> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vantage.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# FinOps AI Prompt Guide

> Learn what the Vantage FinOps Agent can do and how to ask for it in plain language.

The [FinOps Agent](/vantage_finops_agent) is the same agent whether you use it in the [Vantage console](https://console.vantage.sh/agent) or in Slack. This guide shows what the agent can do and how to phrase your prompts so you get useful answers the first time.

<Note>
  Every prompt example on this page is copy-pasteable. Click the **Copy** button on any prompt card and paste it into the agent in the console or in Slack. In Slack, prepend `@Vantage` to the prompt so the agent is notified.
</Note>

<Tip>
  To turn a prompt into a saved, refreshable table report, use [Canvas](/canvas). It applies the same Intent, Scope, and Direction principles covered here, with a [Prompt Library](/canvas#prompt-library) focused on building structured tables.
</Tip>

## What the Agent Can Do

The FinOps Agent is a purpose-built FinOps assistant. Its read and write actions are powered by tools from the [Vantage MCP](/vantage_mcp) (cost data and resource management) and the [Vantage Docs MCP](/docs_mcp) (product knowledge); however, the agent takes this one step further and brings FinOps reasoning, multi-step planning, and awareness of your workspace, RBAC scope, and audit context. For a complete reference of the underlying tools, see the [Vantage MCP Tools table](/vantage_mcp#vantage-mcp-tools).

The sections below organize the agent's capabilities into nine categories. Each accordion explains, in plain language, what you can ask for and provides ready-to-copy prompts.

<AccordionGroup>
  <Accordion title="Explore your cloud costs" icon="magnifying-glass-dollar">
    Ask the agent to summarize, break down, or compare cloud spend across providers, services, accounts, regions, and tags. Useful for ad-hoc cost questions, executive summaries, and identifying drivers of change.

    Underlying MCP tools: `query-costs`, `list-costs`, `list-cost-providers`, `list-cost-services`, `get-cost-provider-accounts`, `list-cost-integrations`.

    <Prompt description="What did we spend on AWS Lambda last month in the Production workspace?" actions={["copy"]}>
      What did we spend on AWS Lambda last month in the Production workspace?
    </Prompt>

    <Prompt description="Provide a breakdown of costs by service for Datadog from July 1 to July 31, 2025." actions={["copy"]}>
      Provide a breakdown of costs by service for Datadog from July 1 to July 31, 2025.
    </Prompt>

    <Prompt description="Compare AWS spend in October 2025 vs. September 2025. What were the top three drivers of the change, and which accounts and regions contributed?" actions={["copy"]}>
      Compare AWS spend in October 2025 vs. September 2025. What were the top three drivers of the change, and which accounts and regions contributed?
    </Prompt>

    <Prompt description="Which cost providers and integrations are connected to my Vantage account?" actions={["copy"]}>
      Which cost providers and integrations are connected to my Vantage account?
    </Prompt>
  </Accordion>

  <Accordion title="Build and manage Cost Reports" icon="chart-line">
    Ask the agent to create, retrieve, list, delete, or forecast [Cost Reports](/cost_reports). The agent generates the [VQL](/vql) filter for you based on a plain-language description and can place reports in a specific [Folder](/folders). You can reference an existing report by pasting its console URL (for example, `https://console.vantage.sh/reports/rprt_xyz789abc123def4`) or by its token (for example, `rprt_xyz789abc123def4`).

    Underlying MCP tools: `create-cost-report`, `get-cost-report`, `list-cost-reports`, `delete-cost-report`, `get-cost-report-forecast`, `list-unit-costs`.

    <Prompt description={`Create a Cost Report titled "AWS RDS - October 2025" filtered to AWS RDS for October 2025 and place it in the Infra folder.`} actions={["copy"]}>
      Create a Cost Report titled "AWS RDS - October 2025" filtered to AWS RDS for October 2025 and place it in the Infra folder.
    </Prompt>

    <Prompt description="List my Cost Reports in the Engineering folder, then show me the filter and groupings on the largest one." actions={["copy"]}>
      List my Cost Reports in the Engineering folder, then show me the filter and groupings on the largest one.
    </Prompt>

    <Prompt description="Forecast spend for this Cost Report (https://console.vantage.sh/reports/rprt_xyz789abc123def4) for the next 90 days and explain what's driving the forecast." actions={["copy"]}>
      Forecast spend for this Cost Report ([https://console.vantage.sh/reports/rprt\_xyz789abc123def4](https://console.vantage.sh/reports/rprt_xyz789abc123def4)) for the next 90 days and explain what's driving the forecast.
    </Prompt>

    <Prompt description="Show me the daily unit costs for this Cost Report (rprt_xyz789abc123def4) over the last 30 days." actions={["copy"]}>
      Show me the daily unit costs for this Cost Report (rprt\_xyz789abc123def4) over the last 30 days.
    </Prompt>
  </Accordion>

  <Accordion title="Organize with Folders and Dashboards" icon="folder-tree">
    Use the agent to organize Cost Reports into [Folders](/folders) and to assemble [Dashboards](/dashboards) from existing reports, widgets, and saved filters.

    Underlying MCP tools: `create-folder`, `update-folder`, `delete-folder`, `list-folders`, `get-folder`, `create-dashboard`, `list-dashboards`.

