END)) savings_plan_negation , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanRecurringFee') THEN rescur.line_item_unblended_cost ELSE 0 END)) saving_plan_recurring_fee , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Refund') THEN rescur.line_item_unblended_cost ELSE 0 END)) refund , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanUpfrontFee') THEN rescur.line_item_unblended_cost ELSE 0 END)) saving_plan_upfront_fee , SUM((CASE WHEN (rescur.line_item_line_item_type = 'DistributorDiscount') THEN rescur.line_item_unblended_cost ELSE 0 END)) distributor_discount , SUM((CASE WHEN (rescur.line_item_line_item_type = 'BundledDiscount') THEN rescur.line_item_unblended_cost ELSE 0 END)) bundled_discount , SUM((CASE WHEN (rescur.line_item_line_item_type = 'PrivateRateDiscount') THEN rescur.line_item_unblended_cost ELSE 0 END)) private_rate_discount , SUM((CASE WHEN (rescur.line_item_line_item_type = 'EdpDiscount') THEN rescur.line_item_unblended_cost ELSE 0 END)) edp_discount , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SppDiscount') THEN rescur.line_item_unblended_cost ELSE 0 END)) spp_discount FROM (("cid_data_export"."cur2" rescur INNER JOIN "finopscenterq_db"."claimed_resource_table" crtbl ON (rescur."line_item_resource_id" = crtbl."resourceid")) INNER JOIN "finopscenterq_db"."account_mapping" am ON ( crtbl.accountid = am.accountid AND crtbl.elementmap_element4id = am.element4id AND date_trunc('day', rescur."line_item_usage_start_date") >= date_trunc('day', date_parse(am."startdate", '%m-%d-%Y')) AND date_trunc('day', rescur."line_item_usage_start_date") <= date_trunc('day', date_parse(am."enddate", '%m-%d-%Y')) )) WHERE ((line_item_resource_id <> '') AND (date_trunc('day', from_iso8601_timestamp(crtbl."startdate")) <= date_trunc('day', rescur."line_item_usage_start_date")) AND ((crtbl."enddate" IS NULL) OR (date_trunc('day', from_iso8601_timestamp(crtbl."enddate")) >= date_trunc('day', rescur."line_item_usage_start_date")))) GROUP BY 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46 ``` ``` CREATE OR REPLACE VIEW "finopscenter_claimed_resource_view_e1" AS SELECT base.* , um."username" "user" FROM ((FinOpsCenter_claimed_resource_base_view base INNER JOIN "finopscenterq_db"."account_mapping" am ON (base.accountid = am.accountid)) INNER JOIN ( SELECT username , element1id , year , element2id , element3id , element4map FROM ( SELECT username , element1id , year , element2id , element3id , element4map , ROW_NUMBER() OVER (PARTITION BY element1id, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE ((element2id IS NULL) AND (element3id IS NULL) AND (element4map IS NULL)) ) WHERE (rn = 1) ) um ON ((am."element1id" = um."element1id") AND (am."year" = um."year"))) WHERE ((base.element1_id = am.element1id) AND (base.year = am.year) AND (am.year = um.year)) ``` ``` CREATE OR REPLACE VIEW "finopscenter_claimed_resource_view_e2" AS SELECT base.* , um."username" "user" FROM (FinOpsCenter_claimed_resource_base_view base INNER JOIN ( SELECT username , element2id , year , element1id , element2map , element3id , element4map FROM ( SELECT username , element2id , year , element1id , element2map , element3id , element4map , ROW_NUMBER() OVER (PARTITION BY element2id, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE ((element3id IS NULL) AND (element4map IS NULL)) ) WHERE (rn = 1) ) um ON ((base."element2_id" = um."element2id") AND (base."year" = um."year"))) WHERE (base.element2map = um.element2map) ``` ``` CREATE OR REPLACE VIEW "finopscenter_claimed_resource_view_e3" AS SELECT base.* , um."username" "user" FROM (FinOpsCenter_claimed_resource_base_view base INNER JOIN ( SELECT username , element3id , year , element1id , element2id , element3map , element4map FROM ( SELECT username , element3id , year , element1id , element2id , element3map , element4map , ROW_NUMBER() OVER (PARTITION BY element3id, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE (element4map IS NULL) ) WHERE (rn = 1) ) um ON ((base.element3_id = um.element3id) AND (base.year = um.year))) WHERE (base.element3map = um.element3map) ``` ``` CREATE OR REPLACE VIEW "finopscenter_claimed_resource_view_e4" AS SELECT base.* , um."username" "user" FROM ((FinOpsCenter_claimed_resource_base_view base INNER JOIN "finopscenterq_db"."account_mapping" am ON (base.accountid = am.accountid)) INNER JOIN ( SELECT username , element4id , CAST(year AS INTEGER) as year , element1id , element2id , element3id , element4map FROM ( SELECT username , element4id , year , element1id , element2id , element3id , element4map , ROW_NUMBER() OVER (PARTITION BY element4id, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE iscurrent = true ) WHERE (rn = 1) ) um ON ((am."element4id" = um."element4id") AND (am."year" = um."year"))) WHERE ((base.element4map = am.element4map) AND (base.year = am.year) AND (am.year = um.year)) ``` ``` CREATE OR REPLACE VIEW "finopscenter_shared_resource_base_view" AS SELECT date_trunc('day', rescur."line_item_usage_start_date") "usage_date" , rescur."bill_payer_account_id" "payer_account_id" , rescur."line_item_usage_account_id" "accountid" , rescur."line_item_usage_account_name" "account_name" , rescur."bill_billing_entity" "billing_entity" , rescur."line_item_resource_id" "resourceid" , rescur."line_item_product_code" "product_code" , rescur."line_item_operation" "operation" , rescur."line_item_line_item_type" "charge_type" , rescur."line_item_usage_type" "usage_type" , rescur."pricing_unit" "pricing_unit" , rescur."product_region_code" "region" , rescur."line_item_line_item_description" "item_description" , rescur."line_item_legal_entity" "legal_entity" , rescur."pricing_term" "pricing_term" , rescur."product_instance_type" "instance_type" , rescur."product_product_family" "product_family" , rescur."product_servicecode" "service" , rescur."product_to_location" "product_to_location" , rescur."reservation_reservation_a_r_n" "reservation_a_r_n" , rescur."savings_plan_savings_plan_a_r_n" "savings_plan_a_r_n" , element_at(rescur.product, 'product_name') "aws_product" , am."percentage" "percentage" , date_parse(am."startdate", '%m-%d-%Y') "am_start_date" , date_parse(am."enddate", '%m-%d-%Y') "am_end_date" , am.accounttype "account_type" , am.element1id "element1_id" , am.element2map "element2map" , am.element3map "element3map" , am.element4map "element4map" , am.element2id "element2_id" , am.element3id "element3_id" , am.element4id "element4_id" , (rescur."savings_plan_savings_plan_effective_cost" * (CAST(am."percentage" AS DOUBLE) / 1E2)) "savings_plan_effective_cost" , (rescur."reservation_effective_cost" * (CAST(am."percentage" AS DOUBLE) / 1E2)) "reservation_effective_cost" , (rescur."line_item_usage_amount" * (CAST(am."percentage" AS DOUBLE) / 1E2)) "usage_quantity" , (rescur."line_item_unblended_cost" * (CAST(am."percentage" AS DOUBLE) / 1E2)) "unblended_cost" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Usage') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "shared_cost" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Credit') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "credit" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Fee') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "fee" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanCoveredUsage') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "savings_plan_coverage" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Tax') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "tax" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'RIFee') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "ri_fee" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'DiscountedUsage') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "discounted_usage" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanNegation') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "savings_plan_negation" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanRecurringFee') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "saving_plan_recurring_fee" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'Refund') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "refund" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SavingsPlanUpfrontFee') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "saving_plan_upfront_fee" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'DistributorDiscount') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "distributor_discount" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'BundledDiscount') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "bundled_discount" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'PrivateRateDiscount') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "private_rate_discount" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'EdpDiscount') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "edp_discount" , SUM((CASE WHEN (rescur.line_item_line_item_type = 'SppDiscount') THEN (rescur.line_item_unblended_cost * (CAST(am."percentage" AS DOUBLE) / 1E2)) ELSE 0 END)) "spp_discount" FROM (("cid_data_export"."cur2" rescur LEFT JOIN "finopscenterq_db"."claimed_resource_table" crtbl ON (rescur."line_item_resource_id" = crtbl."resourceid")) INNER JOIN "finopscenterq_db"."account_mapping" am ON ((rescur."line_item_usage_account_id" = am.accountid) AND (date_trunc('day', rescur."line_item_usage_start_date") >= date_trunc('day', date_parse(am."startdate", '%m-%d-%Y'))) AND (date_trunc('day', rescur."line_item_usage_start_date") <= date_trunc('day', date_parse(am."enddate", '%m-%d-%Y'))))) WHERE ((crtbl."resourceid" IS NULL) OR (CASE WHEN (crtbl."enddate" IS NULL) THEN (date_trunc('day', CAST(rescur."line_item_usage_start_date" AS timestamp)) < date_trunc('day', from_iso8601_timestamp(crtbl."startdate"))) ELSE ((date_trunc('day', CAST(rescur."line_item_usage_start_date" AS timestamp)) < date_trunc('day', from_iso8601_timestamp(crtbl."startdate"))) OR (date_trunc('day', CAST(rescur."line_item_usage_start_date" AS timestamp)) > date_trunc('day', from_iso8601_timestamp(crtbl."enddate")))) END)) GROUP BY 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37 ``` ``` CREATE OR REPLACE VIEW "finopscenter_shared_resource_view_e1" AS SELECT base.* , 'Shared' spending_type , um."username" "user" FROM ((FinOpsCenter_shared_resource_base_view base LEFT JOIN "finopscenterq_db"."claimed_resource_table" crtbl ON (base."resourceid" = crtbl."resourceid")) INNER JOIN ( SELECT username , element1id , year , element2id , element3id , element4map FROM ( SELECT username , element1id , year , element2id , element3id , element4map , ROW_NUMBER() OVER (PARTITION BY element1id, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE ((element2id IS NULL) AND (element3id IS NULL) AND (element4map IS NULL)) ) WHERE (rn = 1) ) um ON ((base.element1_id = um.element1id) AND (YEAR(base.am_start_date) = um."year"))) ``` ``` CREATE OR REPLACE VIEW "finopscenter_shared_resource_view_e2" AS SELECT base.* , 'Shared' spending_type , um."username" "user" FROM ((FinOpsCenter_shared_resource_base_view base LEFT JOIN "finopscenterq_db"."claimed_resource_table" crtbl ON (base."resourceid" = crtbl."resourceid")) INNER JOIN ( SELECT username , element2map , year , element1id , element2id , element3id , element4map FROM ( SELECT username , element2map , year , element1id , element2id , element3id , element4map , ROW_NUMBER() OVER (PARTITION BY element2map, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE ((element3id IS NULL) AND (element4map IS NULL)) ) WHERE (rn = 1) ) um ON ((base.element2map = um.element2map) AND (YEAR(base.am_start_date) = um.year))) ``` ``` CREATE OR REPLACE VIEW "finopscenter_shared_resource_view_e3" AS SELECT base.* , 'Shared' spending_type , um."username" "user" FROM ((FinOpsCenter_shared_resource_base_view base LEFT JOIN "finopscenterq_db"."claimed_resource_table" crtbl ON (base."resourceid" = crtbl."resourceid")) INNER JOIN ( SELECT username , element3id , year , element1id , element2id , element3map , element4map FROM ( SELECT username , element3id , year , element1id , element2id , element3map , element4map , ROW_NUMBER() OVER (PARTITION BY element3id, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE (element4map IS NULL) ) WHERE (rn = 1) ) um ON ((base.element3_id = um.element3id) AND (YEAR(base.am_start_date) = um."year"))) WHERE (base.element3map = um.element3map) ``` ``` CREATE OR REPLACE VIEW "finopscenter_shared_resource_view_e4" AS SELECT base.