FinOps AI Prompt Guide

The FinOps Agent is the same agent whether you use it in the Vantage console or in Slack. This guide shows what the agent can do and how to phrase your prompts so you get useful answers the first time.

Every prompt example on this page is copy-pasteable. Click the Copy button on any prompt card and paste it into the agent in the console or in Slack. In Slack, prepend @Vantage to the prompt so the agent is notified.

To turn a prompt into a saved, refreshable table report, use Canvas. It applies the same Intent, Scope, and Direction principles covered here, with a Prompt Library focused on building structured tables.

What the Agent Can Do

The FinOps Agent is a purpose-built FinOps assistant. Its read and write actions are powered by tools from the Vantage MCP (cost data and resource management) and the Vantage Docs MCP (product knowledge); however, the agent takes this one step further and brings FinOps reasoning, multi-step planning, and awareness of your workspace, RBAC scope, and audit context. For a complete reference of the underlying tools, see the Vantage MCP Tools table. The sections below organize the agent’s capabilities into ten categories. Each accordion explains, in plain language, what you can ask for and provides ready-to-copy prompts.

Explore your cloud costs

Ask the agent to summarize, break down, or compare cloud spend across providers, services, accounts, regions, and tags. Useful for ad-hoc cost questions, executive summaries, and identifying drivers of change.Underlying MCP tools: query-costs, list-costs, list-cost-providers, list-cost-services, get-cost-provider-accounts, list-cost-integrations.

What did we spend on AWS Lambda last month in the Production workspace?

Provide a breakdown of costs by service for Datadog from July 1 to July 31, 2025.

Compare AWS spend in October 2025 vs. September 2025. What were the top three drivers of the change, and which accounts and regions contributed?

Which cost providers and integrations are connected to my Vantage account?

Build and manage Cost Reports

Ask the agent to create, retrieve, list, delete, or forecast Cost Reports. The agent generates the VQL filter for you based on a plain-language description and can place reports in a specific Folder. You can reference an existing report by pasting its console URL (for example, https://console.vantage.sh/reports/rprt_xyz789abc123def4) or by its token (for example, rprt_xyz789abc123def4).Underlying MCP tools: create-cost-report, get-cost-report, list-cost-reports, delete-cost-report, get-cost-report-forecast, list-unit-costs.

Create a Cost Report titled "AWS RDS - October 2025" filtered to AWS RDS for October 2025 and place it in the Infra folder.

List my Cost Reports in the Engineering folder, then show me the filter and groupings on the largest one.

Forecast spend for this Cost Report (https://console.vantage.sh/reports/rprt_xyz789abc123def4) for the next 90 days and explain what's driving the forecast.

Show me the daily unit costs for this Cost Report (rprt_xyz789abc123def4) over the last 30 days.

Organize with Folders and Dashboards

Use the agent to organize Cost Reports into Folders and to assemble Dashboards from existing reports, widgets, and saved filters.Underlying MCP tools: create-folder, update-folder, delete-folder, list-folders, get-folder, create-dashboard, get-dashboard, update-dashboard, delete-dashboard, list-dashboards.

Create a folder called "Data Platform Costs" and move these two reports into it: https://console.vantage.sh/reports/rprt_xyz789abc123def4 and https://console.vantage.sh/reports/rprt_abc456def789ghi0

Create a Dashboard called "Engineering Cost Overview" set to a trailing 30-day window. Can you add these linked reports to it: https://console.vantage.sh/reports/rprt_xyz789abc123def4 and https://console.vantage.sh/reports/rprt_abc456def789ghi0

Show me my existing Dashboards and Folders. Which Dashboards are most relevant to AWS spend?

Investigate cost anomalies

Ask the agent to find, explain, and triage Cost Anomaly Alerts. It pulls the daily cost data around the spike, identifies attributed resources, and explains what likely changed.Underlying MCP tools: list-anomalies, get-anomaly, update-anomaly.

Investigate the anomalies on my AWS Costs report from the past 14 days. What's driving each one, and are any of them correlated?

Explain the anomaly on my "AWS Production Costs" report from yesterday. Which service spiked, what's the magnitude, and which resources are attributed?