    <Prompt description={`Create a folder called "Data Platform Costs" and move these two reports into it: https://console.vantage.sh/reports/rprt_xyz789abc123def4 and https://console.vantage.sh/reports/rprt_abc456def789ghi0`} actions={["copy"]}>
      Create a folder called "Data Platform Costs" and move these two reports into it: [https://console.vantage.sh/reports/rprt\_xyz789abc123def4](https://console.vantage.sh/reports/rprt_xyz789abc123def4) and [https://console.vantage.sh/reports/rprt\_abc456def789ghi0](https://console.vantage.sh/reports/rprt_abc456def789ghi0)
    </Prompt>

    <Prompt description={`Create a Dashboard called "Engineering Cost Overview" set to a trailing 30-day window. Can you add these linked reports to it: https://console.vantage.sh/reports/rprt_xyz789abc123def4 and https://console.vantage.sh/reports/rprt_abc456def789ghi0`} actions={["copy"]}>
      Create a Dashboard called "Engineering Cost Overview" set to a trailing 30-day window. Can you add these linked reports to it: [https://console.vantage.sh/reports/rprt\_xyz789abc123def4](https://console.vantage.sh/reports/rprt_xyz789abc123def4) and [https://console.vantage.sh/reports/rprt\_abc456def789ghi0](https://console.vantage.sh/reports/rprt_abc456def789ghi0)
    </Prompt>

    <Prompt description="Show me my existing Dashboards and Folders. Which Dashboards are most relevant to AWS spend?" actions={["copy"]}>
      Show me my existing Dashboards and Folders. Which Dashboards are most relevant to AWS spend?
    </Prompt>
  </Accordion>

  <Accordion title="Investigate cost anomalies" icon="triangle-exclamation">
    Ask the agent to find, explain, and triage [Cost Anomaly Alerts](/cost_anomaly_alerts). It pulls the daily cost data around the spike, identifies attributed resources, and explains what likely changed.

    Underlying MCP tools: `list-anomalies`, `get-anomaly`, `update-anomaly`.

    <Prompt description="Investigate the anomalies on my AWS Costs report from the past 14 days. What's driving each one, and are any of them correlated?" actions={["copy"]}>
      Investigate the anomalies on my AWS Costs report from the past 14 days. What's driving each one, and are any of them correlated?
    </Prompt>

    <Prompt description={`Explain the anomaly on my "AWS Production Costs" report from yesterday. Which service spiked, what's the magnitude, and which resources are attributed?`} actions={["copy"]}>
      Explain the anomaly on my "AWS Production Costs" report from yesterday. Which service spiked, what's the magnitude, and which resources are attributed?
    </Prompt>
  </Accordion>

  <Accordion title="Find and act on cost recommendations" icon="lightbulb">
    Ask the agent to surface, explain, and drill into [cost recommendations](/cost_recommendations) such as Savings Plans, Reserved Instances, and rightsizing opportunities.

    Underlying MCP tools: `list-recommendations`, `get-recommendation-details`, `get-recommendation-resources`, `get-recommendation-resource-details`.

    <Note>
      Cost remediation actions and approvals run through Slack. The console agent can describe and explain recommendations but cannot purchase Savings Plans, RIs, or rightsize resources at this time.
    </Note>

    <Prompt description="List all open AWS cost recommendations, ranked by estimated monthly savings. Which three should I prioritize this week?" actions={["copy"]}>
      List all open AWS cost recommendations, ranked by estimated monthly savings. Which three should I prioritize this week?
    </Prompt>

    <Prompt description="Show me the resources affected by rightsizing recommendations, with their current and recommended instance types." actions={["copy"]}>
      Show me the resources affected by rightsizing recommendations, with their current and recommended instance types.
    </Prompt>
  </Accordion>

  <Accordion title="Track Budgets and Cost Alerts" icon="wallet">
    Ask the agent to create, update, and review [Budgets](/budgets) and [Cost Alerts](/cost_alerts). The agent can compare actual spend against budget targets and set up threshold-based notifications.

    Underlying MCP tools: `create-budget`, `update-budget`, `delete-budget`, `get-budget`, `list-budgets`, `create-cost-alert`, `get-cost-alert`, `list-cost-alerts`.

    <Prompt description="Create a monthly Budget of $50,000 for my Production AWS Costs report (rprt_xyz789abc123def4) for the rest of the calendar year." actions={["copy"]}>
      Create a monthly Budget of \$50,000 for my Production AWS Costs report (rprt\_xyz789abc123def4) for the rest of the calendar year.
    </Prompt>

    <Prompt description="List all Budgets in the Finance workspace and compare actual spend against budget targets. Which are off-track?" actions={["copy"]}>
      List all Budgets in the Finance workspace and compare actual spend against budget targets. Which are off-track?
    </Prompt>

    <Prompt description="Create a weekly Cost Alert that notifies the #finops Slack channel if AWS RDS spend exceeds $10,000 in any 7-day window." actions={["copy"]}>
      Create a weekly Cost Alert that notifies the #finops Slack channel if AWS RDS spend exceeds \$10,000 in any 7-day window.
    </Prompt>
  </Accordion>

  <Accordion title="Tag and allocate costs" icon="tags">
    Ask the agent to explore [tags](/tagging) and tag values across providers and to create [Virtual Tag](/virtual_tagging) configurations that normalize and combine cost attribution across providers.

    Underlying MCP tools: `list-tags`, `list-tag-values`, `create-virtual-tag-config`.

    <Prompt description="What tag keys are available for filtering my AWS costs, and what are the most common values for the `team` tag?" actions={["copy"]}>
      What tag keys are available for filtering my AWS costs, and what are the most common values for the `team` tag?
    </Prompt>

    <Prompt description="Create a Virtual Tag called `team` that combines the AWS `team` tag and the Kubernetes `organization/team` label. Backfill it to January 2026 and let it override provider-supplied tags." actions={["copy"]}>
      Create a Virtual Tag called `team` that combines the AWS `team` tag and the Kubernetes `organization/team` label. Backfill it to January 2026 and let it override provider-supplied tags.
    </Prompt>

    <Prompt description="Show last month's cost grouped by `tag:team` in the Engineering workspace. Which team spent the most?" actions={["copy"]}>
      Show last month's cost grouped by `tag:team` in the Engineering workspace. Which team spent the most?
    </Prompt>
  </Accordion>

  <Accordion title="Inspect resources, workspace, and audit history" icon="magnifying-glass">
    Ask the agent about specific cloud resources, what workspaces and teams you have access to, and what's been happening in your account.

    Underlying MCP tools: `list-provider-resources`, `get-provider-resource`, `list-audit-logs`, `get-myself`, `get-users`, `get-team`, `get-teams`.