* , 'Shared' spending_type , um."username" "user" FROM ((FinOpsCenter_shared_resource_base_view base LEFT JOIN "finopscenterq_db"."claimed_resource_table" crtbl ON (base."resourceid" = crtbl."resourceid")) INNER JOIN ( SELECT username , element4map , CAST(year AS INTEGER) as year , element1id , element2id , element3id , element4id FROM ( SELECT username , element4map , year , element1id , element2id , element3id , element4id , ROW_NUMBER() OVER (PARTITION BY element4map, year ORDER BY username ASC) rn FROM "finopscenterq_db"."user_mapping" WHERE iscurrent = true ) WHERE (rn = 1) ) um ON ((base.element4map = um.element4map) AND (YEAR(base.am_start_date) = um.year))) ``` Resource View ``` CREATE OR REPLACE VIEW "finopscenter_resource_view_e1" AS SELECT accountid , account_name , resourceid , claimedby , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , workload , isactive , "year" , releasedby , cr_start_date , cr_end_date , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , claimed_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee FROM FinOpsCenter_claimed_resource_view_e1 UNION ALL SELECT accountid , account_name , resourceid , null , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , 'Unallocated' , null , null , null , null , null , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , shared_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee FROM FinOpsCenter_shared_resource_view_e1 ``` ``` CREATE OR REPLACE VIEW "finopscenter_resource_view_e2" AS SELECT accountid , account_name , resourceid , claimedby , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , workload , isactive , "year" , releasedby , cr_start_date , cr_end_date , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , claimed_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee FROM FinOpsCenter_claimed_resource_view_e2 UNION ALL SELECT accountid , account_name , resourceid , null , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , 'Unallocated' , null , null , null , null , null , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , shared_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee FROM FinOpsCenter_shared_resource_view_e2 ``` ``` CREATE OR REPLACE VIEW "finopscenter_resource_view_e3" AS SELECT accountid , account_name , resourceid , claimedby , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , workload , isactive , "year" , releasedby , cr_start_date , cr_end_date , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , claimed_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee FROM FinOpsCenter_claimed_resource_view_e3 UNION ALL SELECT accountid , account_name , resourceid , null , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , 'Unallocated' , null , null , null , null , null , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , shared_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee FROM FinOpsCenter_shared_resource_view_e3 ``` ``` CREATE OR REPLACE VIEW "finopscenter_resource_view_e4" AS SELECT accountid , account_name , resourceid , claimedby , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , workload , isactive , "year" , releasedby , cr_start_date , cr_end_date , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , claimed_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee , distributor_discount , bundled_discount , private_rate_discount , edp_discount , spp_discount FROM FinOpsCenter_claimed_resource_view_e4 UNION ALL SELECT accountid , account_name , resourceid , null , element1_id , element2map , element3map , element4map , element2_id , element3_id , element4_id , 'Unallocated' , null , null , null , null , null , usage_date , payer_account_id , billing_entity , product_code , operation , charge_type , usage_type , pricing_unit , region , item_description , legal_entity , pricing_term , instance_type , product_family , service , product_to_location , reservation_a_r_n , savings_plan_a_r_n , aws_product , percentage , am_start_date , am_end_date , account_type , "user" , spending_type , savings_plan_effective_cost , reservation_effective_cost , usage_quantity , unblended_cost , shared_cost "cost" , credit , fee , savings_plan_coverage , tax , ri_fee , discounted_usage , savings_plan_negation , saving_plan_recurring_fee , refund , saving_plan_upfront_fee , distributor_discount , bundled_discount , private_rate_discount , edp_discount , spp_discount FROM FinOpsCenter_shared_resource_view_e4 ``` ### Updated Views Summary The following 14 views were created or updated in 26.4.0. Base views: finopscenter\_claimed\_resource\_base\_view and finopscenter\_shared\_resource\_base\_view. Claimed element views: finopscenter\_claimed\_resource\_view\_e1 through e4. Shared element views: finopscenter\_shared\_resource\_view\_e1 through e4. Resource views (UNION ALL of claimed + shared): finopscenter\_resource\_view\_e1 through e4. The e4-level resource views include the five discount columns in both the claimed and shared SELECT statements. # Liquid Glass Theme FinOps Center 26.4.0 introduces the Liquid Glass theme system with two custom QuickSight themes: agent-bill-light (based on CLASSIC) and agent-bill-dark (based on MIDNIGHT). Both themes use the Open Sans font family with sans-serif fallback and feature a teal/amber accent palette with FBBF24 (amber/gold) as the accent foreground color. The dark theme is the default across the entire FinOps Center application. Themes are deployed at the account level using the update-account-settings API. Below are the CLI Commands to install the Agent Bill Light and Dark Liquid Glass Themes with the Account Permissions. ``` aws quicksight create-theme \ --aws-account-id AWSACCOUNT# \ --theme-id "agent-bill-light" \ --name "Agent Bill Light" \ --base-theme-id "CLASSIC" \ --configuration '{"DataColorPalette":{"Colors":["#0D9488","#F97316","#3B82F6","#10B981","#8B5CF6","#EC4899","#06B6D4","#F59E0B","#6366F1","#14B8A6"],"MinMaxGradient":["#CCFBF1","#0D9488"],"EmptyFillColor":"#E5E7EB"},"UIColorPalette":{"PrimaryForeground":"#1F2937","PrimaryBackground":"#FFFFFF","SecondaryForeground":"#6B7280","SecondaryBackground":"#F8FAFC","Accent":"#0D9488","AccentForeground":"#FFFFFF","Danger":"#EF4444","DangerForeground":"#FFFFFF","Warning":"#F97316","WarningForeground":"#FFFFFF","Success":"#10B981","SuccessForeground":"#FFFFFF","Dimension":"#3B82F6","DimensionForeground":"#FFFFFF","Measure":"#0D9488","MeasureForeground":"#FFFFFF"},"Sheet":{"Tile":{"Border":{"Show":false}},"TileLayout":{"Gutter":{"Show":true},"Margin":{"Show":true}}},"Typography":{"FontFamilies":[{"FontFamily":"Open