Find and act on cost recommendations

Ask the agent to surface, explain, and drill into cost recommendations such as Savings Plans, Reserved Instances, and rightsizing opportunities.Underlying MCP tools: list-recommendations, get-recommendation-details, get-recommendation-resources, get-recommendation-resource-details.

The agent can surface, explain, and analyze recommendations in both the console and Slack. If your account has GitHub connected, it can also open a GitHub issue with the exact Terraform changes for a rightsizing recommendation. It cannot itself purchase Savings Plans or Reserved Instances or execute rightsizing changes; those remediations and approvals are handled through the Slack workflow.

List all open AWS cost recommendations, ranked by estimated monthly savings. Which three should I prioritize this week?

Show me the resources affected by rightsizing recommendations, with their current and recommended instance types.

Track Budgets and Cost Alerts

Ask the agent to create and update Budgets, and to create and review Cost Alerts. The agent can compare actual spend against budget targets and set up threshold-based notifications.Underlying MCP tools: create-budget, update-budget, delete-budget, get-budget, list-budgets, create-cost-alert, get-cost-alert, list-cost-alerts.

Create a monthly Budget of $50,000 for my Production AWS Costs report (rprt_xyz789abc123def4) for the rest of the calendar year.

List all Budgets in the Finance workspace and compare actual spend against budget targets. Which are off-track?

Create a weekly Cost Alert that notifies the #finops Slack channel if AWS RDS spend exceeds $10,000 in any 7-day window.

Tag and allocate costs

Ask the agent to explore tags and tag values across providers and to create Virtual Tag configurations that normalize and combine cost attribution across providers.Underlying MCP tools: list-tags, list-tag-values, create-virtual-tag-config.

What tag keys are available for filtering my AWS costs, and what are the most common values for the team tag?

Create a Virtual Tag called team that combines the AWS team tag and the Kubernetes organization/team label. Backfill it to January 2026 and let it override provider-supplied tags.

Show last month's cost grouped by tag:team in the Engineering workspace. Which team spent the most?

Inspect resources, workspace, and audit history

Ask the agent about specific cloud resources, what workspaces and teams you have access to, and what’s been happening in your account.Underlying MCP tools: list-provider-resources, get-provider-resource, list-audit-logs, get-myself, get-users, get-team, get-teams.

Which workspaces do I have access to, and what's my access level in each?

List my AWS EC2 instances in us-east-1 that cost more than $100 per month, sorted by cost.

Show me details and the cost breakdown for this resource: arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234ef567890.

Show me audit log entries from the past 7 days for changes to Cost Reports and Budgets in my workspace.

Correlate costs with Datadog (MCP Connector)

If your organization has connected the Datadog MCP, the agent can pull live Datadog telemetry—metrics, logs, monitors, dashboards, APM, and events—and reason over it alongside your Vantage cost data. This is useful for tying cost changes to infrastructure activity, validating rightsizing recommendations against real utilization, and verifying whether a resource is actually idle before acting on it.

The Datadog MCP must be connected from the Integrations page by an Organization Owner or Integration Owner. See the Datadog MCP documentation for setup and more examples.

Did any recent deployments cause my AWS costs to increase?

Which EC2 instances have the highest cost but lowest utilization?

Our AWS data transfer costs jumped this week. Which services or hosts in Datadog show increased network throughput over the same period?

Send feedback to Vantage

Have something to share with the Vantage team? Tell the agent and it will route your feedback directly to us via the submit-user-feedback tool.

I have feedback to share: [describe what worked well, what didn't, or what you'd like to see].

Prompting Building Blocks

The sections above show what to ask for. The next three sections—Intent, Scope, and Direction—help you phrase prompts so the agent gets you the right answer the first time.

1. Intent

What you want the agent to do—ask a question or take an action.

2. Scope

What data the agent should look at—workspace, provider, time range, groupings.

3. Direction

How you want the answer presented—summary, table, checklist, and so on.

1. Intent

Every productive interaction with the FinOps Agent starts with a clear action or question. The agent supports two intent categories: ask the agent questions or ask the agent to perform actions.

Ask the Agent Questions

You can ask questions about your cloud costs or about Vantage features and functionality.

What drove our AWS EC2 costs last month?

Which Azure services are trending up this week?