    <Prompt description="Which workspaces do I have access to, and what's my access level in each?" actions={["copy"]}>
      Which workspaces do I have access to, and what's my access level in each?
    </Prompt>

    <Prompt description="List my AWS EC2 instances in us-east-1 that cost more than $100 per month, sorted by cost." actions={["copy"]}>
      List my AWS EC2 instances in us-east-1 that cost more than \$100 per month, sorted by cost.
    </Prompt>

    <Prompt description="Show me details and the cost breakdown for this resource: arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234ef567890." actions={["copy"]}>
      Show me details and the cost breakdown for this resource: arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234ef567890.
    </Prompt>

    <Prompt description="Show me audit log entries from the past 7 days for changes to Cost Reports and Budgets in my workspace." actions={["copy"]}>
      Show me audit log entries from the past 7 days for changes to Cost Reports and Budgets in my workspace.
    </Prompt>
  </Accordion>

  <Accordion title="Correlate costs with Datadog (MCP Connector)" icon="https://assets.vantage.sh/docs/logos/logo-icon-datadog.svg">
    If your organization has connected the [Datadog MCP](/datadog_agent), the agent can pull live Datadog telemetry—metrics, logs, monitors, dashboards, APM, and events—and reason over it alongside your Vantage cost data. This is useful for tying cost changes to infrastructure activity, validating rightsizing recommendations against real utilization, and verifying whether a resource is actually idle before acting on it.

    <Note>
      The Datadog MCP must be connected from the [Integrations page](https://console.vantage.sh/settings/integrations) by an **Organization Owner** or **Integration Owner**. See the [Datadog MCP](/datadog_agent) documentation for setup and more examples.
    </Note>

    <Prompt description="Did any recent deployments cause my AWS costs to increase?" actions={["copy"]}>
      Did any recent deployments cause my AWS costs to increase?
    </Prompt>

    <Prompt description="Which EC2 instances have the highest cost but lowest utilization?" actions={["copy"]}>
      Which EC2 instances have the highest cost but lowest utilization?
    </Prompt>

    <Prompt description="Our AWS data transfer costs jumped this week. Which services or hosts in Datadog show increased network throughput over the same period?" actions={["copy"]}>
      Our AWS data transfer costs jumped this week. Which services or hosts in Datadog show increased network throughput over the same period?
    </Prompt>
  </Accordion>

  <Accordion title="Send feedback to Vantage" icon="message-pen">
    Have something to share with the Vantage team? Tell the agent and it will route your feedback directly to us via the `submit-user-feedback` tool.

    <Prompt description="I have feedback to share: [describe what worked well, what didn't, or what you'd like to see]." actions={["copy"]}>
      I have feedback to share: \[describe what worked well, what didn't, or what you'd like to see].
    </Prompt>
  </Accordion>
</AccordionGroup>

## Prompting Building Blocks

The sections above show what to ask for. The next three sections—**Intent**, **Scope**, and **Direction**—help you phrase prompts so the agent gets you the right answer the first time.

<CardGroup cols={3}>
  <Card title="1. Intent" icon="comment-dots" href="#1-intent">
    What you want the agent to do—ask a question or take an action.
  </Card>

  <Card title="2. Scope" icon="sitemap" href="#2-scope">
    What data the agent should look at—workspace, provider, time range, groupings.
  </Card>

  <Card title="3. Direction" icon="sliders" href="#3-direction">
    How you want the answer presented—summary, table, checklist, and so on.
  </Card>
</CardGroup>

## 1. Intent

Every productive interaction with the FinOps Agent starts with a clear action or question. The agent supports two intent categories: ask the agent questions or ask the agent to perform actions.

### Ask the Agent Questions

You can ask questions about your cloud costs or about Vantage features and functionality.

<Prompt description="What drove our AWS EC2 costs last month?" actions={["copy"]}>
  What drove our AWS EC2 costs last month?
</Prompt>

<Prompt description="Which Azure services are trending up this week?" actions={["copy"]}>
  Which Azure services are trending up this week?
</Prompt>

<Prompt description="Show me any compute-related anomalies for the past week." actions={["copy"]}>
  Show me any compute-related anomalies for the past week.
</Prompt>

<Prompt description="Can you explain the difference between Virtual Tags and Segments? When should I use one over the other?" actions={["copy"]}>
  Can you explain the difference between Virtual Tags and Segments? When should I use one over the other?
</Prompt>

<CodeGroup>
  ```md Example interaction: cloud costs expandable theme={null}
  You:
  @Vantage What drove our AWS EC2 costs last month?

  The Agent:
  EC2 Cost Drivers — Last Month

  Scope used: Production Workspace (token wrkspc_a1b2c3d4e5f6g7h8)
  Period: 2024-10-01 to 2024-10-31
  Filter: AWS provider, service Amazon Elastic Compute Cloud - Compute
  Total EC2 Compute Spend: $127,450.23

  Key Takeaways
  • One AWS account (123456789012) in us-west-2 drove ~94.2% of EC2 compute costs.
  • All EC2 compute spend was in us-west-2.
  • Other accounts contributed minimal EC2 compute spend.

  Breakdown by Account and Region

  | AWS Account ID | Region    | EC2 Compute Cost (USD) | Share of EC2 | Notes                |
  |----------------|-----------|------------------------|--------------|----------------------|
  | 123456789012   | us-west-2 | $120,058.12            | 94.2%        | Primary cost driver  |
  | 987654321098   | us-west-2 | $6,892.45              | 5.4%         | Secondary contributor|
  | 555666777888   | us-west-2 | $412.18                | 0.32%        | Minor                |
  | 111222333444   | us-west-2 | $87.48                 | 0.07%        | Minor                |
  | 999888777666   | us-west-2 | $0.00                  | ~0%          | Negligible           |

  What this means
  • The vast majority of EC2 compute cost is concentrated in a single account and single region.
  • To refine "what drove cost" further (e.g., by usage type/purchase option, or top instances), we can:
    • Group by charge_type to separate On-Demand vs. Savings Plans/RIs and other line items.
    • Group by resource_id to identify the top-cost EC2 instances.
    • Add tag-based groupings (for example, tag:environment) if you use tags for ownership or workload mapping.

  Want deeper detail?
  • Do you want me to:
    • Break down by purchase option/charge type (On-Demand vs. SP/RI vs. Credits)?
    • List the top-cost EC2 instances in that account?
    • Run the analysis for a different workspace instead of Production?
    • Create a Cost Report you can open in Vantage with this exact filter and date range?

  Reply with your preferred next step and, if needed, the workspace name you want analyzed.
  ```

  ```md Example interaction: Vantage features expandable theme={null}
  You:
  @Vantage can you explain the difference between virtual tags and segments? when should I use one over the other?

  The Agent:
  Virtual Tags vs. Segments in Vantage

  Short answer: Virtual Tags are standardized, cross-provider labels you define in Vantage to improve and normalize tagging. Segments are hierarchical cost allocation views that ensure each dollar is allocated once (with rollups and unallocated tracking) for governance and showback/chargeback.

  Key Differences:
  - Purpose: Virtual Tags normalize and increase tagging coverage without infra changes. Segments allocate and govern costs in a hierarchy.
  - Scope: Virtual Tags apply everywhere in Vantage. Segments are structured views built from filters.
  - Allocation behavior: Virtual Tags don't enforce "allocated once." Segments enforce mutually exclusive allocation within a hierarchy.

  When To Use Which:
  - Use Virtual Tags when you need to standardize tagging across AWS, Azure, GCP, and other providers, or fill tagging gaps without changing cloud resources.
  - Use Segments when you need to build hierarchical cost allocation for finance governance and showback/chargeback, ensuring each cost is allocated exactly once.

  Recommended Approach:
  1. Define Virtual Tags first to create clean, consistent dimensions
  2. Build Segments using those virtual tags for your official allocation hierarchy
  3. Optionally use Saved Filters for ad-hoc lenses
  ```
</CodeGroup>

