Operations7 min readOctober 16, 2026

AWS FinOps Agent finds the cost. Knowing what to fix, and fixing it, is the hard part

AWS has put its FinOps Agent in preview. It explains cost spikes and summarises recommendations well. The skill that stays scarce is deciding which fix is safe, applying it, and proving on the bill that it worked. Here is where the agent stops and what fills the gap for S3.

JeVaughn Ferguson
Founder, developer
The short version

The AWS FinOps Agent is a genuine step forward for cost assessment, and worth turning on in preview if you run a management account. Treat its output as the start of the work. Knowing which fix is safe, applying it without side effects, and verifying on the bill that it paid off is where the skill, and the saving, actually lives. For S3, BucketDesk's S3 Savings tool does those three steps in your own account and only charges against savings that show up on the bill.

AWS announced the public preview of the AWS FinOps Agent on June 9, 2026. Point it at a management account and it investigates cost anomalies, answers plain-language questions about the bill, produces scheduled reports and summarises the recommendations AWS already generates. For anyone who has spent an afternoon in Cost Explorer trying to explain a spike, that is real help.

It is also a good moment to be precise about what cost work actually consists of. Finding out what you spend is one task. Knowing which change to make, making it without losing data or breaking a workload, and confirming on the next bill that the saving arrived is a different task, and it is the one that has always needed the most skill. The agent handles the first. The second is still yours.

What the FinOps Agent does in preview

The agent runs in US East (N. Virginia) and reads from the cost services AWS already operates: Cost Explorer, Cost Anomaly Detection, Cost Optimization Hub, Compute Optimizer and CloudTrail. Set-up is one agent and one IAM role, with optional Jira and Slack connections.

Preview use is free up to a monthly usage limit, with standard charges for the underlying services. AWS named Workday, AVIV Group, Convera and Mitre 10 as early users.

  • Anomaly investigation: when Cost Anomaly Detection fires, the agent correlates the cost change with CloudTrail events, names a likely root cause and a probable owner, and writes a summary.
  • Cost questions: engineers ask why a service cost more last month and get an answer in terms of the contributing services and usage drivers. Uploaded context files, such as an account-to-team mapping, help it answer team-level questions.
  • Recurring reports: scheduled HTML, PDF or PowerPoint reports.
  • Optimisation summaries: it pulls rightsizing, idle-resource and Savings Plans recommendations from Cost Optimization Hub and Compute Optimizer and writes them into a Jira ticket for review.

Where its job ends

Read the capability list again and notice the verbs: investigate, answer, summarise, deliver. The agent's output is a Jira ticket or a Slack post. The changes it makes to your account are the EventBridge rules that trigger its own automations. Every recommendation it surfaces is one that Cost Optimization Hub or Compute Optimizer had already computed. Its value is turning that data into readable findings and routing them to the right team.

That is the assessment half of FinOps, and assessment has been getting steadily easier for years. Cost Explorer, Storage Lens, Compute Optimizer and now an agent that reads them all and writes the memo. The part that has stayed hard is what happens after the memo lands.

The skill that stays scarce: knowing what to fix, and how

Take the most common finding on a storage bill: a bucket of business files is paying the S3 Standard rate for data nobody has opened in a year. The recommendation writes itself. The correction does not.

None of these questions is answered by a cost report. Each needs someone who knows how S3 bills, how lifecycle rules behave, what the business keeps, and how to apply a change in a way that can be undone. That person is the bottleneck in most teams, and the ticket from the FinOps Agent sits in their queue behind everything else.

  • Which buckets? Intelligent-Tiering gains nothing on objects under 128 KB, so a bucket of a million small files should be left alone, and the monitoring fee would make it slightly worse.
  • Which tier? Infrequent Access and Archive Instant Access open files immediately. Archive Access and Deep Archive Access take hours to restore, and a sales team that opens a 2023 contract once a quarter will notice.
  • Which versions? Expiring old versions is permanent. Some buckets have Object Lock or a legal reason to keep history, and those have to be found and left out before the rule goes on.
  • Which existing rules? Putting a lifecycle configuration replaces the whole configuration on the bucket. Apply a new rule without copying the old ones and you have quietly removed someone else's retention policy.
  • Is the data actually cold? The bill shows data transfer, which is an upper bound on reads. Without access logs or a CloudTrail data trail, "unread" is an assumption, and assumptions are what delete the wrong thing.

The third task: proving the saving

There is a step after the fix that is just as often skipped. A change is applied, everyone assumes it worked, and nobody compares the next bill with the one before. Intelligent-Tiering moves objects to Infrequent Access after 30 days unread and to Archive Instant Access after 90, so the full saving takes a quarter to show up and arrives in stages. Version expiry shows on the very next bill. Unless someone holds a baseline and checks each month, the saving is a forecast, and forecasts have a way of being quoted as results.

A cost tool that stops at assessment leaves you with three jobs: decide, apply, verify. The decision needs expertise, the apply needs care, and the verification needs patience and a spreadsheet. The FinOps Agent removes the first afternoon of work and leaves the other three.

The solution

BucketDesk does the assessment, the fix and the proof for S3

The S3 Savings tool in BucketDesk covers all three jobs for one AWS account. You deploy one CloudFormation stack from the Tools page, and it reads your bucket configuration, CloudWatch storage metrics for every Region and three months of your actual S3 bill from Cost Explorer. The stack's helpers return counts only, so the assessment works from numbers rather than from your files.

  1. See the cost

    your current monthly S3 cost by storage class, requests and transfer, each bucket's cost with its evidence level, and how much data is unread, marked as measured or as taken from the bill.

  2. Decide change by change

    every proposed action shows its monthly saving in dollars and as a share of the cost, net of what it adds, with buckets under 128 KB, Object Lock and existing rules already accounted for. Archive tiers with a restore wait are opt-in per bucket and show their own figures.

  3. Apply with one click

    BucketDesk expires old versions and unfinished uploads under retention rules you set, puts cold data on Intelligent-Tiering with instant access, and turns on read recording so next month's unread figure is measured. Deleting versions always asks first, and BucketDesk's rules can be removed from any bucket at any time.

  4. Watch the outcome arrive

    a monthly report compares your bill with the baseline taken before the first change, shows which savings are verified and which are still on their 30-day and 90-day tiering timeline, and lists what is still waiting for approval. The fee is calculated from the verified figure, so the tool is paid for results, which keeps its incentives lined up with yours.

Try it out now

The assessment is free on every plan. Applying changes needs a card on file, and the fee is a share of the savings verified on your monthly bill, starting at 10 percent, charged only once verified savings reach 500 dollars, for twelve months. If nothing is saved, nothing is charged.

Try it in BucketDesk

Minimum is free. Deploy a scoped role with CloudFormation, sign in, and browse, without handing anyone an access key.

Connect a bucket

Primary sources

Discussion

0 comments · open to guests · moderated
Comments appear after a quick review.

Liked this? Get the next article by email. No schedule, no filler, one click to leave.

Keep reading

All writing →