{"id":39186519,"url":"https://github.com/pfrederiksen/cost-blame","last_synced_at":"2026-01-17T22:39:33.804Z","repository":{"id":332478757,"uuid":"1133906304","full_name":"pfrederiksen/cost-blame","owner":"pfrederiksen","description":"Local-first CLI to attribute AWS cost spikes to services, tags, and likely resources.","archived":false,"fork":false,"pushed_at":"2026-01-14T03:28:38.000Z","size":52,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-14T05:51:21.505Z","etag":null,"topics":["aws","aws-sdk-go-v2","cli","cloudops","cost-explorer","devops","finops","go"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pfrederiksen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-14T01:26:06.000Z","updated_at":"2026-01-14T03:28:23.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/pfrederiksen/cost-blame","commit_stats":null,"previous_names":["pfrederiksen/cost-blame"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/pfrederiksen/cost-blame","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfrederiksen%2Fcost-blame","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfrederiksen%2Fcost-blame/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfrederiksen%2Fcost-blame/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfrederiksen%2Fcost-blame/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pfrederiksen","download_url":"https://codeload.github.com/pfrederiksen/cost-blame/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfrederiksen%2Fcost-blame/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28521165,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-17T22:11:28.393Z","status":"ssl_error","status_checked_at":"2026-01-17T22:11:27.841Z","response_time":85,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-sdk-go-v2","cli","cloudops","cost-explorer","devops","finops","go"],"created_at":"2026-01-17T22:39:33.746Z","updated_at":"2026-01-17T22:39:33.798Z","avatar_url":"https://github.com/pfrederiksen.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cost-blame\n\n[![Test](https://github.com/pfrederiksen/cost-blame/actions/workflows/test.yml/badge.svg)](https://github.com/pfrederiksen/cost-blame/actions/workflows/test.yml)\n[![Release](https://img.shields.io/github/v/release/pfrederiksen/cost-blame)](https://github.com/pfrederiksen/cost-blame/releases)\n[![Go Report Card](https://goreportcard.com/badge/github.com/pfrederiksen/cost-blame)](https://goreportcard.com/report/github.com/pfrederiksen/cost-blame)\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)\n\n\u003e Local-first CLI to attribute AWS cost spikes to services, tags, and likely resources.\n\n**cost-blame** helps CloudOps and FinOps teams answer the critical question: **\"Who or what caused our AWS spend to rise?\"**\n\nBuilt with Go, it runs entirely locally using AWS Cost Explorer and Resource APIs—no backend required.\n\n## Features\n\n- **Spike Detection**: Identify cost increases across services, regions, accounts, or tags\n- **Anomaly Detection**: Statistical analysis with z-score for detecting unusual cost patterns\n- **New Spender Identification**: Find resources that just started incurring costs\n- **Tag-based Attribution**: Blame cost changes on teams, apps, or environments via tags\n- **Resource Drilldown**: Map cost spikes to specific EC2, RDS, S3, Lambda, CloudFront, ECS, EKS resources\n- **Multi-Account Support**: Query across AWS Organizations or filter specific accounts\n- **Export Options**: CSV export and Slack webhook integration for alerts\n- **Flexible Output**: Human-readable tables or JSON for automation\n- **AWS SDK v2**: Fast, modern AWS integration with proper pagination and rate limiting\n\n## Installation\n\n### Homebrew (Recommended)\n\n```bash\n# Add the tap\nbrew tap pfrederiksen/tap\n\n# Install cost-blame\nbrew install cost-blame\n\n# Upgrade to latest version\nbrew upgrade cost-blame\n```\n\n### Download Pre-built Binaries\n\nDownload the latest release for your platform from