Show me any compute-related anomalies for the past week.

Can you explain the difference between Virtual Tags and Segments? When should I use one over the other?

You:
@Vantage What drove our AWS EC2 costs last month?

The Agent:
EC2 Cost Drivers — Last Month

Scope used: Production Workspace (token wrkspc_a1b2c3d4e5f6g7h8)
Period: 2024-10-01 to 2024-10-31
Filter: AWS provider, service Amazon Elastic Compute Cloud - Compute
Total EC2 Compute Spend: $127,450.23

Key Takeaways
• One AWS account (123456789012) in us-west-2 drove ~94.2% of EC2 compute costs.
• All EC2 compute spend was in us-west-2.
• Other accounts contributed minimal EC2 compute spend.

Breakdown by Account and Region

| AWS Account ID | Region    | EC2 Compute Cost (USD) | Share of EC2 | Notes                |
|----------------|-----------|------------------------|--------------|----------------------|
| 123456789012   | us-west-2 | $120,058.12            | 94.2%        | Primary cost driver  |
| 987654321098   | us-west-2 | $6,892.45              | 5.4%         | Secondary contributor|
| 555666777888   | us-west-2 | $412.18                | 0.32%        | Minor                |
| 111222333444   | us-west-2 | $87.48                 | 0.07%        | Minor                |
| 999888777666   | us-west-2 | $0.00                  | ~0%          | Negligible           |

What this means
• The vast majority of EC2 compute cost is concentrated in a single account and single region.
• To refine "what drove cost" further (e.g., by usage type/purchase option, or top instances), we can:
  • Group by charge_type to separate On-Demand vs. Savings Plans/RIs and other line items.
  • Group by resource_id to identify the top-cost EC2 instances.
  • Add tag-based groupings (for example, tag:environment) if you use tags for ownership or workload mapping.

Want deeper detail?
• Do you want me to:
  • Break down by purchase option/charge type (On-Demand vs. SP/RI vs. Credits)?
  • List the top-cost EC2 instances in that account?
  • Run the analysis for a different workspace instead of Production?
  • Create a Cost Report you can open in Vantage with this exact filter and date range?

Reply with your preferred next step and, if needed, the workspace name you want analyzed.

You:
@Vantage can you explain the difference between virtual tags and segments? when should I use one over the other?

The Agent:
Virtual Tags vs. Segments in Vantage

Short answer: Virtual Tags are standardized, cross-provider labels you define in Vantage to improve and normalize tagging. Segments are hierarchical cost allocation views that ensure each dollar is allocated once (with rollups and unallocated tracking) for governance and showback/chargeback.

Key Differences:
- Purpose: Virtual Tags normalize and increase tagging coverage without infra changes. Segments allocate and govern costs in a hierarchy.
- Scope: Virtual Tags apply everywhere in Vantage. Segments are structured views built from filters.
- Allocation behavior: Virtual Tags don't enforce "allocated once." Segments enforce mutually exclusive allocation within a hierarchy.

When To Use Which:
- Use Virtual Tags when you need to standardize tagging across AWS, Azure, GCP, and other providers, or fill tagging gaps without changing cloud resources.
- Use Segments when you need to build hierarchical cost allocation for finance governance and showback/chargeback, ensuring each cost is allocated exactly once.

Recommended Approach:
1. Define Virtual Tags first to create clean, consistent dimensions
2. Build Segments using those virtual tags for your official allocation hierarchy
3. Optionally use Saved Filters for ad-hoc lenses

Ask the Agent to Perform Actions

You can also ask the agent to create or update Vantage resources, generate Terraform code, or assemble artifacts on your behalf.

Create a Cost Report filtered to AWS Lambda for the last 30 days and put it in the Infra folder.

I have a list of teams in a CSV file (e.g., integrations, security, etc.). I have an AWS tag called team with the same value, and a Kubernetes label organization/team with the same team name. I want to combine all these costs into one Virtual Tag. Write me a Terraform script to do this.

You:
@Vantage can you create a report for me in the Infra folder (fldr_abc123def4567890) that shows me AWS EC2 box usage for October 2025?

