On June 9, 2026, AWS put the FinOps Agent into public preview: an AI agent that answers cost questions in plain language, investigates spending anomalies down to their root cause, and surfaces optimization opportunities, all inside the tools your teams already use. For teams who have spent years manually chasing cost anomalies across many accounts, it is a genuinely useful arrival. But it is not a set-and-forget cost autopilot, and knowing exactly what it does, and what it does not, is what separates a smart rollout from a disappointed one.
This article walks through the FinOps Agent end to end: what it is, how we set one up in a real AWS account, and what it returns when you actually use it. Every screenshot below is from that live setup.
At SUDO, an AWS Premier Tier Partner working with teams across the UAE, Saudi Arabia, and the wider MENA region, we help organizations adopt agentic AI cost management like this on a solid AWS cost-optimization foundation. The walkthrough below comes from one such hands-on engagement.
What the FinOps Agent actually is?
The FinOps Agent is a frontier agent built on Amazon Bedrock that turns cloud cost management into a conversational experience. Instead of navigating multiple dashboards and reports, you ask questions in plain language and get answers drawn from your real cost and usage data.
It does four things: answers cost questions in natural language, automatically investigates cost anomalies to root cause, surfaces optimization opportunities (rightsizing, idle resources, Savings Plans), and runs recurring FinOps workflows on a schedule you define. It delivers findings in a web application, and optionally into Slack and Jira.
To do this, it draws on the cost stack AWS already has: Cost Explorer for cost and usage data, Cost Anomaly Detection for alerts, Cost Optimization Hub and Compute Optimizer for rightsizing recommendations, and AWS CloudTrail to trace the root cause of cost changes by correlating a spike with the record of who changed what and when.
Before you start: the foundation the agent depends on
The agent is only as good as the cost data underneath it. If these are not in place, it has nothing to work with, so set them up first. We cover the reasoning behind tagging and budgets in depth in our FinOps fundamentals guide; here is the checklist:
• Enable Cost Explorer: This is the agent's primary source of cost and usage data. Data can take up to 24 hours to populate, so do this a day ahead.
• Enable Cost Anomaly Detection: This is what the agent's automatic investigations listen for. No monitor, no anomaly investigations.
• Enable Cost Optimization Hub (and confirm Compute Optimizer): These power the rightsizing, idle-resource, and Savings Plans recommendations. Easy to miss, and the agent will look thin without them.
• Confirm CloudTrail is logging management events: In the regions you use, or the root-cause correlation has no data to work with.
• Tag resources with owner or team tags: The agent names the responsible owner far more reliably when tags exist.
In our walkthrough account, an active Cost Anomaly Detection monitor was already in place, the foundation that lets the agent investigate later.
Creating the agent: a five-step setup
The agent is created in the AWS console. As of the preview, it runs only in the US East (N. Virginia), us-east-1 Region, though once created in a management account it can monitor costs across all Regions and accounts, including workloads in the Middle East, Europe, and Asia Pacific. It simply runs from us-east-1 while managing spend everywhere.
From the console, search for FinOps Agent, open it, and click Create Agent. The setup has five steps.
Step 1 and 2: Name the agent, grant AWS resource access
First, you name the agent (we used demo-FinOpsAgent) and optionally add a description. Then you grant the IAM permissions the agent needs to read your cost data. The setup creates the role for you, auto-create is the recommended default, so you do not configure IAM manually unless your organization manages permissions centrally.
Step 3: Grant web app access
This is a distinct step worth noting: the agent gets a second, separate IAM role that controls what its web application can do, creating tasks, viewing execution history, and managing context files. Web app authentication is handled through the AWS Console. This is the role that powers the chat interface you will use to interact with the agent.
Step 4: Third-party integrations (optional)
The setup offers optional Jira and Slack integrations. Jira lets the agent create tickets; Slack lets it post findings to a channel. You can connect them now or later from agent settings. For this walkthrough, we skipped both to validate the core agent first; connecting them is a natural next step once the agent is proven.
One practical gotcha when you do connect Slack: the FinOps Agent app must be added to the channel before you configure the integration, or it will fail with an unhelpful error. AWS marks this as important, but it is easy to skip.
Step 5: Review and create
The final screen summarizes everything: the agent name, both auto-created IAM roles, and the integrations (none, since we skipped them). Confirm and click Create Agent.
The agent provisions in a few moments and appears in the Agents list with an Open link. Note the useful detail here: each agent operates with its own IAM permissions, context files, memory, task queue, and integrations, with no data or permissions shared across agents- a clean isolation boundary that matters for regulated environments.
Using the agent: a conversational interface over real cost data
Clicking Open launches the agent's web application, a separate, chat-style interface distinct from the AWS console. This is where you actually work with the agent: ask questions, run tasks, manage automations, upload context files, and view artifacts.