the [releases page](https://github.com/pfrederiksen/cost-blame/releases):\n\n**macOS (Intel)**\n```bash\ncurl -L https://github.com/pfrederiksen/cost-blame/releases/latest/download/cost-blame_0.2.2_Darwin_x86_64.tar.gz | tar xz\nsudo mv cost-blame /usr/local/bin/\n```\n\n**macOS (Apple Silicon)**\n```bash\ncurl -L https://github.com/pfrederiksen/cost-blame/releases/latest/download/cost-blame_0.2.2_Darwin_arm64.tar.gz | tar xz\nsudo mv cost-blame /usr/local/bin/\n```\n\n**Linux (amd64)**\n```bash\ncurl -L https://github.com/pfrederiksen/cost-blame/releases/latest/download/cost-blame_0.2.2_Linux_x86_64.tar.gz | tar xz\nsudo mv cost-blame /usr/local/bin/\n```\n\n**Linux (arm64)**\n```bash\ncurl -L https://github.com/pfrederiksen/cost-blame/releases/latest/download/cost-blame_0.2.2_Linux_arm64.tar.gz | tar xz\nsudo mv cost-blame /usr/local/bin/\n```\n\n**Windows**\nDownload the `.zip` file from the releases page and extract it to your PATH.\n\n### Using Go\n\n```bash\ngo install github.com/pfrederiksen/cost-blame@latest\n```\n\n### From Source\n\n```bash\ngit clone https://github.com/pfrederiksen/cost-blame.git\ncd cost-blame\nmake build\n# Binary will be in ./bin/cost-blame\n```\n\n### Requirements\n\n- AWS credentials configured (via `~/.aws/credentials` or environment variables)\n- AWS Cost Explorer API access (requires payer account for multi-account visibility)\n- For building from source: Go 1.22+\n\n## Quick Start\n\n### Find top cost increases in the last 7 days\n\n```bash\ncost-blame spike --last 7d --threshold 100 --group-by service\n```\n\n### Attribute costs by team tag\n\n```bash\ncost-blame blame --last 30d --tag-key team\n```\n\n### Drill down into EC2 cost spike\n\n```bash\ncost-blame drilldown AmazonEC2 --last 48h --region us-west-2 --tag-key team\n```\n\n## Commands\n\n### `cost-blame spike`\n\nDetect cost spikes by comparing two equal time periods.\n\n**New in v0.2.0**: Multi-account support, CSV export, Slack webhooks\n\n**Flags:**\n- `--last`: Time window (`48h`, `7d`, `30d`)\n- `--granularity`: `DAILY` or `HOURLY` (default: `DAILY`)\n- `--threshold`: Minimum USD delta to report (default: `0`)\n- `--group-by`: `service`, `linked_account`, `region`, or `usage_type` (default: `service`)\n- `--tag-key`: Optional tag dimension to group by\n- `--accounts`: Filter to specific account IDs (comma-separated)\n- `--all-accounts`: Query all accounts in AWS Organization\n- `--top`: Number of results (default: `10`)\n- `--json`: Output as JSON\n- `--csv`: Export results to CSV file\n- `--slack-webhook`: Send alerts to Slack webhook URL\n- `--profile`: AWS profile\n- `--region`: AWS region (default: `us-east-1`)\n\n**Example:**\n\n```bash\ncost-blame spike --last 7d --threshold 200 --group-by service --top 5\n```\n\n### `cost-blame new-spend`\n\nFind resources that recently started spending.\n\n**Flags:** Same as `spike`, plus:\n- `--min-current`: Minimum current spend to consider (default: `50`)\n\n**Example:**\n\n```bash\ncost-blame new-spend --last 30d --min-current 100 --group-by service\n```\n\n### `cost-blame blame`\n\nAttribute cost changes by tag values.\n\n**Flags:**\n- `--tag-key`: Tag to group by (required)\n- `--tag-values`: Optional CSV filter for specific values\n- Other flags same as `spike`\n\n**Example:**\n\n```bash\ncost-blame blame --last 30d --tag-key team --threshold 50\n```\n\n### `cost-blame drilldown`\n\nMap a service cost spike to likely resources.