The Agent:
Cost Report Created: AWS EC2 Usage (October 2025)

Your report is ready in the Infra folder and focuses on AWS EC2 instance (compute) usage for October 2025.

• Direct link: https://console.vantage.sh/go/rprt_xyz789abc123def4

Report Summary:
- **Title**: AWS EC2 Usage - October 2025
- **Folder**: Infra (fldr_abc123def4567890)
- **Filter**: (costs.provider = 'aws' AND costs.service = 'Amazon Elastic Compute Cloud - Compute')
- **Date Range**: 2025-10-01 to 2025-10-31
- **Aggregate By**: usage
- **Workspace**: Production (wrkspc_def456ghi789jkl0)

Notes:
• This targets the EC2 compute service: Amazon Elastic Compute Cloud - Compute, which matches "EC2 box usage."
• It excludes EC2-related "other" costs (like EBS, NAT, data transfer). If you want those included, I can broaden the filter.

Want any tweaks?
• Groupings: Add by account_id, region, or instance type (if tagged).
• Compare periods: Keep or remove previous-period comparison.
• Scope: Restrict to specific AWS accounts or regions.

You:
@Vantage I have a list of teams in a CSV file (e.g., integrations, security, etc.). I have an AWS tag called team with value of the same name and a Kubernetes label of organization/team with a value of the same team name. I want to combine all these costs to one virtual tag. Write me a Terraform script to do this.

The Agent:
Virtual Tag: Combine AWS tag "team" and Kubernetes label "organization/team"

Goal: Create a single, cross-provider Virtual Tag in Vantage (key: team) whose values are sourced from:
• AWS tag: team
• Kubernetes label: organization/team
This lets you group and filter total costs by team across both providers.

How it works
• Creates a Virtual Tag with key team.
• Reads your CSV of team names and generates one Custom Value per team.
• Each value uses a VQL filter that matches:
  • AWS costs where ``tags.name = 'team'`` and ``tags.value = '<team>'``
  • Kubernetes costs where ``tags.name = 'organization/team'`` and ``tags.value = '<team>'``

Prerequisites
• Vantage Terraform provider installed and configured with a Vantage API token.
• A CSV file (e.g., ``teams.csv``) with a header ``team`` and one team name per row.
• Vantage roles/permissions to manage Virtual Tags.

References:
• https://docs.vantage.sh/terraform_docs/resources/virtual_tag_config
• https://docs.vantage.sh/tagging
• https://docs.vantage.sh/vql

Terraform: Provider and Variables

```hcl
terraform {
  required_providers {
    vantage = {
      source  = "vantage-sh/vantage"
      version = ">= 0.1.24"
    }
  }
}

provider "vantage" {
  # Or set via environment variable: export VANTAGE_API_TOKEN=...
  api_token = var.vantage_api_token
}

variable "vantage_api_token" {
  type        = string
  description = "Vantage API token"
  sensitive   = true
}

variable "teams_csv_file" {
  type        = string
  description = "Path to CSV with column 'team'"
  default     = "teams.csv"
}

variable "virtual_tag_key" {
  type        = string
  description = "The Virtual Tag key to create"
  default     = "team"
}

variable "overridable" {
  type        = bool
  description = "Whether this Virtual Tag should override provider-supplied tags"
  default     = true
}

# Format: YYYY-MM (month you want to backfill to). Optional but recommended.
variable "backfill_until" {
  type        = string
  description = "Earliest billing month to backfill (e.g., 2024-01)"
  default     = "2024-01"
}
```

Terraform: Build Values From the CSV and Create the Virtual Tag

```hcl
locals {
  # Expect a header 'team' in the CSV
  raw_teams = csvdecode(file(var.teams_csv_file))

  # Normalize team values (optional: trim and lower for consistency)
  team_names = tolist(toset([
    for r in local.raw_teams : lower(trimspace(r.team))
    if try(length(trimspace(r.team)) > 0, false)
  ]))

  # Build one Virtual Tag value per team with a cross-provider VQL filter
  # Matches AWS tag 'team' == <team> OR Kubernetes label 'organization/team' == <team>
  virtual_tag_values = [
    for t in local.team_names : {
      name  = t
      filter = "( (costs.provider = 'aws' AND tags.name = 'team' AND tags.value = '${t}') OR (costs.provider = 'kubernetes' AND tags.name = 'organization/team' AND tags.value = '${t}') )"
    }
  ]
}

# Create the Virtual Tag (key = 'team') with CSV-driven values
resource "vantage_virtual_tag_config" "team" {
  key            = var.virtual_tag_key
  overridable    = var.overridable
  backfill_until = var.backfill_until

  # The Vantage provider expects a list of objects for values.
  # Each object represents a "Custom Value" with "name" and "filter".
  values = local.virtual_tag_values
}
```