Sans"},{"FontFamily":"sans-serif"}]}}' \ --region us-east-1 ``` ``` // aws quicksight create-theme \ --aws-account-id AWSACCOUNT# \ --theme-id "agent-bill-dark" \ --name "Agent Bill Dark" \ --base-theme-id "MIDNIGHT" \ --configuration '{"DataColorPalette":{"Colors":["#14B8A6","#F97316","#3B82F6","#10B981","#A78BFA","#F472B6","#22D3EE","#FBBF24","#818CF8","#2DD4BF"],"MinMaxGradient":["#134E4A","#14B8A6"],"EmptyFillColor":"#374151"},"UIColorPalette":{"PrimaryForeground":"#FFFFFF","PrimaryBackground":"#0F172A","SecondaryForeground":"#FFFFFF","SecondaryBackground":"#1E293B","Accent":"#14B8A6","AccentForeground":"#FFFFFF","Danger":"#F87171","DangerForeground":"#FFFFFF","Warning":"#F97316","WarningForeground":"#FFFFFF","Success":"#10B981","SuccessForeground":"#FFFFFF","Dimension":"#FFFFFF","DimensionForeground":"#FFFFFF","Measure":"#FFFFFF","MeasureForeground":"#FFFFFF"},"Sheet":{"Tile":{"Border":{"Show":false}},"TileLayout":{"Gutter":{"Show":true},"Margin":{"Show":true}}},"Typography":{"FontFamilies":[{"FontFamily":"Open Sans"},{"FontFamily":"sans-serif"}]}}' \ --region us-east-1 ``` Allow Permissions Replace light for dark for light mode permissions to enable both themes. ``` // aws quicksight update-theme-permissions \ --aws-account-id AWSACCOUNT# \ --theme-id "agent-bill-dark" \ --grant-permissions '[ { "Principal": "arn:aws:quicksight:us-east-1:AWSACCOUNT#:namespace/default", "Actions": [ "quicksight:DescribeTheme", "quicksight:DescribeThemeAlias", "quicksight:ListThemeAliases", "quicksight:ListThemeVersions" ] } ]' \ --region us-east-1 ``` ### Theme Deployment The default theme is set at the account level using the update-account-settings API. Once the themes are created and permissions granted, set the dark theme as the account default to apply it across all dashboards and embedded experiences automatically. ### Known Limitations QuickSight themes do not fully apply to the Q/Chat visuals panel within embedded experiences. The chat response area and generated visuals may not inherit the custom theme colors. As a workaround, brand customization is used instead of themes for the embedded chat component. Theme inheritance does not propagate to all QuickChat UI elements, so the FinOps Center application CSS applies additional dark mode styling to ensure visual consistency across the full interface. # Filter Null Values To assist with the user experience, we recommended that Filter Null Values are created for the Service and Product Family Services within each Topics Data Configuration

# Embedded Data Assistant Agent Bill 2.0 uses Amazon QuickSight embedded QuickChat (Quick Suite) to provide an AI-powered data assistant directly within the FinOps Center application. This is a migration from the previous embedded Q\&A (Q Bar) approach. Each role gets a dedicated chat agent with persona-specific instructions, topic access, and optional MCP actions for workflow ### Architecture ### The embedded QuickChat integration uses an AppSync backend with a TypeScript Lambda function. When a user opens Agent Bill in FinOps Center, the application calls generate-embed-url-for-registered-user via AppSync, passing the user's Cognito identity to resolve their QuickSight registered user. The embed URL is configured with experience-configuration set to QuickChat and a fixedAgentArn in contentOptions that routes the user to their role-specific chat agent. The QuickSight Embedding SDK (awslabs/amazon-quicksight-embedding-sdk) renders the chat interface within the application. ### ### Quick Actions and MCP Integration ### Agent Bill 2.0 supports Quick Actions via MCP (Model Context Protocol) integration through Quick Spaces. When a persona instruction routes a query to ACTION/TASKS, the chat agent can trigger workflow actions such as budget management, spend card operations, and resource management. These actions are backed by GraphQL mutations via AppSync with Cognito authentication. Quick Spaces are configured in the QuickSight console and must be shared with the appropriate user groups. Note that the automation framework creates Athena queries, datasets, RLS, and topics automatically, but Spaces and embedded chat configuration are manual steps. ### ### Configuration in FinOps Center ### Agent Bill is configured in the FinOps Center application via the Configuration page. Financial Admins navigate to Configuration > Agent Bill Configuration to enable Amazon Q Topics and map agent IDs to roles. Each role has a unique agent ID and view ID that connects the FinOps Center application role to the correct QuickSight chat agent. The QuickSight Environment settings (Region, Account) are also configured on this page. ### ### Additional IAM Permissions ### The embedded QuickChat integration requires additional IAM permissions beyond standard QuickSight embedding. The embedding policy currently uses resource \* and will need scoping for Marketplace onboarding. MCP actions require specific QuickSight action permissions beyond the standard Cognito read-only role. Actions may work in the QuickSight console but require additional sharing configuration to function in the embedded context. Q Business console settings may also need configuration for action authorization. ### ### Troubleshooting ### If the default QuickSight chat loads instead of the role-specific Agent Bill chat, verify that fixedAgentArn is set correctly in contentOptions. If users see embed failures, check their QuickSight user status via the CLI command describe-user — users with INACTIVE status will not be able to load the embedded chat. If MCP actions fail with permission errors in the embedded context but work in the QuickSight console, check that the additional IAM policies and QuickSight sharing configuration have been applied. Ensure allowedDomains in the QuickSight management console includes the FinOps Center application domain.automation.

# Row Level Security Agent Bill for Amazon Q in Quicksight was built considering the challenge for Row Level Security. Each Role has their Athena Queries, QuickSight Datasets, and QuickSight Topics. The Dataset are configured with User-based rules leveraging FinOps Center User table for Financial Scope. Users Scope is updated when the Dataset's SPICE is Refreshed.