### Ask the Agent to Perform Actions

You can also ask the agent to create or update Vantage resources, generate Terraform code, or assemble artifacts on your behalf.

<Prompt description="Create a Cost Report filtered to AWS Lambda for the last 30 days and put it in the Infra folder." actions={["copy"]}>
  Create a Cost Report filtered to AWS Lambda for the last 30 days and put it in the Infra folder.
</Prompt>

<Prompt description="I have a list of teams in a CSV file (e.g., integrations, security, etc.). I have an AWS tag called `team` with the same value, and a Kubernetes label `organization/team` with the same team name. I want to combine all these costs into one Virtual Tag. Write me a Terraform script to do this." actions={["copy"]}>
  I have a list of teams in a CSV file (e.g., integrations, security, etc.). I have an AWS tag called `team` with the same value, and a Kubernetes label `organization/team` with the same team name. I want to combine all these costs into one Virtual Tag. Write me a Terraform script to do this.
</Prompt>

<CodeGroup>
  ```md Example interaction: create a report expandable theme={null}
  You:
  @Vantage can you create a report for me in the Infra folder (fldr_abc123def4567890) that shows me AWS EC2 box usage for October 2025?

  The Agent:
  Cost Report Created: AWS EC2 Usage (October 2025)

  Your report is ready in the Infra folder and focuses on AWS EC2 instance (compute) usage for October 2025.

  • Direct link: https://console.vantage.sh/go/rprt_xyz789abc123def4

  Report Summary:
  - **Title**: AWS EC2 Usage - October 2025
  - **Folder**: Infra (fldr_abc123def4567890)
  - **Filter**: (costs.provider = 'aws' AND costs.service = 'Amazon Elastic Compute Cloud - Compute')
  - **Date Range**: 2025-10-01 to 2025-10-31
  - **Aggregate By**: usage
  - **Workspace**: Production (wrkspc_def456ghi789jkl0)

  Notes:
  • This targets the EC2 compute service: Amazon Elastic Compute Cloud - Compute, which matches "EC2 box usage."
  • It excludes EC2-related "other" costs (like EBS, NAT, data transfer). If you want those included, I can broaden the filter.

  Want any tweaks?
  • Groupings: Add by account_id, region, or instance type (if tagged).
  • Compare periods: Keep or remove previous-period comparison.
  • Scope: Restrict to specific AWS accounts or regions.
  ```

  ````md Example interaction: create a Terraform script expandable theme={null}
  You:
  @Vantage I have a list of teams in a CSV file (e.g., integrations, security, etc.). I have an AWS tag called team with value of the same name and a Kubernetes label of organization/team with a value of the same team name. I want to combine all these costs to one virtual tag. Write me a Terraform script to do this.

  The Agent:
  Virtual Tag: Combine AWS tag "team" and Kubernetes label "organization/team"

  Goal: Create a single, cross-provider Virtual Tag in Vantage (key: team) whose values are sourced from:
  • AWS tag: team
  • Kubernetes label: organization/team
  This lets you group and filter total costs by team across both providers.

  How it works
  • Creates a Virtual Tag with key team.
  • Reads your CSV of team names and generates one Custom Value per team.
  • Each value uses a VQL filter that matches:
    • AWS costs where ``tags.name = 'team'`` and ``tags.value = '<team>'``
    • Kubernetes costs where ``tags.name = 'organization/team'`` and ``tags.value = '<team>'``

  Prerequisites
  • Vantage Terraform provider installed and configured with a Vantage API token.
  • A CSV file (e.g., ``teams.csv``) with a header ``team`` and one team name per row.
  • Vantage roles/permissions to manage Virtual Tags.

  References:
  • https://docs.vantage.sh/terraform_docs/resources/virtual_tag_config
  • https://docs.vantage.sh/tagging
  • https://docs.vantage.sh/vql

  Terraform: Provider and Variables

  ```hcl
  terraform {
    required_providers {
      vantage = {
        source  = "vantage-sh/vantage"
        version = ">= 0.1.24"
      }
    }
  }

  provider "vantage" {
    # Or set via environment variable: export VANTAGE_API_TOKEN=...
    api_token = var.vantage_api_token
  }

  variable "vantage_api_token" {
    type        = string
    description = "Vantage API token"
    sensitive   = true
  }

  variable "teams_csv_file" {
    type        = string
    description = "Path to CSV with column 'team'"
    default     = "teams.csv"
  }

  variable "virtual_tag_key" {
    type        = string
    description = "The Virtual Tag key to create"
    default     = "team"
  }

  variable "overridable" {
    type        = bool
    description = "Whether this Virtual Tag should override provider-supplied tags"
    default     = true
  }