Notes:
• The Vantage Terraform provider models nested blocks as list-of-objects (e.g., ``values = [ { name, filter } ]``).
• This configuration uses Custom Value Virtual Tag values. You can extend it later for Cost-Based or Business Metric types if needed.

Example teams.csv

```csv
team
integrations
security
platform
data
```

Usage
1. Save the Terraform and CSV files.
2. Set your Vantage API token:
```bash
export VANTAGE_API_TOKEN="your-token"
```
3. Initialize and apply:
```bash
terraform init
terraform plan
terraform apply
```
4. After processing (usually under an hour), use the new team Virtual Tag on Cost Reports for filtering/grouping.

Tips and caveats
• Avoid double counting in reports: If you're aggregating both AWS and Kubernetes in the same Cost Report, follow guidance to ensure you aren't double counting Kubernetes node costs and Kubernetes agent costs in the same view.

2. Scope

The FinOps Agent needs to know which data to use. Vantage customers often have multiple workspaces, multiple cloud providers, and different access levels. Providing scope upfront can help to eliminate back-and-forth questions.

Specify a Workspace

If you don’t specify a workspace, the agent falls back to the workspace you’re currently working in. Understanding this process helps you know what data you’re viewing.

Workspaces in Vantage separate your provider integrations into distinct cost views. Different integrations can be associated with different workspaces, so the workspace you query determines which cost data is available. Learn more about workspaces.

The Agent chooses a workspace in this order:

If you specify one. If you mention a workspace name or token in your prompt, that workspace is used.
Your current workspace. Otherwise, the agent uses your active workspace—the one you most recently selected in the Vantage console. There’s no separate default setting; to change which workspace the agent falls back to, switch workspaces in the console using the workspace switcher, and the agent will use that one next.
Otherwise, it asks. If it can’t confidently determine which workspace you mean, the agent asks you rather than guessing.

Show me spend for the last 30 days.

Example agent response

Last 30 Days Spend

• Workspace: Infra
• Date range: 2025-10-14 to 2025-11-13
• Total spend: $253,264.53 USD

Breakdown by Provider
• AWS: $215,235.88
• GCP: $1,497.95
• Kubernetes: $36,530.70

Note: Monthly rows are prorated to the exact date range.

Would you like this broken down by service or account, or run for a different workspace?

The agent used the default workspace (Infra). For more specific analysis, scope the prompt explicitly:

Show me AWS EC2 costs for the last 30 days in the Production workspace.

Specify a Folder

When you create Vantage resources, like reports, you can specify which folder to place them in by providing the folder URL or token (found at the end of the URL).

Create a report in https://console.vantage.sh/reporting/fldr_abc123def4567890 showing AWS RDS costs for August 2025.

Cost Report Created: AWS RDS (August 2025)

Your report is ready. You can open it here:

• Report link: https://console.vantage.sh/go/rprt_xyz789abc123def4
• Folder: https://console.vantage.sh/reporting/fldr_abc123def4567890

Report Details
• Title: AWS RDS Costs - August 2025
• Scope: ``costs.provider = 'aws'`` and ``costs.service = 'Amazon Relational Database Service'``
• Date range: 2025-08-01 to 2025-08-31
• Chart type: Line
• Aggregation: Cost over Date
• Settings:
 • Discounts: Included
 • Tax: Included
 • Amortized: Yes
 • Credits/Refunds: Excluded
 • Previous period comparison: Enabled


Next Steps (Optional)
• Add groupings for more detail (e.g., ``region``, ``account_id``).
• Attach budgets or forecasts to track RDS spend trends beyond August.
• Create a dashboard widget if you want this visible on a central dashboard.