The interface is a chatbot in form, but the value is what sits behind the chat. A normal chatbot would guess or answer generically. This one pulls actual figures from Cost Explorer, breaks them down by service, computes month-over-month change, and, for anomalies, correlates them with CloudTrail to identify who caused the spike. Conversational interface, real cost intelligence underneath.
The interface also suggests common tasks that show its range in AWS's own words: find EC2 rightsizing opportunities and generate an HTML report, investigate anomalies in the last 7 days correlated with CloudTrail to identify the API calls and IAM principals behind them, automate anomaly alerts over a dollar threshold to a Slack channel, compare monthly costs, produce an executive-ready PPT report, or detect idle RDS instances. Prompts are capped at 1000 characters.
Asking a real question
To test it, we asked a plain-language question: "What was my cost in May 2026, and how did it change compared to the prior month?" Within seconds, the agent returned a structured answer, a per-service breakdown table comparing April and May, the month-over-month change, and a short analysis naming the two services that drove the difference. It correctly excluded zero-cost services and labeled the metric it used (UnblendedCost). A Show thinking process link exposes the reasoning steps it took to get there.
Follow-up questions work the same way, conversationally. Ask "How many active services are in my account?" and it inventories them; ask for a multi-month trend, and it breaks the spend down by service with a brief analysis and offers to drill deeper. You steer it like a chat, and it answers from your real account each time.
For example, asking for a six-month service breakdown returns a per-service table across the period, with a chart and a totals row, again, from a single plain-language question, with no dashboard to build.
What it deliberately does not do
This is where an honest read matters, because the launch coverage tends to skip it.
It is read-only: The agent investigates, reports, and (when connected) files tickets or posts messages, but it does not stop, resize, delete, or remediate anything. A human still decides and acts. That is the right design choice: autonomous action on production cost requires trust the industry is still building, but it means the agent is an analyst, not a brake.
It is reactive: It triggers on anomaly alerts or scheduled reviews, working from billing data after a cost change has already happened. It does not watch resource-creation events at the moment an expensive resource launches. By the time it investigates, the money is already being spent.
The practical takeaway
Treat the FinOps Agent as a very sharp investigator, not a guardrail that stops the bill before it lands. It complements preventative controls, budgets, tagging discipline, guardrails, and SCPs, but does not replace them. Most teams need both: preventative controls to stop surprises, and the agent to explain the ones that get through.
Availability and cost
The FinOps Agent is currently available only in us-east-1, but once deployed in a management account, it monitors costs across all Regions and member accounts. During the public preview, it is free, subject to a monthly usage limit; standard charges still apply for the underlying services it reads, such as Cost Explorer API calls. Pricing at general availability has not been announced, so confirm current terms before building it into a long-term cost-governance plan.
The honest verdict
The FinOps Agent is a real, capable tool that automates the single most tedious part of cloud cost management: root-cause investigation and plain-language cost analysis. It is not a replacement for preventative cost controls; it is not autonomous, and it is only as good as the cost foundation you have already built. Get that foundation right, and it is a strong addition to how modern teams keep cloud spend under control, turning cost from a monthly report the FinOps team chases into a real-time answer any engineer can get for themselves.
How SUDO can help
As an AWS Premier Tier Partner, SUDO helps organizations put the cost-governance foundation in place: cost anomaly detection, budget structures, tagging strategy, CloudTrail configuration- that makes tools like the FinOps Agent genuinely useful, and integrates them into your existing FinOps and engineering workflows. If your team wants to adopt agentic cost management on a solid footing, we can help you get there.
Through our AWS Managed Cloud Services and DevOps as a Service engagements, we build and run that cost-governance foundation for you and integrate agentic FinOps into your day-to-day cloud operations across the UAE, Saudi Arabia, and the wider MENA region.
Get in touch at sudoconsultants.com or reach@sudoconsultants.com.
Frequently asked questions
What is the AWS FinOps Agent?
The AWS FinOps Agent is a frontier AI agent built on Amazon Bedrock that answers cloud cost questions in plain language, investigates spending anomalies to their root cause using CloudTrail, and surfaces optimization opportunities delivered in a web app and, optionally, Slack and Jira.
Is the AWS FinOps Agent available in the Middle East?
During preview, the agent runs only in us-east-1, but once created in a management account, it monitors costs across all Regions and accounts, including workloads in the UAE, Saudi Arabia, and the wider MENA region. It simply runs from us-east-1 while managing spend everywhere.
Does the FinOps Agent replace preventative cost controls?
No. It is read-only and reactive; it explains a spike after it lands but does not stop, resize, or remediate anything. Most teams pair it with preventative controls such as budgets, tagging, and SCPs. SUDO Consultants helps put both in place.
Top comments (0)