  # Format: YYYY-MM (month you want to backfill to). Optional but recommended.
  variable "backfill_until" {
    type        = string
    description = "Earliest billing month to backfill (e.g., 2024-01)"
    default     = "2024-01"
  }
  ```

  Terraform: Build Values From the CSV and Create the Virtual Tag

  ```hcl
  locals {
    # Expect a header 'team' in the CSV
    raw_teams = csvdecode(file(var.teams_csv_file))

    # Normalize team values (optional: trim and lower for consistency)
    team_names = tolist(toset([
      for r in local.raw_teams : lower(trimspace(r.team))
      if try(length(trimspace(r.team)) > 0, false)
    ]))

    # Build one Virtual Tag value per team with a cross-provider VQL filter
    # Matches AWS tag 'team' == <team> OR Kubernetes label 'organization/team' == <team>
    virtual_tag_values = [
      for t in local.team_names : {
        name  = t
        filter = "( (costs.provider = 'aws' AND tags.name = 'team' AND tags.value = '${t}') OR (costs.provider = 'kubernetes' AND tags.name = 'organization/team' AND tags.value = '${t}') )"
      }
    ]
  }

  # Create the Virtual Tag (key = 'team') with CSV-driven values
  resource "vantage_virtual_tag_config" "team" {
    key            = var.virtual_tag_key
    overridable    = var.overridable
    backfill_until = var.backfill_until

    # The Vantage provider expects a list of objects for values.
    # Each object represents a "Custom Value" with "name" and "filter".
    values = local.virtual_tag_values
  }
  ```

  Notes:
  • The Vantage Terraform provider models nested blocks as list-of-objects (e.g., ``values = [ { name, filter } ]``).
  • This configuration uses Custom Value Virtual Tag values. You can extend it later for Cost-Based or Business Metric types if needed.

  Example teams.csv

  ```csv
  team
  integrations
  security
  platform
  data
  ```

  Usage
  1. Save the Terraform and CSV files.
  2. Set your Vantage API token:
  ```bash
  export VANTAGE_API_TOKEN="your-token"
  ```
  3. Initialize and apply:
  ```bash
  terraform init
  terraform plan
  terraform apply
  ```
  4. After processing (usually under an hour), use the new team Virtual Tag on Cost Reports for filtering/grouping.

  Tips and caveats
  • Avoid double counting in reports: If you're aggregating both AWS and Kubernetes in the same Cost Report, follow guidance to ensure you aren't double counting Kubernetes node costs and Kubernetes agent costs in the same view.
  ````
</CodeGroup>

***

## 2. Scope

The FinOps Agent needs to know which data to use. Vantage customers often have multiple workspaces, multiple cloud providers, and different access levels. Providing scope upfront can help to eliminate back-and-forth questions.

### Specify a Workspace

The agent automatically selects a workspace for your queries if you don't specify one. Understanding this process helps you know what data you're viewing.

<Info>
  Workspaces in Vantage separate your provider integrations into distinct cost views. Different integrations can be associated with different workspaces, so the workspace you query determines which cost data is available. Learn more about [workspaces](/workspaces).
</Info>

The Agent chooses a workspace in this order:

1. **If you specify one.** If you mention a workspace name or token in your prompt, that workspace is used.
2. **Your last used workspace.** If you've used a workspace before, the Agent remembers and uses that one.
3. **If you only have one workspace.** If your account has just one workspace, that's automatically used.

<Prompt description="Show me spend for the last 30 days." actions={["copy"]}>
  Show me spend for the last 30 days.
</Prompt>

```md Example agent response theme={null}
Last 30 Days Spend

• Workspace: Infra
• Date range: 2025-10-14 to 2025-11-13
• Total spend: $253,264.53 USD

Breakdown by Provider
• AWS: $215,235.88
• GCP: $1,497.95
• Kubernetes: $36,530.70

Note: Monthly rows are prorated to the exact date range.

Would you like this broken down by service or account, or run for a different workspace?
```

The agent used the default workspace (Infra). For more specific analysis, scope the prompt explicitly:

<Prompt description="Show me AWS EC2 costs for the last 30 days in the Production workspace." actions={["copy"]}>
  Show me AWS EC2 costs for the last 30 days in the Production workspace.
</Prompt>

### Specify a Folder

When you create Vantage resources, like reports, you can specify which folder to place them in by providing the [folder](/folders) URL or token (found at the end of the URL).

<Prompt description="Create a report in https://console.vantage.sh/reporting/fldr_abc123def4567890 showing AWS RDS costs for August 2025." actions={["copy"]}>
  Create a report in [https://console.vantage.sh/reporting/fldr\_abc123def4567890](https://console.vantage.sh/reporting/fldr_abc123def4567890) showing AWS RDS costs for August 2025.
</Prompt>

<CodeGroup>
  ```md Agent response: created report expandable theme={null}
  Cost Report Created: AWS RDS (August 2025)

  Your report is ready. You can open it here:

  • Report link: https://console.vantage.sh/go/rprt_xyz789abc123def4
  • Folder: https://console.vantage.sh/reporting/fldr_abc123def4567890

  Report Details
  • Title: AWS RDS Costs - August 2025
  • Scope: ``costs.provider = 'aws'`` and ``costs.service = 'Amazon Relational Database Service'``
  • Date range: 2025-08-01 to 2025-08-31
  • Chart type: Line
  • Aggregation: Cost over Date
  • Settings:
   • Discounts: Included
   • Tax: Included
   • Amortized: Yes
   • Credits/Refunds: Excluded
   • Previous period comparison: Enabled


  Next Steps (Optional)
  • Add groupings for more detail (e.g., ``region``, ``account_id``).
  • Attach budgets or forecasts to track RDS spend trends beyond August.
  • Create a dashboard widget if you want this visible on a central dashboard.

  If you’d like, I can:
  • Add groupings to this report,
  • Create a matching budget,
  • Or generate a forecast for upcoming months.
  ```
</CodeGroup>

### Specify Time Windows

Always include time ranges to avoid ambiguity about which period you're analyzing.

