investigation-cost-guardrail
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [Cost Governance Framework]: The skill implements a three-layer architecture (Heuristics, Registry, and Response Validation) to monitor investigation costs across all AWS services. This approach is a standard operations best practice designed to provide transparency and control over cloud spending.
- [Live Pricing Lookups]: To ensure accuracy, the skill fetches current rates from the official AWS Pricing API using standard
aws pricing get-productscalls. This targets well-known AWS service endpoints and is documented for use in cost estimation. - [Behavioral Guardrails]: The skill provides explicit instructions for the agent to perform 'pre-flight' cost checks, enforce per-investigation budgets, and suggest cost-efficient alternatives (e.g., using
FilterLogEventsinstead ofStartQuery). These guardrails serve as a functional safety mechanism rather than a security risk. - [Resource Access Considerations]: The skill requires read-only IAM permissions (
pricing:GetProducts) to resolve regional rates. This is the minimum required privilege for the skill's stated purpose and is applied to public pricing data.
Audit Metadata