\n\n**Arguments:**\n- `SERVICE`: AWS service name (e.g., `AmazonEC2`, `AmazonRDS`)\n\n**Flags:**\n- `--last`: Time window\n- `--region`: Filter to specific region\n- `--account`: Filter to specific account ID\n- `--tag-key`: Filter by tag key\n- `--json`: Output as JSON\n\n**Example:**\n\n```bash\ncost-blame drilldown AmazonEC2 --last 48h --region us-west-2\n```\n\n## How It Works\n\n1. **Cost Explorer Queries**: Fetches cost data for current and prior periods\n2. **Delta Calculation**: Computes absolute and percentage changes\n3. **Resource Correlation**: Uses Resource Groups Tagging API and service-specific APIs (EC2, RDS) to identify resources\n4. **Attribution**: Maps costs to tags, teams, or specific resource ARNs\n\n## Permissions Required\n\nMinimum IAM permissions:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ce:GetCostAndUsage\",\n        \"tag:GetResources\",\n        \"ec2:DescribeInstances\",\n        \"ec2:DescribeVolumes\",\n        \"ec2:DescribeNatGateways\",\n        \"ec2:DescribeAddresses\",\n        \"ec2:DescribeSnapshots\",\n        \"rds:DescribeDBInstances\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n**Note**: Cost Explorer requires **payer account** credentials for consolidated billing visibility across linked accounts.\n\n## Configuration\n\ncost-blame respects standard AWS SDK configuration:\n\n- `AWS_PROFILE` / `--profile`\n- `AWS_REGION` / `--region`\n- `~/.aws/credentials` and `~/.aws/config`\n\n## Edge Cases \u0026 Limitations\n\n- **Incomplete Data**: Costs for the current day are not final; tool warns when window includes today\n- **Hourly Granularity**: Cost Explorer has constraints on hourly data retention\n- **Currency**: Assumes USD but displays actual currency from API responses\n- **Permissions**: Continues with partial results if some APIs are inaccessible\n\n## Development\n\n```bash\n# Build\nmake build\n\n# Run tests\nmake test\n\n# Lint (requires golangci-lint)\nmake lint\n\n# Run locally\ngo run main.go spike --last 7d --debug\n```\n\n## CI/CD\n\nThis project uses GitHub Actions for automated testing and releases:\n\n- **Automated Testing**: Every PR and push runs the full test suite\n- **Multi-platform Releases**: Automated builds for Linux, macOS, and Windows (amd64 + arm64)\n- **Semantic Versioning**: Tag a version (e.g., `v0.1.0`) to trigger an automated release\n\n### Creating a Release\n\n```bash\n# Tag the version\ngit tag v0.1.0\n\n# Push the tag to trigger release workflow\ngit push origin v0.1.0\n```\n\nThe release workflow will automatically:\n- Run all tests\n- Build binaries for all platforms\n- Generate checksums\n- Create a GitHub release with installation instructions\n\n## Contributing\n\nContributions welcome! This is an open-source project under the Apache 2.0 license.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feat/amazing-feature`)\n3. Make your changes\n4. Run tests (`make test`)\n5. Commit your changes (`git commit -m 'feat: add amazing feature'`)\n6. Push to the branch (`git push origin feat/amazing-feature`)\n7. Open a Pull Request\n\nAll PRs automatically run tests via GitHub Actions.\n\n## License\n\nApache License 2.0 - see [LICENSE](LICENSE)\n\n## Roadmap\n\n- ✅ Multi-account support via AWS Organizations (v0.2.0)\n- ✅ S3, Lambda, CloudFront, ECS, EKS drilldown (v0.2.0)\n- ✅ Anomaly detection with statistical analysis (v0.2.0)\n- ✅ CSV export and Slack webhook integration (v0.2.0)\n- Interactive TUI mode with bubble tea\n- PagerDuty integration\n- Cost forecasting and trend analysis\n- Budget threshold alerts\n\n---\n\nBuilt with ❤️ for CloudOps teams tired of mystery AWS bills.\n\n### `cost-blame anomaly`\n\nDetect cost anomalies using statistical analysis (z-score).\n\n**Arguments:**\n- `--group-by`: `service` or `linked_account` (default: `service`)\n- `--historical-days`: Number of days for baseline (default: `30`)\n- `--threshold`: Z-score threshold for anomaly detection (default: `2.0`)\n- `--min-data-points`: Minimum data points required (default: `7`)\n- `--anomalies-only`: Show only detected anomalies\n- `--top`: Number of results (default: `20`)\n- `--json`: Output as JSON\n\n**Example:**\n\n```bash\ncost-blame anomaly --historical-days 30 --threshold 2.5 --anomalies-only\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpfrederiksen%2Fcost-blame","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpfrederiksen%2Fcost-blame","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpfrederiksen%2Fcost-blame/lists"}