If you’d like, I can:
• Add groupings to this report,
• Create a matching budget,
• Or generate a forecast for upcoming months.

Specify Time Windows

Always include time ranges to avoid ambiguity about which period you’re analyzing.

Provide a breakdown of costs by service for Datadog from July 1 to July 31, 2025.

Datadog Cost Breakdown — Management Workspace (2025-07-01 to 2025-07-31)

Workspace: Management
Provider: Datadog
Period: 2025-07-01 to 2025-07-31

Summary
• Total Datadog spend: $52,847.30
• Costs are aggregated monthly and reflect this workspace's default report settings (here: discounts and tax included, amortization enabled, credits/refunds excluded).

Costs by Service

| Service | Cost (USD) | Share of Total |
|---------|------------|----------------|
| APM | $21,852.18 | 41.35% |
| Infrastructure Monitoring | $15,980.42 | 30.24% |
| Containers | $5,696.94 | 10.78% |
| Log Management | $4,835.53 | 9.15% |
| CI Visibility | $2,737.49 | 5.18% |
| Database Monitoring | $835.00 | 1.58% |
| Real User Monitoring | $581.32 | 1.10% |
| Synthetic Monitoring | $174.40 | 0.33% |
| Serverless Monitoring | $154.02 | 0.28% |

Notes
• Monthly aggregation: Each record represents July 2025; the ``accrued_at`` date refers to the first day of the month.
• Settings applied (from this workspace's default report settings): include_discounts = true, include_tax = true, amortize = true, include_credits = false, include_refunds = false.
If you want these toggled (e.g., exclude tax or include credits), let me know and I'll rerun the breakdown.

Reference Existing Reports

You can reference existing reports by their token or link, and the agent will analyze them.

In this report rprt_xyz987abc456def789, what was my biggest change in cost from September 2025 to October 2025, and what resources contributed to this?

Biggest Month-over-Month Change (Sep 2025 → Oct 2025)

• Largest change: AWS AmazonS3 costs decreased by $87,542.31 (from $245,892.67 in Sep to $158,350.36 in Oct).
• Report link: https://console.vantage.sh/go/rprt_xyz987abc456def789

What resources contributed to this change?

The decrease was concentrated in a single AWS account. Bucket-level resource IDs are not present in this report's data, but the account-level breakdown clearly shows where the change occurred.

AWS AmazonS3 by account:

| AWS Account ID | Sep 2025 | Oct 2025 | Change |
|----------------|----------|----------|--------|
| 987654321098 | $238,450.12 | $152,180.45 | **-$86,269.67** |
| 555444333222 | $5,892.34 | $4,567.89 | -$1,324.45 |
| 111222333444 | $1,550.21 | $1,602.02 | +$51.81 |

• Conclusion: ~98.5% of the S3 decrease was driven by account 987654321098.

Other notable month-over-month movements (context):
• Increases:
  - AWS AmazonEC2: +$42,156.78
  - AWS RDS: +$28,934.12
  - Azure Load Balancer: +$15,678.45
• Decreases:
  - Snowflake Data Cloud: -$18,234.56
  - Datadog APM: -$12,567.89

Want bucket-level detail? I can try to pull the top S3 buckets by month-over-month change, but the current report data doesn't expose bucket-level resource IDs. If you'd like, I can run a workspace-level query to identify the specific buckets contributing to this change.

3. Direction

Direction helps the agent shape the final output. Use one of the following output formats to control how results are presented.

Executive Summary

3–6 bullet highlights with key numbers. Best for stakeholder updates and quick insights.

[your question with intent and scope] Give a summary of findings.

Spend increased 12% MoM; top driver is EC2 in us-east-1 (+$18k).

Bullet List

Concise points or steps. Best for action items and next steps.

[your question with intent and scope] List the top 5 drivers.

- EC2 +$18k
- S3 +$6k
...

Markdown Table

Tabular view with columns. Best for grouped spend/usage data.

[your question with intent and scope] Show a table grouped by service and region.

| Service | Region | Cost (USD) |
|---------|--------|------------|
| EC2 | us-east-1 | $125,450.23 |
| EC2 | us-west-2 | $89,234.56 |
| S3 | us-east-1 | $67,891.12 |
| S3 | us-west-2 | $45,678.90 |
| RDS | us-east-1 | $34,567.89 |

CSV Snippet

Comma-separated rows. Best for spreadsheet import.

