/alibabacloud-finops-inspect

name: alibabacloud-finops-inspect
description: |
  Alibaba Cloud FinOps Resource Inspection Skill. Performs cost-oriented health inspection
  across all regions of an Alibaba Cloud account. Scans ECS, RDS, EIP, Cloud Disks,
  Load Balancers (CLB/ALB/NLB), and NAT Gateways to identify underutilized and idle resources.
  Triggers: "FinOps巡检", "成本巡检", "资源利用率检查", "idle resource detection",
  "cost optimization", "finops inspection", "资源浪费检查", "闲置资源检测".

Alibaba Cloud FinOps Resource Inspection Skill

> **⚠️ MANDATORY EXECUTION PROTOCOL ⚠️** > > This skill MUST be executed EXCLUSIVELY by running: > ``` > python3 scripts/main.py [parameters] > ``` > **FORBIDDEN actions** (violation = invalid execution): > - ❌ Running `aliyun` CLI commands directly > - ❌ Writing custom bash/python scripts > - ❌ Calling SDK APIs directly in code > - ❌ Any execution method other than `python3 scripts/main.py` > > The Agent MUST first confirm parameters with user, then run `python3 scripts/main.py` with appropriate flags. No exceptions.

Overview

This skill provides a **pre-built Python script** (`scripts/main.py`) that performs cost-oriented health inspection across all regions of an Alibaba Cloud account. The Agent's role is ONLY to: 1. Parse user intent into CLI parameters 2. Confirm parameters with user (HITL) 3. Run `python3 scripts/main.py [parameters]` 4. Present the script output as the final report

The script internally handles: credential initialization, region discovery, multi-product resource collection, CloudMonitor metric aggregation, judgment & recommendation generation, and structured report output. **The Agent MUST NOT replicate any of this logic** — just run the script.

> **Note**: The Workflow section below describes the script's INTERNAL implementation for documentation purposes only. The Agent MUST NOT use this information to write custom code or call APIs directly. The ONLY action required is running `python3 scripts/main.py`.

Features

This skill implements the following features:

1. **Credentials and Region Preparation**

• Load AK/SK in priority order: environment variables → Alibaba Cloud CLI config → runtime prompt
• Call the ECS API to automatically discover all enabled regions under the account
• Allow users to explicitly specify regions via the `--regions` parameter

2. **Core Resource Utilization Inspection**

• Inspect 7-day average CPU, memory, IOPS, and intranet bandwidth for ECS instances
• Inspect CPU, memory, IOPS, connection usage, and disk usage for RDS instances
• Tag results with three severity levels: Critical Idle / Low Utilization / Normal
• Separately identify "stopped but still billed" prepaid ECS instances
• Identify long-running (>30 days) PostPaid instances and recommend switching to PrePaid (subscription) billing for cost savings

3. **Idle Resource Detection**

• Detect unbound or zero-traffic Elastic IPs (EIPs)
• Detect unmounted data disks, with priority escalation based on creation age
• Detect Load Balancers (CLB/ALB/NLB) with no listeners or no backend servers
• Detect public NAT Gateways without bound EIPs or without any SNAT/DNAT rules

4. **Optimization Recommendation Engine**

• Categorize recommendations into P0 (Act Now) / P1 (Recommended) / P2 (Observe)
• Apply differentiated recommendation templates per resource scenario (downsize / release / switch billing / convert to Serverless, etc.)
• Optionally display estimated monthly cost of each resource

5. **Report Output**

• Structured text report: inspection summary + per-resource detail tables + recommendation summary + error summary

Important Notes

• **Read-Only Guarantee**:
• The skill calls only `Describe*` / `List*` read-only APIs. It **never** performs Delete / Stop / Modify operations. All recommendations include a "please confirm before acting" warning.
• **Operation Costs**:
• The skill itself creates no live resources, but it does invoke a large number of read-only OpenAPI calls. In large-account scenarios (thousands of instances × multiple regions × multiple metrics), CloudMonitor call volume is significant — built-in throttling is required to avoid triggering API Throttling.
• **Credential Security**:
• AK/SK are used only in memory; they are never persisted, written to logs, or included in the report. Running with a least-privilege RAM sub-account is recommended.
• **Memory Metric Dependency**:
• ECS memory utilization requires the CloudMonitor agent (`cloudmonitor-agent`) installed on the instance. Instances without the agent are flagged as "memory data missing" and judged on CPU metrics only.
• **Observation Window Handling**:
• Resources created within the last 7 days are flagged as "observation window" and excluded from idle / low-utilization judgment to avoid false positives.

Prerequisites

• **Environment**: Python 3.10+
• **Alibaba Cloud Account**: An Alibaba Cloud account with the relevant services activated (ECS / RDS / VPC / SLB / ALB / NLB / CMS, etc.)
• **Access Credentials**: Configure access credentials properly. This skill uses the `alibabacloud-credentials` credential chain to automatically read credentials from environment variables or the CLI config. For configuration details, see [Manage Access Credentials in Python](https://help.aliyun.com/zh/sdk/developer-reference/manage-access-credentials).
• **RAM Permissions**: A least-privilege RAM policy with read-only actions is recommended. Key actions include:
• `ecs:DescribeRegions` / `ecs:DescribeInstances` / `ecs:DescribeDisks`
• `rds:DescribeDBInstances`
• `vpc:DescribeEipAddresses` / `vpc:DescribeNatGateways` / `vpc:DescribeSnatTableEntries` / `vpc:DescribeForwardTableEntries`
• `slb:DescribeLoadBalancers` / `slb:DescribeLoadBalancerListeners`
• `alb:ListLoadBalancers` / `alb:ListListeners` / `alb:ListServerGroups` / `alb:ListServerGroupServers`
• `nlb:ListLoadBalancers` / `nlb:ListListeners` / `nlb:ListServerGroups`
• `cms:Des