CUSTOMER CASE STUDY

Nodei

AWS Cost Analysis and Optimization Agent

Customer Background

Nodei operates production workloads on AWS and needed better visibility into cloud spend along with practical, trustworthy guidance on how to reduce it. As usage grew across accounts, its finance, engineering, and cloud operations teams were spending time manually gathering cost data from the console, Cost Explorer, optimization tools, and documentation before they could answer routine questions or act on savings opportunities. The goal was to design and validate an agentic AI solution that lets teams ask cost and optimization questions in plain language, grounded in live AWS data, without granting the agent the ability to change infrastructure.

1. Executive Summary

Atomic Computing designed and built a proof-of-concept AWS Cost Analysis and Optimization Agent for Nodei. The solution is a multi-agent, conversational assistant for FinOps, cloud operations, and engineering teams. It combines Amazon Bedrock foundation model inference with an agent orchestration layer, live AWS cost and optimization data, AWS documentation retrieval, session memory, and secure cross-account access. The agent uses a Claude Haiku-class model on Amazon Bedrock for routing, summarization, and explanation, with LangGraph for controlled multi-agent orchestration, MCP servers for standardized access to AWS billing and documentation tools, and FastAPI for a streaming chat interface. Financial calculations are performed deterministically in code, and the model is used to explain results rather than to invent or compute them. The engagement was delivered across four practice areas: agentic AI design, security and interoperability, responsible AI, and managed compute. The result was a working, read-only, least-privilege agent that improved cost visibility and self-service optimization guidance for Nodei while keeping human review in place for any operational or financial decision.

The solution addresses three primary customer needs:

2. Customer Challenges

The assessment identified a set of cost, operational, and security challenges that the agent needed to address:

3. Solution Overview

Atomic Computing implemented a controlled, multi-agent architecture rather than a single monolithic assistant. A supervisor agent classifies each user message and routes it to a specialist agent, and cost and documentation tasks follow a two-phase pattern that separates deterministic data retrieval from model narration. The solution included:

• A supervisor agent for intent classification and routing.
• A cost analysis (manager) agent for month-to-date, previous-month, and service-level spend.
• A remediation agent for service-scoped optimization recommendations.
• A documentation agent for grounded AWS service and pricing explanations.
• A direct chat agent for greetings, capability questions, and simple follow-ups.
• Amazon Bedrock (Claude Haiku-class) for inference, accessed through langchain-aws.
• LangGraph for explicit, state-based orchestration and typed shared state.
• MCP servers (billing/cost management and AWS documentation) launched on demand through uvx.
• FastAPI with Server-Sent Events for streaming responses, and SQLite with WAL mode for session persistence.
• Cookie-based authentication with PBKDF2-SHA256 password hashing and session ownership.
• STS AssumeRole with optional ExternalId for secure cross-account analysis.

4. Agent Architecture and Routing

The supervisor routes each request to the agent best suited to the task. This limits unnecessary tool exposure and lets each specialist have its own tools, prompt, and token budget.

Two-phase retrieval and narration

For cost analysis and documentation, the implementation fetches data first and narrates second. The cost fetcher retrieves previous-month, month-to-date, and same-period-last-month figures in parallel using asyncio.gather, month-over-month deltas are calculated in Python, and the result is reduced to a compact JSON summary before a single Bedrock narration call. Financial calculations are therefore deterministic and auditable, and the model explains the result rather than computing it. The documentation agent works the same way: it retrieves targeted AWS documentation, then passes it to the model without tools bound to produce a grounded answer.

5. Cost Analysis and Optimization Capabilities

The cost analysis agent answers questions about recent and comparative AWS spend using Cost Explorer data through the billing MCP server. The remediation agent uses service-scoped tool routing so it can answer both broad questions, such as how to reduce the overall bill, and targeted questions, such as showing RDS rightsizing opportunities.

6. Responsible AI and Safety Controls

Because the agent interacts with sensitive cost data and can influence operational decisions, responsible AI practices were applied across the full lifecycle: discovery, design, implementation, validation, monitoring, and iterative improvement. The design prioritizes accuracy, safety, transparency, privacy, and continuous improvement.