[your question with intent and scope] Provide CSV for the top 10 services.

Service,TotalCostUSD
ClickHouse Cloud,18432.55
AmazonEC2,5219.63
AmazonS3,3077.81
AmazonRDS,1693.00
ComputeSavingsPlans,1345.40
AmazonECS,832.11
Amazon Elastic Block Storage (EBS),598.02
Tackle Cloud GTM Platform,414.25
AmazonCloudWatch,328.90
AmazonElastiCache,211.87

Comparison/Diff

Side-by-side or delta view. Best for before/after and period-over-period analysis.

[your question with intent and scope] Compare last month vs this month and highlight the deltas.

+12% total, EC2 +22%

Checklist

Markdown checkboxes. Best for runbooks and to-dos.

[your question with intent and scope] Output a checklist of fixes.

- [ ] Tag coverage to 95%
- [ ] Review root user access and remove if unused
- [ ] Enable cost anomaly alerts for all AWS accounts
- [ ] Archive old unused reports to reduce clutter

Annotated Findings

Highlights with brief rationale. Best for root cause storytelling.

[your question with intent and scope] Call out anomalies and likely causes.

EC2 spike tied to ASG scale-out on 11/12.

Queries/Code Blocks

VQL or CLI commands. Best for reproducibility.

[your question with intent and scope] Show the VQL you used.

(costs.provider = 'aws')

Putting It All Together

A great prompt usually combines all three building blocks in a single sentence: what you want, what data to use, and how to format the answer. You don’t need a special syntax; plain English works. A good prompt covers, in order:

Intent — what you want the agent to do (a question or an action).
Scope — the workspace, providers, services, accounts, regions, tags, time range, and groupings to apply.
Direction — how you want the answer formatted (summary, table, checklist, code block) and any notes or callouts.

Here’s a fully-formed prompt that uses all three:

In the Production workspace, show AWS EC2 and S3 spend for the last 30 days, grouped by service and account ID. Present the result as a table and identify the top 5 cost drivers.

How that maps to the building blocks:

Intent: “Show AWS EC2 and S3 spend” (a question).
Scope: “In the Production workspace”, “AWS EC2 and S3”, “for the last 30 days”, “grouped by service and account ID”.
Direction: “as a table”, “identify the top 5 cost drivers”.

Ready-to-Use Prompts

Copy and customize these prompts for common FinOps tasks. Each one follows the Intent, Scope, and Direction framework. Replace the values in brackets (such as [workspace] or [time period]) with your own.

Investigate cost spikes

Identify what caused unexpected cost increases.

What caused the cost spike in the [workspace] workspace [time period]?

Analyze trends

Track spending patterns and identify trends over time.

Show the [time period] trend for [service] spend in [workspace].

Track Budgets

Compare actual spending against Budgets and forecasts.

List all Budgets in the [workspace] workspace and compare against actuals.

Detect anomalies

Find unusual spending patterns that may indicate issues.

Find anomalies for the last [days] days in the [workspace] workspace.

Investigate cost anomalies

When you receive a Cost Anomaly Alert in Slack, click the Investigate Anomaly button to start an automated investigation. You can also ask the agent directly—in either Slack or the console. The agent investigates each anomaly, queries daily costs around the spike, identifies attributed resources, and presents correlations across anomalies.

Investigate the anomalies on my [report name] report.

AWS Cost Anomaly Investigation

Report: AWS Costs (filter: all AWS costs)
Detected: January 16, 2026 | 3 anomalies with a combined increase of ~$156.42

1. Amazon S3 — API Requests (+$72.18) — Largest Spike

| Field           | Value                                     |
|-----------------|-------------------------------------------|
| Category        | API Request                               |
| Occurred        | Jan 10, 2026                              |
| Amount          | $198.34                                   |
| Previous Day    | $157.20 (+26.2%)                          |
| 7-Day Average   | $126.16 (+57.2% above baseline)           |

Resource: my-data-lake-bucket-441298320517 (S3 bucket, us-west-2, account 441298320517)