Users see their Data in Scope of their Users Allocation of Accounts and Financial Budgets configured in FinOps Center. In image below, FinOps Center users Products on the left are what are reflected in Embedded Amazon Q.

# Forecasting Agent Bill leverages Amazon Q in QuickSight's Forecasting Algorithm to provide users expected spending aligned to their Financial Scope.

# Quick Sight Topic Custom Instructions QuickSight Topics support custom instructions that guide how Agent Bill interprets and responds to natural language queries. In 26.4.0, topic-level custom instructions work alongside persona-level instructions (configured per role in the Custom Instruction page) to provide layered context. Topic instructions are shared across all users of that topic, while persona instructions are role-specific. Custom instructions can be managed via the QuickSight API using DescribeTopic (returns CustomInstructionsString), CreateTopic, and UpdateTopic operations. The character limit for topic custom instructions is approximately 3,000 characters. To assist the Quick Sight Topic understand how business weeks are defined, each topics needs to have a Custom Instruction

Customer Instruction Week are defined by sunday to saturday. the first week of each month starts the 1st of month to saturday 23:59. The last week of the month starts Sunday 00:01 to the last day of that month. Normal weeks are sunday to saturday. When Forecasting only show the past 2 months and then the forecast for the selected time ### Business Week Alignment (v2) In version 26.4.0, the business week calendar guidelines were restructured to enforce Sunday-based week definitions consistently. The updated custom instruction text for each topic should include explicit week boundary definitions: W1 starts on the 1st of the month and ends on the first Saturday. W2 through W5 run Sunday 00:00 to Saturday 23:59. W6 (if present) starts on the last Sunday and ends on the last day of the month. For example, "week 2 of January 2026" refers to January 5-11 (Sunday through Saturday). These week definitions must align with the business\_week\_number and business\_week\_label calculated fields in the dataset to ensure consistent results between direct queries and weekly aggregations. ### API Management Topic custom instructions can be programmatically managed through the QuickSight API. Use DescribeTopic to retrieve the current custom instructions via the CustomInstructionsString field in the response. Use CreateTopic or UpdateTopic to set or update custom instructions by including the CustomInstructions parameter. This enables automated deployment of instruction updates across all four topics (Cost Management, Container Allocation, Marketplace Spending, Savings Plans Management) without manual console interaction. # Persona Instructions Guide How Agent Bill's persona instruction system works — routing logic, topic assignments, template structure, and API management. Agent Bill uses a persona instruction system to deliver role-specific AI assistance within FinOps Center. Each persona instruction is a structured text block embedded in a QuickSight Topic that controls how Agent Bill responds to a specific user role. The instructions define the agent's identity, data scope, query routing logic, available topics, and business context. This page documents the structure, routing logic, per-role configuration, and management of persona instructions. ### How Persona Instructions Work Persona instructions sit within QuickSight Topics and are delivered to Agent Bill through the Amazon Quick Suite architecture chain: Dataset (with RLS) → Topic (with persona instructions) → Space (topics + MCP actions) → Chat Agent → Embedded in FinOps Center. When a user opens Agent Bill in the FinOps Center application, the system identifies their role via Cognito authentication, routes them to their dedicated QuickSight Chat Agent (via fixedAgentArn), and the agent loads the persona instruction associated with that role's topic. ### Query Routing Logic Every persona instruction defines how Agent Bill classifies and routes incoming user queries into one of three categories: * DATA ONLY (Q Topics) — Cost queries, spending analysis, usage reports, and any question that can be answered from the QuickSight dataset. Agent Bill queries the semantic model directly. Examples: "What was my EC2 spend last week?", "Show me container costs by pod." * ACTION/TASKS (MCP Server) — Workflow actions that modify data in FinOps Center via the MCP server backend. These are routed to Quick Spaces actions rather than dataset queries. Examples: "Accept my spend card for week 2", "Submit my budget for approval", "Claim this resource for my workload." * COMBINED (Data + Action) — Queries that require both data retrieval and a workflow action. For example, "Show me my budget vs actuals and submit a reschedule request" combines a data query with an MCP action. ### Topic Routing For DATA ONLY queries, persona instructions also define which QuickSight Topic to route to. There are 4 topics available in Agent Bill 2.0, and not all roles have access to all topics: * Cost Management (default topic) — The primary topic for all roles. Handles general spending, budget, and cost allocation queries. All personas default to this topic unless a more specific topic applies. * Container Allocation — Routes container-specific queries (EKS, ECS, pods, tasks, Kubernetes). Triggered when the user mentions container, pod, task, EKS, ECS, or k8s keywords. Available to Financial Admins, Department Managers, Portfolio Managers, Product Owners, and Cloud Engineers. * Marketplace Spending — Vendor-specific cost filtering and marketplace analytics. Currently available to Financial Admins only. When other roles ask about marketplace spending, the persona instruction redirects them to contact the FinOps team. * Savings Plans Management — Savings plan coverage, savings amounts, and effective cost analysis. Currently available to Financial Admins only. Other roles are redirected to the FinOps team for savings plan inquiries. ### Instruction Template Structure Each persona instruction follows a consistent template structure. The total instruction must stay within approximately 3,200 characters (the QuickSight topic custom instruction limit). The template sections are: #### 1. Agent Identity Opens with "You are Agent Bill, an AI assistant helping \[Role Name] manage cloud spending for their assigned \[Scope]..." This establishes the agent's name, the user's role, and the organizational scope (e.g., product, portfolio, department, or business unit). The identity section also lists the user's primary responsibilities so Agent Bill understands what tasks the user performs in FinOps Center. #### 2. Data Scope Defines the cost hierarchy terminology that applies to this role. Uses the FinOps Center budget hierarchy: Business Unit = Element 1 (E1), Department = Element 2 (E2), Portfolio = Element 3 (E3), Product = Element 4 (E4). The data scope tells Agent Bill which level of the hierarchy this user operates at, and what cost allocation model applies (Budget → Account Allocation % → Workload → Resources). #### 3. Query Classification Rules Explicit rules for how to classify each incoming query as DATA ONLY, ACTION/TASKS, or COMBINED. This section defines keywords and patterns that trigger each routing path. For roles with MCP