<Prompt description="Provide a breakdown of costs by service for Datadog from July 1 to July 31, 2025." actions={["copy"]}>
  Provide a breakdown of costs by service for Datadog from July 1 to July 31, 2025.
</Prompt>

<CodeGroup>
  ```md Agent response: scoped to time window expandable theme={null}
  Datadog Cost Breakdown — Management Workspace (2025-07-01 to 2025-07-31)

  Workspace: Management
  Provider: Datadog
  Period: 2025-07-01 to 2025-07-31

  Summary
  • Total Datadog spend: $52,847.30
  • Costs are aggregated monthly and include discounts and tax, with amortization enabled (credits/refunds excluded by default).

  Costs by Service

  | Service | Cost (USD) | Share of Total |
  |---------|------------|----------------|
  | APM | $21,852.18 | 41.35% |
  | Infrastructure Monitoring | $15,980.42 | 30.24% |
  | Containers | $5,696.94 | 10.78% |
  | Log Management | $4,835.53 | 9.15% |
  | CI Visibility | $2,737.49 | 5.18% |
  | Database Monitoring | $835.00 | 1.58% |
  | Real User Monitoring | $581.32 | 1.10% |
  | Synthetic Monitoring | $174.40 | 0.33% |
  | Serverless Monitoring | $154.02 | 0.28% |

  Notes
  • Monthly aggregation: Each record represents July 2025; the ``accrued_at`` date refers to the first day of the month.
  • Defaults used: include_discounts = true, include_tax = true, amortize = true, include_credits = false, include_refunds = false.
  If you want these toggled (e.g., exclude tax or include credits), let me know and I'll rerun the breakdown.
  ```
</CodeGroup>

### Reference Existing Reports

You can reference existing reports by their token or link, and the agent will analyze them.

<Prompt description="In this report rprt_xyz987abc456def789, what was my biggest change in cost from September 2025 to October 2025, and what resources contributed to this?" actions={["copy"]}>
  In this report rprt\_xyz987abc456def789, what was my biggest change in cost from September 2025 to October 2025, and what resources contributed to this?
</Prompt>

<CodeGroup>
  ```md Agent response: breakdown expandable theme={null}
  Biggest Month-over-Month Change (Sep 2025 → Oct 2025)

  • Largest change: AWS AmazonS3 costs decreased by $87,542.31 (from $245,892.67 in Sep to $158,350.36 in Oct).
  • Report link: https://console.vantage.sh/go/rprt_xyz987abc456def789

  What resources contributed to this change?

  The decrease was concentrated in a single AWS account. Bucket-level resource IDs are not present in this report's data, but the account-level breakdown clearly shows where the change occurred.

  AWS AmazonS3 by account:

  | AWS Account ID | Sep 2025 | Oct 2025 | Change |
  |----------------|----------|----------|--------|
  | 987654321098 | $238,450.12 | $152,180.45 | **-$86,269.67** |
  | 555444333222 | $5,892.34 | $4,567.89 | -$1,324.45 |
  | 111222333444 | $1,550.21 | $1,602.02 | +$51.81 |

  • Conclusion: ~98.5% of the S3 decrease was driven by account 987654321098.

  Other notable month-over-month movements (context):
  • Increases:
    - AWS AmazonEC2: +$42,156.78
    - AWS RDS: +$28,934.12
    - Azure Load Balancer: +$15,678.45
  • Decreases:
    - Snowflake Data Cloud: -$18,234.56
    - Datadog APM: -$12,567.89

  Want bucket-level detail? I can try to pull the top S3 buckets by month-over-month change, but the current report data doesn't expose bucket-level resource IDs. If you'd like, I can run a workspace-level query to identify the specific buckets contributing to this change.
  ```
</CodeGroup>

***

## 3. Direction

Direction helps the agent shape the final output. Use one of the following output formats to control how results are presented.

<AccordionGroup>
  <Accordion title="Executive Summary" icon="file-lines">
    3–6 bullet highlights with key numbers. Best for stakeholder updates and quick insights.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] Give a summary of findings.
      ```

      ```md Example response snippet theme={null}
      Spend increased 12% MoM; top driver is EC2 in us-east-1 (+$18k).
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="Bullet List" icon="list">
    Concise points or steps. Best for action items and next steps.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] List the top 5 drivers.
      ```

      ```md Example response snippet theme={null}
      - EC2 +$18k
      - S3 +$6k
      ...
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="Markdown Table" icon="table">
    Tabular view with columns. Best for grouped spend/usage data.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] Show a table grouped by service and region.
      ```

      ```md Example response snippet theme={null}
      | Service | Region | Cost (USD) |
      |---------|--------|------------|
      | EC2 | us-east-1 | $125,450.23 |
      | EC2 | us-west-2 | $89,234.56 |
      | S3 | us-east-1 | $67,891.12 |
      | S3 | us-west-2 | $45,678.90 |
      | RDS | us-east-1 | $34,567.89 |
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="CSV Snippet" icon="file-csv">
    Comma-separated rows. Best for spreadsheet import.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] Provide CSV for the top 10 services.
      ```

      ```md Example response snippet theme={null}
      Service,TotalCostUSD
      ClickHouse Cloud,18432.55
      AmazonEC2,5219.63
      AmazonS3,3077.81
      AmazonRDS,1693.00
      ComputeSavingsPlans,1345.40
      AmazonECS,832.11
      Amazon Elastic Block Storage (EBS),598.02
      Tackle Cloud GTM Platform,414.25
      AmazonCloudWatch,328.90
      AmazonElastiCache,211.87
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="Comparison/Diff" icon="arrows-left-right">
    Side-by-side or delta view. Best for before/after and period-over-period analysis.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] Compare last month vs this month and highlight the deltas.
      ```

      ```md Example response snippet theme={null}
      +12% total, EC2 +22%
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="Checklist" icon="list-check">
    Markdown checkboxes. Best for runbooks and to-dos.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] Output a checklist of fixes.
      ```

      ```md Example response snippet theme={null}
      - [ ] Tag coverage to 95%
      - [ ] Review root user access and remove if unused
      - [ ] Enable cost anomaly alerts for all AWS accounts
      - [ ] Archive old unused reports to reduce clutter
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="Annotated Findings" icon="note-sticky">
    Highlights with brief rationale. Best for root cause storytelling.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] Call out anomalies and likely causes.
      ```

      ```md Example response snippet theme={null}
      EC2 spike tied to ASG scale-out on 11/12.
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="Queries/Code Blocks" icon="terminal">
    VQL or CLI commands. Best for reproducibility.