Implemented controls

Human oversight

The agent is designed to provide analysis and recommendations, not autonomous infrastructure changes. Optimization recommendations, rightsizing suggestions, and RI or Savings Plans guidance are advisory, and a human is expected to validate workload impact, cost commitment, and owner approval before acting. Escalation to a human reviewer is recommended whenever a recommendation could affect production, involves financial commitment, conflicts with console data, or reports missing data.

7. Security, Cross-Account Access, and Interoperability

Security was implemented at two levels. Application-level authorization ensures only authenticated users can access the agent and their own sessions, using cookie-based authentication with PBKDF2-SHA256 password hashing, HMAC-signed HTTP-only cookies, and session ownership. AWS-level authorization uses read-only IAM permissions for cost, optimization, and recommendation data, so the agent can inspect billing and optimization data but cannot modify infrastructure.

Cross-account access

For multi-account environments, the application assumes a read-only role in the target account using AWS STS, configured through AWS_ROLE_ARN, an optional AWS_PROFILE, and an optional AWS_EXTERNAL_ID. Temporary role-based credentials are preferred over long-lived static keys, and ExternalId reduces confused-deputy risk when a central or consulting account analyzes a member account.

Interoperability

The application exposes standard, reusable interfaces so it can integrate with web UIs, internal portals, and future channels. These include a JSON REST API, Server-Sent Events for token-by-token streaming, MCP for standardized tool invocation, and LangGraph for controlled routing between agents. Endpoints cover streaming and non-streaming chat, session creation and listing, message history retrieval, session deletion, login, and health checks.

8. Compute and Deployment Architecture

The recommended production deployment uses Amazon ECS on AWS Fargate as the primary compute service for the containerized FastAPI and LangGraph application. Fargate suits the workload because it is containerized, long-running, API-driven, and needs stable HTTP and SSE streaming, and it supports the subprocess-based MCP servers launched inside the container. Fargate also removes EC2 host management, supports task IAM roles and private networking, and scales task count based on demand.

The supporting stack includes Amazon ECR for the container image, an Application Load Balancer with AWS Certificate Manager for HTTPS, AWS Secrets Manager or SSM Parameter Store for secrets, and Amazon CloudWatch for logs and metrics. ECS tasks run in private subnets across at least two Availability Zones with the ALB as the only public entry point, a least-privilege task role for Bedrock, STS, logging, and approved cost APIs, and VPC endpoints to reduce public internet exposure.

9. Business Outcomes

The proof of concept delivered the following outcomes for Nodei:

• A working conversational agent for AWS cost analysis and optimization across FinOps, cloud operations, and engineering teams.
• Faster, self-service answers to cost questions without manual navigation of multiple AWS consoles and dashboards.
• Grounded, auditable cost figures, with financial calculations performed deterministically in code.
• Service-scoped optimization guidance for EC2, RDS, Lambda, ECS, EBS, Reserved Instances, and Savings Plans.
• Secure, least-privilege, read-only AWS access with cross-account role assumption and no ability to modify infrastructure.
• A responsible AI framework with human-in-the-loop review, monitoring signals, and an iterative improvement process.
• A clear path to production on Amazon ECS Fargate, with enterprise hardening options for SSO, RBAC, secrets management, and observability.

10. Conclusion

Atomic Computing helped Nodei move from fragmented cost visibility to a controlled, conversational way of understanding and reducing AWS spend. The proof of concept combines Amazon Bedrock-hosted Claude models for inference, LangGraph for controlled multi-agent orchestration, MCP servers for live AWS data and documentation access, and FastAPI for a streaming interface, all designed around least-privilege access, deterministic financial calculations, and human review of operational decisions. The engagement demonstrates a disciplined consulting approach across agentic AI, security and interoperability, responsible AI, and managed compute. Nodei can get fast, grounded cost and optimization insights today, while the architecture leaves a clear path toward enterprise-grade identity, authorization, monitoring, and governance as adoption grows.