The AWS FinOps Deep Agent

Directeam’s AWS FinOps Deep Agent is an autonomous agent embedded in every customer’s AWS accounts. It continuously manages and monitors cost inefficiencies, cost and usage anomalies, and security-guardrail posture across the customer’s entire AWS organization, and alerts the customer the moment a new anomaly appears. It advises on building AWS infrastructure in the most cost-effective, well-architected way, with recommendations grounded specifically in AWS services. The agent also exposes an MCP (Model Context Protocol) interface  adopted by a growing number of customers  that integrates directly into their SDLC and developer tooling, significantly improving time-to-resolution (TTR) for FinOps, DevOps, security and billing issues by delivering precise, accurate recommendations together with the root cause and reasoning behind any incident. The agent is enabled through a read-only IAM role deployed via a CloudFormation Stack (standalone) or StackSet (organization-wide); all processing runs on AWS Bedrock  no external/OpenAI models  in a per-customer isolated tenant within AWS U.S. regions, collecting only metadata/usage metrics and retaining only investigation summaries, with access revocable at any time by deleting the stack.

Inefficiency detection is part of the agent’s continuous anomaly alerting. Alongside spike anomalies, the AWS FinOps Deep Agent proactively detects inefficiencies that quietly drive wasted cost  and for each one it explains the reasoning and root cause, then provides a step-by-step recommendation for how to resolve it. The inefficiency portal presents the potential monthly and annual savings for every finding, and each inefficiency line carries an estimate of how long it will take to resolve (for example, “quick wins” that take under ~4 hours of work), so the team can filter the backlog by savings and by effort and act on the highest-value items first.

Part of Directeam’s full managed-services stack

The agent is delivered within Directeam’s end-to-end managed-services platform, deployed and operated by Directeam for every customer at onboarding: the Umbrella cost-management platform for cost visibility; landing-zone build and management (Control Tower / LZA); billing, CUR and cost-allocation operated on behalf of the customer; IAM-role and policy management (least-privilege roles, permission boundaries, SCPs); AWS support (PLS) enrollment with a dedicated support channel; and Sombrero Savings  Directeam’s automated Savings Plans / Reserved Instance commitment management that cuts EC2 compute cost without the customer carrying commitment risk. Directeam’s security baseline for this stack is validated through the AWS SPP Foundational Technical Review (FTR).

The Challenge

• Limited cost visibility in the hardest-to-attribute areas  S3, networking, EKS and CloudWatch/Datadog metric costs.
• Anomalies were sometimes only caught at invoice review (e.g. a forgotten Redis cluster left running), not proactively.
• Commodity waste detectors surfaced only the obvious idle resources, missing deeper inefficiencies.
• The team wanted findings delivered with enough context, effort and savings estimates to act, and ideally integrated into their task and IaC workflow.
• S3 and EKS internal traffic gave little native visibility into where the money was going.

The Solution

• Directeam runs its AWS FinOps Deep Agent across Eleos Health’s accounts via a Slack-native interface and a structured ‘Optimize’ UI, posting anomalies continuously and running deep inefficiency scans on a monthly cadence.
• Directeam uses the agent to target ‘deep’ inefficiencies beyond commodity detectors — RDS manual snapshots, FSx provisioned-size, backup lifecycle policy, VPC flow-log filtering, VPC endpoints per subnet, and Datadog enhanced-metric cardinality / CloudWatch GetMetricData volume.
• Directeam runs a networking-and-S3 investigation capability (temporarily enabling flow logs to gather insight) to attack the hardest-to-see costs.
• Each finding is presented with surrounding context, the reasoning and root cause, a step-by-step recommendation, a percentage savings estimate and an effort estimate.
• Directeam pushes findings into the team’s task tracker (Jira) and IaC/developer tooling via the agent’s MCP interface, improving TTR.

Key Results & KPIs

Representative operational metrics observed for Eleos Health with the AWS FinOps Deep Agent:

Quantitative Outcomes

Representative optimisations Directeam delivered for Eleos Health, expressed as percentage reductions on the affected service line (absolute amounts withheld; available privately):

Worked Example – An Inefficiency Finding

A representative inefficiency the agent surfaced and walked Eleos Health through, end to end:

Apply a lifecycle policy to pipeline-generated EBS snapshots

Detected: Surfaced as a deep inefficiency after the agent observed continuously accumulating snapshot storage with no lifecycle/retention policy in place.

Reasoning & root cause: Every production deployment pipeline run creates an EBS snapshot, but no lifecycle policy expires them. Over a 90-day window the snapshots accumulate indefinitely, so storage cost grows linearly while only the most recent snapshots have any recovery value — the rest are pure waste. (This is invisible to commodity waste detectors, which look only at idle resources, not retention behaviour.)

Step-by-step recommendation to resolve:

1. Inventory snapshots by source volume and age; identify those older than the required recovery window (e.g. >90 days).
2. Confirm with the team / security which retention period is actually required.
3. Create a Data Lifecycle Manager (or backup) retention policy that expires snapshots beyond that window automatically.
4. Delete the existing redundant/orphaned snapshots in batches.
5. Add the lifecycle policy to the pipeline IaC so new environments inherit it by default.

The Results

• Directeam surfaced spend that was invisible to commodity waste detectors and to invoice review, each with the reasoning, root cause and a step-by-step fix.
• Representative reductions Directeam delivered (as % of the affected line): EBS snapshot storage ~85–90%, CloudTrail data events ~80–90%, NAT per-GB ~75–88% on the affected account, S3 request volume ~60–75%, CloudWatch GetMetricData ~60–75%, dev MSK ~60–67%, FSx ~50–67%, S3 storage ~40–50%.
• The agent’s understanding of Eleos Health’s environment improves continuously as Directeam’s monthly review sessions feed back into its context.
• Directeam pushes findings into Jira and IaC tooling via MCP and is deepening networking/S3/EKS visibility; every finding ships with an effort estimate and % savings to prioritise by value and speed.

Directeam continues to operate the AWS FinOps Deep Agent across Eleos Health’s AWS estate as part of its managed-services engagement, with ongoing anomaly detection, inefficiency reviews and architecture guidance.