actions (Product Owners, Cloud Engineers), this section is more detailed because those roles can both query data and perform workflow actions. #### 4. Topic Routing Rules Specifies the default topic (Cost Management for all roles) and when to route to specialized topics. For example, container-related keywords (pod, task, EKS, ECS, Kubernetes, k8s) trigger routing to the Container Allocation topic. Also defines unavailable topics for the role — when a user asks about a topic they don't have access to (e.g., Marketplace or Savings Plans for non-admin roles), Agent Bill responds with a redirect message: "For \[topic] inquiries, please contact your FinOps team." #### 5. Cost Metric Definitions Defines the key cost fields Agent Bill should use when answering queries: "cost" (combined claimed + shared cost), "net\_cost" (after discounts), discount columns (distributor, private\_rate, bundled, edp, spp), and credit visibility rules. Credits are only visible to Financial Admin personas — other roles do not see credit-related fields. #### 6. Calendar Guidelines (Business Week Alignment) Critical section that enforces FinOps Center's Sunday-to-Saturday business week definition. All weeks run SUNDAY to SATURDAY (not the default Monday-Sunday). The instruction includes explicit week definitions (W1 through W6) for each month, with rules for partial first and last weeks. The "SUNDAY to SATURDAY" rule is stated at the top of this section and reinforced at the bottom as a reminder. This ensures that when users ask "show me week 2 spending," Agent Bill uses the correct date range aligned to FinOps Center's period cards. #### 7. Response Formatting Guidelines Optional section that controls how Agent Bill formats its responses. May include instructions to always show costs in USD, include time period labels, group by specific dimensions, or present data in a particular format suited to the role's needs. ### Per-Role Topic Assignments The following table summarizes which topics and capabilities are available to each role's persona instruction. Full persona instructions for each role are documented on the QuickChat Personas page. * Financial Admins — Topics: Cost Management, Container Allocation, Marketplace Spending, Savings Plans Management. Credits: Yes. MCP Actions: No (admin oversight role). Scope: Full organization. * Business Unit Managers — Topics: Cost Management only. Credits: No. MCP Actions: No. Scope: Business unit (E1), view-only. * Department Managers — Topics: Cost Management, Container Allocation. Credits: No. MCP Actions: No. Scope: Department (E2), view-only. * Portfolio Managers — Topics: Cost Management, Container Allocation. Credits: No. MCP Actions: No (but manage spend card governance and budget approvals through the FinOps Center UI). Scope: Portfolio (E3). * Product Owners — Topics: Cost Management, Container Allocation. Credits: No. MCP Actions: Yes (accept spend cards, submit budgets, request reschedules). Scope: Product (E4). * Cloud Engineers — Topics: Cost Management, Container Allocation. Credits: No. MCP Actions: Yes (claim resources, implement optimizations, manage workloads). Scope: Product (E4). ### Managing Persona Instructions via API Persona instructions can be managed programmatically using the AWS QuickSight API. This is essential for version control, bulk updates across roles, and automated deployment pipelines. The three relevant API operations are: * DescribeTopic — Retrieves the current persona instruction for a topic. The custom instruction is returned in the CustomInstructions object via the CustomInstructionsString field. Use this to read and verify instructions before making changes. * CreateTopic — Creates a new topic with a persona instruction included at creation time via the CustomInstructions field. Used when setting up Agent Bill for a new role or creating a new environment. * UpdateTopic — Modifies the persona instruction on an existing topic. This is the primary API for iterating on instructions. Use DescribeTopic first, modify the instruction text, then call UpdateTopic to apply changes. ### Best Practices for Creating and Iterating on Instructions * Stay within the \~3,200 character limit. QuickSight topic custom instructions have a hard character limit. If your instruction exceeds this, prioritize the routing rules and calendar guidelines over verbose descriptions. * Reinforce critical rules at both the beginning and end of the instruction. The business week definition ("SUNDAY to SATURDAY") is stated at the top and repeated at the bottom because AI models can lose track of rules in the middle of long instructions. * Test with real user queries after each iteration. Use the QuickSight embedded chat preview to test questions like "What was my spend last week?" and verify the response uses the correct date range and topic. * Use calculated fields in the dataset rather than the topic instruction when possible. For example, business\_week\_number and business\_week\_label were initially attempted as topic expressions but were moved to dataset calculated fields for reliability. * Keep instructions consistent across roles. All personas should use the same terminology section, the same calendar guidelines, and the same cost metric definitions. Only the agent identity, data scope, and routing rules should differ between roles. * Version your instructions. Use the API (DescribeTopic) to save a copy of the current instruction before making changes. This allows rollback if a new version causes unexpected behavior. # Operational # Athena Queries Clean Up Agent Bill loads data to Quick Sight via Athena for each role. Depending on the number of refreshes that customer configure, there will be at least 6 queries each day of large datasets. Query results bucket should have a lifecycle rule that deletes bucket results every 30 days to avoid undue costs.

# Installation Prerequisites ## Prerequisites for Agent Bill Amazon Q in QuickSight for FinOps Center Agent Bill Amazon Q for QuickSight For FinOps Center brings the power of Amazon Q to your FinOps Users. To be able to be installed, Customers need to have one of the FinOps Center versions installed, have FinOps Center Minimal Setup Complete (See Below), and have Amazon Q in QuickSiight enabled in there environment with at least 1 Author Pro Enabled with Embedding of your FinOps Center application configured. FinOps Center Minimal Setup for the Amazon Q in QuickSight Framework: 1. One Product Owner Onboarded 2. One Budget Onboarded and Mapped to Product Owner 3. One AWS Account Mapped to Budget 4. One Workload Created to the Mapped AWS Account 5. One Resource Claimed to the Workload All FinOps Center underlying compute (including Amazon Q in QuickSight) is the responsibility of Customers. Pricing for Amazon Q in QuickSight - *A $250/month per account Amazon Q enablement fee applies for accounts with at least one Pro user or with at least one Amazon Q Topic.* ![](https://static.helpjuice.com/helpjuice_production/uploads/upload/image/22503/direct/1730481335686/image.png)Click to Zoom ![](https://static.helpjuice.com/helpjuice_production/uploads/upload/image/22503/direct/1740414080699/image.png)Click to Zoom To Install Agent Bill Amazon Q in QuickSight for FinOps Center customer must Add 1 Author Pro User to their QuickSight Environment. Embedding must be enabled with the url of the FinOps Center Application.

