AWS Budgets + Cost Anomaly Detection: Cap Runaway Coding-Agent Spend

Application = coding-agents
TenantId    = acme          (when possible on resources)
Env         = prod
Tool        = typecheck     (on dedicated functions)

# ❌ Untagged shared account dump — Budget fires, nobody knows which agent
# ✅ Separate linked account or strict tags for agent workloads

# Sketch: monthly Bedrock+Lambda budget with SNS
aws budgets create-budget --account-id 123456789012 --budget '{
  "BudgetName": "coding-agents-monthly",
  "BudgetType": "COST",
  "TimeUnit": "MONTHLY",
  "BudgetLimit": {"Amount": "2500", "Unit": "USD"},
  "CostFilters": {
    "TagKeyValue": ["user:Application$coding-agents"]
  },
  "CostTypes": {
    "IncludeTax": true,
    "IncludeSubscription": true,
    "UseBlended": false
  }
}' --notifications-with-subscribers '[
  {
    "Notification": {
      "NotificationType": "ACTUAL",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 50,
      "ThresholdType": "PERCENTAGE"
    },
    "Subscribers": [{"SubscriptionType": "SNS", "Address": "arn:aws:sns:us-east-1:123456789012:agent-cost-alerts"}]
  },
  {
    "Notification": {
      "NotificationType": "ACTUAL",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 80,
      "ThresholdType": "PERCENTAGE"
    },
    "Subscribers": [{"SubscriptionType": "SNS", "Address": "arn:aws:sns:us-east-1:123456789012:agent-cost-alerts"}]
  }
]'

// ✅ SNS → Lambda: flip AppConfig kill switch for all non-essential tools
import {
  AppConfigDataClient,
  // use AppConfig start-configuration-session / or prefer Admin API to update hosted config
} from "@aws-sdk/client-appconfig";

export async function onCostAlarm(event: { severity: "warn" | "critical" }) {
  // Pseudocode: write flag file / update hosted configuration
  // agents.tools.allowlist = ["health", "retrieve_only"] on critical
  console.log(JSON.stringify({ msg: "cost_kill_switch", severity: event.severity }));
  // Also post Slack; open incident ticket
}

// EMF-style metric log for Bedrock tokens (sketch)
console.log(
  JSON.stringify({
    _aws: {
      Timestamp: Date.now(),
      CloudWatchMetrics: [
        {
          Namespace: "CodingAgents/LLM",
          Dimensions: [["TenantId", "ModelId"]],
          Metrics: [
            { Name: "TokensIn", Unit: "Count" },
            { Name: "TokensOut", Unit: "Count" },
            { Name: "EstimatedCostUsd", Unit: "None" },
          ],
        },
      ],
    },
    TenantId: tenantId,
    ModelId: modelId,
    TokensIn: tokensIn,
    TokensOut: tokensOut,
    EstimatedCostUsd: estimateUsd(tokensIn, tokensOut, modelId),
  })
);