    <CodeGroup>
      ```md How to request theme={null}
      [your question with intent and scope] Show the VQL you used.
      ```

      ```md Example response snippet theme={null}
      (costs.provider = 'aws')
      ```
    </CodeGroup>
  </Accordion>
</AccordionGroup>

***

## Putting It All Together

A great prompt usually combines all three building blocks in a single sentence: what you want, what data to use, and how to format the answer. You don't need a special syntax; plain English works.

A good prompt covers, in order:

1. **Intent** — what you want the agent to do (a question or an action).
2. **Scope** — the workspace, providers, services, accounts, regions, tags, time range, and groupings to apply.
3. **Direction** — how you want the answer formatted (summary, table, checklist, code block) and any notes or callouts.

Here's a fully-formed prompt that uses all three:

<Prompt description="In the Production workspace, show AWS EC2 and S3 spend for the last 30 days, grouped by service and account ID. Present the result as a table and identify the top 5 cost drivers." actions={["copy"]}>
  In the Production workspace, show AWS EC2 and S3 spend for the last 30 days, grouped by service and account ID. Present the result as a table and identify the top 5 cost drivers.
</Prompt>

How that maps to the building blocks:

* **Intent:** "Show AWS EC2 and S3 spend" (a question).
* **Scope:** "In the Production workspace", "AWS EC2 and S3", "for the last 30 days", "grouped by service and account ID".
* **Direction:** "as a table", "identify the top 5 cost drivers".

## Ready-to-Use Prompts

Copy and customize these prompts for common FinOps tasks. Each one follows the Intent, Scope, and Direction framework. Replace the values in brackets (such as `[workspace]` or `[time period]`) with your own.

<AccordionGroup>
  <Accordion title="Investigate cost spikes" icon="chart-line-up">
    Identify what caused unexpected cost increases.

    <Prompt description="What caused the cost spike in the [workspace] workspace [time period]?" actions={["copy"]}>
      What caused the cost spike in the \[workspace] workspace \[time period]?
    </Prompt>
  </Accordion>

  <Accordion title="Analyze trends" icon="chart-bar">
    Track spending patterns and identify trends over time.

    <Prompt description="Show the [time period] trend for [service] spend in [workspace]." actions={["copy"]}>
      Show the \[time period] trend for \[service] spend in \[workspace].
    </Prompt>
  </Accordion>

  <Accordion title="Track Budgets" icon="wallet">
    Compare actual spending against Budgets and forecasts.

    <Prompt description="List all Budgets in the [workspace] workspace and compare against actuals." actions={["copy"]}>
      List all Budgets in the \[workspace] workspace and compare against actuals.
    </Prompt>
  </Accordion>

  <Accordion title="Detect anomalies" icon="triangle-exclamation">
    Find unusual spending patterns that may indicate issues.

    <Prompt description="Find anomalies for the last [days] days in the [workspace] workspace." actions={["copy"]}>
      Find anomalies for the last \[days] days in the \[workspace] workspace.
    </Prompt>
  </Accordion>

  <Accordion title="Investigate cost anomalies" icon="magnifying-glass-chart">
    When you receive a Cost Anomaly Alert in Slack, click the **Investigate Anomaly** button to start an automated investigation. You can also ask the agent directly—in either Slack or the console. The agent investigates each anomaly, queries daily costs around the spike, identifies attributed resources, and presents correlations across anomalies.

    <Prompt description="Investigate the anomalies on my [report name] report." actions={["copy"]}>
      Investigate the anomalies on my \[report name] report.
    </Prompt>

    <CodeGroup>
      ```md Example response expandable theme={null}
      AWS Cost Anomaly Investigation

      Report: AWS Costs (filter: all AWS costs)
      Detected: January 16, 2026 | 3 anomalies with a combined increase of ~$156.42

      1. Amazon S3 — API Requests (+$72.18) — Largest Spike

      | Field           | Value                                     |
      |-----------------|-------------------------------------------|
      | Category        | API Request                               |
      | Occurred        | Jan 10, 2026                              |
      | Amount          | $198.34                                   |
      | Previous Day    | $157.20 (+26.2%)                          |
      | 7-Day Average   | $126.16 (+57.2% above baseline)           |

      Resource: my-data-lake-bucket-441298320517 (S3 bucket, us-west-2, account 441298320517)

      Daily API Request Trend:

      | Date   | S3 API Request Cost |
      |--------|---------------------|
      | Jan 7  | $124.30             |
      | Jan 8  | $131.05             |
      | Jan 9  | $157.20             |
      | Jan 10 | $198.34 ⬆️ anomaly  |
      | Jan 11 | $210.77             |
      | Jan 12 | $187.63             |
      | Jan 13 | $156.41             |

      Analysis: The spike on Jan 10 was notable, but costs continued to climb through
      Jan 11 ($210.77). This S3 bucket is used for data lake storage. The sustained
      increase in API requests suggests either new ETL jobs querying the bucket,
      increased data delivery frequency, or a change in access patterns.

      2. Amazon GuardDuty (+$51.83)

      | Field           | Value                                     |
      |-----------------|-------------------------------------------|
      | Category        | GuardDuty                                 |
      | Occurred        | Jan 12, 2026                              |
      | Amount          | $84.57                                    |
      | Previous Day    | $33.19 (+154.8%)                          |
      | 7-Day Average   | $32.74 (+158.3% above baseline)           |

      Daily Trend:

      | Date   | GuardDuty Cost |
      |--------|----------------|
      | Jan 7  | $31.42         |
      | Jan 8  | $32.18         |
      | Jan 9  | $33.70         |
      | Jan 10 | $34.25         |
      | Jan 11 | $33.19         |
      | Jan 12 | $84.57 ⬆️ anomaly |
      | Jan 13 | $7.82 (partial day)|

      Analysis: GuardDuty costs more than doubled on Jan 12. This typically indicates
      a surge in analyzed events — possibly increased VPC Flow Logs, DNS logs, or
      CloudTrail events being scanned. This could correlate with the S3 API request
      spike generating more CloudTrail events.