# Installation Disclosures Upon considering to install the Amazon Q in QuickSight FinOps Center Framework please be aware of the following: 1. Lambda code hosted in your S3 buckets are not ingested nor scanned by AWS Marketplace. This creates an external dependency. Applications that require external dependencies on deployment must follow product usage policies which includes proper disclosure. In the Release Notes of each FinOps Center Release include the results of the AWS CodeGuru Scan. 2. FinOpsCenterQGlueCrawlerRole295A8956 : add a warning in your deployment guide, product access instructions, or clusters and resources long descriptions that customers should consider deploying into new AWS accounts because the permissions allow your application access to read, edit, and/or delete existing AWS resources in the AWS account. 3. Other IAM roles: The purpose of each of these resources must be included in the product description or usage instructions. IAM Roles are listed with purpose at 4. The Role [AmazonQFramework-FinOpsCenterQGlueCrawlerRole](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQFramework-FinOpsCenterQGlueCrawlerRole295A89-hhZjT5ZET65W)\* leverages the Glue Services Role that enables the solution to Access additional resources than the scope of Amazon Q in QuickSight FinOps Center. I**f this is an issue, consider deploying in stand alone AWS Account.** 5. AWS Marketplace Scans the AMIs that Cloud Scal3 Provides but not the Code Artifacts that are used during the installation. Please view the results of our internal code scanning with AWS CodeGenius with the version Release Notes that you are installing. # IAM Roles and Purpuse The CFT for the Backend Framework Setup and the creation of the QuickSight components create IAM in the AWS Account that it is installed. Below is the list of the Roles and their Purpose: | Role | Purpose | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | | [AmazonQFramework-AWS679f53fac002430cb0da5b7982bd228-fnZ708s887E8](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQFramework-AWS679f53fac002430cb0da5b7982bd228-fnZ708s887E8) | IAM Execution role to Extract Data from DynamoDB Tables | | [AmazonQFramework-CustomCDKBucketDeployment8693BB649-unoj2GSZ3VOE](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQFramework-CustomCDKBucketDeployment8693BB649-unoj2GSZ3VOE) | Lambda to write data into s3 bucket | | [AmazonQFramework-FinOpsCenterQDynamoDataExtractorHa-4oYQql0QJxly](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQFramework-FinOpsCenterQDynamoDataExtractorHa-4oYQql0QJxly) | Lambda to read data from dynamodb tables | | [AmazonQFramework-FinOpsCenterQGlueCrawlerRole295A89-hhZjT5ZET65W](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQFramework-FinOpsCenterQGlueCrawlerRole295A89-hhZjT5ZET65W) | Lambda to setup glue crawlers | | [AmazonQFramework-FinOpsCenterQStaticWebsiteConfigUp-Z0oTD3Mcp1LS](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQFramework-FinOpsCenterQStaticWebsiteConfigUp-Z0oTD3Mcp1LS) | Lambda to update config in s3 bucket | | [AmazonQFramework-QuickSightServiceRole7B637E2B-GUb2vDYNGq13](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQFramework-QuickSightServiceRole7B637E2B-GUb2vDYNGq13) | Lambda to setup quicksight assets | | [AmazonQSetup-FinOpsCenterQAthenaNamedQueryLambdaSer-fdcJdVlzMAam](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQSetup-FinOpsCenterQAthenaNamedQueryLambdaSer-fdcJdVlzMAam) | Lambda to execute named queries on athena | | [AmazonQSetup-FinOpsCenterQDatasetRefreshCheckerServ-Iu75IkVuIcBB](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQSetup-FinOpsCenterQDatasetRefreshCheckerServ-Iu75IkVuIcBB) | Lambda to check quicksight dataset refresh status | | [AmazonQSetup-FinOpsCenterQExecuteLambdaToCreateAthe-p2fB1nlcQtYy](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQSetup-FinOpsCenterQExecuteLambdaToCreateAthe-p2fB1nlcQtYy) | Lambda to create and database on athena which connects to s3 | | [AmazonQSetup-FinOpsCenterQQuicksightAssetsSetupLamb-xVyxccSdwusB](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQSetup-FinOpsCenterQQuicksightAssetsSetupLamb-xVyxccSdwusB) | Lambda to create datastores, datasets, themes on quicksight | | [AmazonQSetup-FinOpsCenterQQuicksightAssetsSetupLamb-xVyxccSdwusB](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQSetup-FinOpsCenterQQuicksightAssetsSetupLamb-xVyxccSdwusB) | Lambda to create datastores, datasets, themes on quicksight | | [AmazonQSetup-FinOpsCenterQTopicCreatorServiceRole89-GKJTnYXFpwCC](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles/details/AmazonQSetup-FinOpsCenterQTopicCreatorServiceRole89-GKJTnYXFpwCC) | Lambda to create topics on quicksight | # Installation Best Practices Agent Bill Amazon Q in QuickSight for FinOps Center is installed with currated Topics that can be customized to your organizational naming convention.

Each Topics need to be Modified to your Organization.

Additional Hints to provide the best expereince for your Users Select Non Additive for the Monthly Periods

# Agent Bill Bedrock Agent ## Agent Bill Bedrock Agent provides a Beckrock Client interface to Vendor Managers, Financial Admin, and Cloud Engineer FinOps Center users.