      3. Amazon CloudWatch — API Requests (+$32.41)

      | Field           | Value                                     |
      |-----------------|-------------------------------------------|
      | Category        | API Request                               |
      | Occurred        | Jan 11, 2026                              |
      | Amount          | $67.92                                    |
      | Previous Day    | $38.14 (+78.1%)                           |
      | 7-Day Average   | $35.51 (+91.3% above baseline)            |

      Daily API Request Trend:

      | Date   | CloudWatch API Cost |
      |--------|---------------------|
      | Jan 7  | $35.63              |
      | Jan 8  | $34.29              |
      | Jan 9  | $36.87              |
      | Jan 10 | $38.14              |
      | Jan 11 | $67.92 ⬆️ anomaly   |
      | Jan 12 | $52.40              |
      | Jan 13 | $48.71              |

      Analysis: CloudWatch API costs jumped 78% on Jan 11 and remain elevated
      (~$48-52/day vs. the ~$35 baseline). This suggests a new monitoring configuration
      or increased GetMetricData calls.

      Key Correlations & Recommendations

      S3 + GuardDuty + CloudWatch may be linked: The surge in S3 API requests
      generates more CloudTrail events, which GuardDuty analyzes and CloudWatch
      monitors. Investigate what is driving the increased S3 API activity on the
      data lake bucket — this could be the root cause of multiple anomalies.

      Action items:
      • Investigate S3 API surge — this is the largest and still-growing cost.
        Check CloudTrail for unusual access patterns on the data lake bucket.
      • Review CloudWatch API usage — the elevated baseline suggests a permanent
        config change. Audit recent monitoring changes.

      Console links:
      • Cost Report: https://console.vantage.sh/go/rprt_abc123def456
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="Tag-based analysis" icon="tags">
    Group and filter costs using tags for allocation and showback.

    <Prompt description="Show cost grouped by tag:[key] for [time period] in [workspace]." actions={["copy"]}>
      Show cost grouped by tag:\[key] for \[time period] in \[workspace].
    </Prompt>
  </Accordion>

  <Accordion title="Report analysis" icon="file-chart-line">
    Deep-dive into existing reports to understand cost changes.

    <Prompt description="In this report [report_token or link], what was my biggest change in cost from [period 1] to [period 2], and what resources contributed to this?" actions={["copy"]}>
      In this report \[report\_token or link], what was my biggest change in cost from \[period 1] to \[period 2], and what resources contributed to this?
    </Prompt>
  </Accordion>
</AccordionGroup>

## Understand Responses

Because the FinOps Agent relies on an LLM, responses are not always deterministic. The same prompt may return slightly different answers, and results depend heavily on the context you provide. Understanding how responses work helps you verify results and get the most out of the agent when answers look unexpected.

<Tip>
  The FinOps Agent uses [Vantage Query Language (VQL)](/vql) to query your cost data. VQL is a SQL-like language for filtering cloud cost data across providers. When the agent answers a cost question, it generates VQL behind the scenes to fetch the data.
</Tip>

You can verify agent responses using the following methods:

* **Compare against Cost Reports**. Use your existing Cost Reports as a source of truth. For example, if you ask about EC2 spend last month, compare the answer against your saved report for that timeframe.
* **Request the VQL query**. Ask the agent to show you the VQL it used. Add "Show the VQL you used" to your prompt or ask in a follow-up message. Review the VQL to understand what data the agent accessed and confirm the filters and groupings align with your intent.
* **Cross-reference between surfaces**. If you receive an unexpected answer in Slack, try the same prompt in the console (or vice versa). Conversations are independent, so you can use one as a sanity check for the other.

## Limitations

Understanding the agent's limitations helps you set appropriate expectations and get the most out of your interactions.

<AccordionGroup>
  <Accordion title="No automatic web browsing" icon="globe">
    The agent doesn't browse the internet unless a tool explicitly provides that information. It can't fetch live pricing from websites unless you provide it or a tool returns it.
  </Accordion>

  <Accordion title="Tooling and account access" icon="key">
    The agent can only access what the [Vantage MCP](/vantage_mcp) and [Vantage Docs MCP](/docs_mcp) tools return, plus anything you share directly in the conversation. All access is scoped to your [RBAC](/rbac) permissions.
  </Accordion>

  <Accordion title="No system control" icon="ban">
    The agent can't run commands, deploy code, or change infrastructure outside Vantage. It can suggest provider commands, but you must run them yourself. Cost remediation actions are taken only via the Slack approval workflow.
  </Accordion>

  <Accordion title="No console-based remediation actions" icon="circle-exclamation">
    The console agent can describe and explain cost recommendations but cannot purchase Savings Plans, RIs, or rightsize resources. Remediation actions and approvals run through Slack today.
  </Accordion>

  <Accordion title="Misinterpretation" icon="triangle-exclamation">
    The agent may misinterpret ambiguous requests. Be specific—provide workspace, time range, and the exact resource or service whenever possible.
  </Accordion>

  <Accordion title="Context limits" icon="message">
    The agent only sees the current chat context. It doesn't carry context between Slack and the console, and it doesn't remember previous Slack threads or console conversations unless they're part of the current thread.
  </Accordion>

  <Accordion title="File support" icon="paperclip">
    The agent currently accepts text-based files, including CSVs. Image analysis and other file formats are not supported today; additional formats are planned.
  </Accordion>

  <Accordion title="No sensitive data inference" icon="lock">
    The agent doesn't access personal data unless you provide it explicitly. It can't read your emails, tickets, or external dashboards without you pasting content or granting access via tools.
  </Accordion>
</AccordionGroup>