# Installation Prerequisites ## Prerequisites for Agent Bill Bedrock Agent for FinOps Center Agent Bill Bedrock Agent provides a Beckrock Client interface to Vendor Managers, Financial Admin, and Cloud Engineer FinOps Center users. # Legal Notices # Privacy Statement Privacy Policy for Cloud Scal3 Inc. Last Updated: October 24, 2024 At Cloud Scal3 Inc. (“we,” “us,” or “our”), we value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard the information you provide when visiting our website, \[[www.cloudscal3.com\]\$http://www.cloudscal3.com)](https://docs.finopscenter.com/legal-notices/http:/www.cloudscal3.com]\\\(http:/www.cloudscal3.com$), and [www.finopcenter.com](http://www.finopcenter.com) or interacting with us. 1\. Information We Collect We may collect and process the following types of personal data: \- Contact Information: This includes your name, email address, phone number, and any other contact details you provide.\ \- Usage Data: Information about how you interact with our website, such as IP address, browser type, time zone, referring/exit pages, and clickstream data.\ \- Marketing Data: Information about your preferences and interests, which may include responses to marketing campaigns or surveys you participate in.\ \- Cookies and Tracking Technologies: We use cookies and similar tracking technologies to enhance your experience, understand your preferences, and deliver targeted advertisements. 2\. How We Use Your Information We use the information we collect in the following ways: \- To Improve Our Website: We analyze data to understand how visitors use our site, ensuring it is easy to navigate and tailored to user needs.\ \- To Communicate with You: We may use your contact information to send you promotional content, newsletters, updates, or respond to your inquiries.\ \- For Marketing Purposes: We use your information to provide personalized advertisements and special offers based on your interests, either through our website or third-party marketing partners.\ \- To Comply with Legal Obligations: We may process your data to comply with legal requirements or respond to legal requests. 3\. Sharing Your Information We do not sell your personal data. However, we may share your information with: \- Service Providers: Third-party vendors who assist us in providing website functionality, marketing services, analytics, and other business operations.\ \- Advertising Partners: Marketing agencies and advertisers to help deliver tailored content and ads that may interest you.\ \- Legal Authorities: When necessary to comply with legal obligations, prevent fraud, or protect the rights of Cloud Scal3 Inc. and others. 4\. Data Retention We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy, or as required by law. You may request deletion of your data by contacting us at \[insert contact email]. 5\. Your Privacy Choices You have the following rights regarding your personal data: \- Opt-Out: You can opt out of receiving marketing communications by following the unsubscribe instructions in the emails we send or contacting us directly.\ \- Access and Correction: You may request access to, correction of, or deletion of your personal data by contacting us.\ \- Cookie Preferences: You can manage your cookie settings through your browser or our cookie consent tool. 6\. Security We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, or alteration. 7\. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post any updates on this page and notify you of significant changes through our website or other communication channels. 8\. Contact Us If you have any questions about this Privacy Policy or our data practices, please contact us at: Cloud Scal3 Inc. \ Email: # Cookie Policies Cookie Policy for Cloud Scal3 Inc. Last Updated: October 24,2024 Cloud Scal3 Inc. ("we," "us," or "our") uses cookies and similar tracking technologies to enhance your experience and analyze how our websites, \[[www.cloudscal3.com\]\$http://www.cloudscal3.com)](https://docs.finopscenter.com/legal-notices/http:/www.cloudscal3.com]\\\(http:/www.cloudscal3.com$) and \[[www.finopscenter.com\]\$http://www.finopscenter.com)](https://docs.finopscenter.com/legal-notices/http:/www.finopscenter.com]\\\(http:/www.finopscenter.com$), are used. This Cookie Policy outlines how we use these technologies for marketing purposes. 1\. What Are Cookies? Cookies are small text files stored on your device when you visit a website. They help us remember your preferences, understand how you interact with our websites, and provide tailored content, including personalized marketing messages. 2\. Types of Cookies We Use We use the following types of cookies on our websites: \- Essential Cookies: These cookies are necessary for the operation of our websites and enable features like secure login and form submissions. They cannot be disabled.\ \ \- Analytical/Performance Cookies: These cookies help us understand how visitors use our websites, which pages are popular, and how we can improve site performance. \- Marketing/Advertising Cookies: These cookies track your online activity to deliver personalized ads relevant to your interests. We use these cookies to analyze user behavior and ensure our marketing efforts are effective. \- Third-Party Cookies: In some cases, we use third-party service providers (e.g., advertising networks, analytics services) that set cookies on our behalf to deliver tailored advertisements and analyze website traffic. 3\. How We Use Cookies for Marketing We use cookies to: \- Understand User Preferences: We track how you interact with our websites to understand your preferences and deliver personalized marketing content.\ \- Display Targeted Ads: We use marketing cookies to deliver relevant ads on our websites and other platforms based on your interests and browsing behavior.\ \- Measure Campaign Effectiveness: Cookies help us analyze the performance of marketing campaigns to optimize our advertising efforts. 4\. Managing Your Cookie Preferences You have the right to manage or disable cookies. Here’s how: \- Cookie Consent Tool: You can manage your preferences through the cookie consent tool that appears on our websites when you first visit or by clicking on the “Cookie Settings” link available on our website footer.\ \- Browser Settings: You can adjust your browser settings to refuse cookies or delete existing cookies. However, this may affect the functionality of our websites.\ \- Opt-Out of Targeted Advertising: You can opt out of personalized advertising by adjusting your preferences on advertising platforms or using industry opt-out tools like the \[Network Advertising Initiative]\() or \[Digital Advertising Alliance]\(). 5\. Data Protection and Privacy Cookies may collect personal data, such as IP addresses or unique identifiers, to tailor marketing efforts. For more details on how we handle personal data, please refer to our \[Privacy Policy]\(#). 6\. Changes to This Cookie Policy We may update this Cookie Policy periodically to reflect changes in our practices or legal requirements. We will notify you of significant changes through our websites or other communication channels. 7\. Contact Us If you have any questions about this Cookie Policy or how we use cookies, please contact us: Cloud Scal3 Inc. \ Email: --- [Next Page](/llms-full.txt/1)