Daily API Request Trend:

| Date   | S3 API Request Cost |
|--------|---------------------|
| Jan 7  | $124.30             |
| Jan 8  | $131.05             |
| Jan 9  | $157.20             |
| Jan 10 | $198.34 ⬆️ anomaly  |
| Jan 11 | $210.77             |
| Jan 12 | $187.63             |
| Jan 13 | $156.41             |

Analysis: The spike on Jan 10 was notable, but costs continued to climb through
Jan 11 ($210.77). This S3 bucket is used for data lake storage. The sustained
increase in API requests suggests either new ETL jobs querying the bucket,
increased data delivery frequency, or a change in access patterns.

2. Amazon GuardDuty (+$51.83)

| Field           | Value                                     |
|-----------------|-------------------------------------------|
| Category        | GuardDuty                                 |
| Occurred        | Jan 12, 2026                              |
| Amount          | $84.57                                    |
| Previous Day    | $33.19 (+154.8%)                          |
| 7-Day Average   | $32.74 (+158.3% above baseline)           |

Daily Trend:

| Date   | GuardDuty Cost |
|--------|----------------|
| Jan 7  | $31.42         |
| Jan 8  | $32.18         |
| Jan 9  | $33.70         |
| Jan 10 | $34.25         |
| Jan 11 | $33.19         |
| Jan 12 | $84.57 ⬆️ anomaly |
| Jan 13 | $7.82 (partial day)|

Analysis: GuardDuty costs more than doubled on Jan 12. This typically indicates
a surge in analyzed events — possibly increased VPC Flow Logs, DNS logs, or
CloudTrail events being scanned. This could correlate with the S3 API request
spike generating more CloudTrail events.

3. Amazon CloudWatch — API Requests (+$32.41)

| Field           | Value                                     |
|-----------------|-------------------------------------------|
| Category        | API Request                               |
| Occurred        | Jan 11, 2026                              |
| Amount          | $67.92                                    |
| Previous Day    | $38.14 (+78.1%)                           |
| 7-Day Average   | $35.51 (+91.3% above baseline)            |

Daily API Request Trend:

| Date   | CloudWatch API Cost |
|--------|---------------------|
| Jan 7  | $35.63              |
| Jan 8  | $34.29              |
| Jan 9  | $36.87              |
| Jan 10 | $38.14              |
| Jan 11 | $67.92 ⬆️ anomaly   |
| Jan 12 | $52.40              |
| Jan 13 | $48.71              |

Analysis: CloudWatch API costs jumped 78% on Jan 11 and remain elevated
(~$48-52/day vs. the ~$35 baseline). This suggests a new monitoring configuration
or increased GetMetricData calls.

Key Correlations & Recommendations

S3 + GuardDuty + CloudWatch may be linked: The surge in S3 API requests
generates more CloudTrail events, which GuardDuty analyzes and CloudWatch
monitors. Investigate what is driving the increased S3 API activity on the
data lake bucket — this could be the root cause of multiple anomalies.

Action items:
• Investigate S3 API surge — this is the largest and still-growing cost.
  Check CloudTrail for unusual access patterns on the data lake bucket.
• Review CloudWatch API usage — the elevated baseline suggests a permanent
  config change. Audit recent monitoring changes.

Console links:
• Cost Report: https://console.vantage.sh/go/rprt_abc123def456

Tag-based analysis

Group and filter costs using tags for allocation and showback.

Show cost grouped by tag:[key] for [time period] in [workspace].

Report analysis

Deep-dive into existing reports to understand cost changes.

In this report [report_token or link], what was my biggest change in cost from [period 1] to [period 2], and what resources contributed to this?

Understand Responses

Because the FinOps Agent relies on an LLM, responses are not always deterministic. The same prompt may return slightly different answers, and results depend heavily on the context you provide. Understanding how responses work helps you verify results and get the most out of the agent when answers look unexpected.

The FinOps Agent uses Vantage Query Language (VQL) to query your cost data. VQL is a SQL-like language for filtering cloud cost data across providers. When the agent answers a cost question, it generates VQL behind the scenes to fetch the data.

You can verify agent responses using the following methods:

Compare against Cost Reports. Use your existing Cost Reports as a source of truth. For example, if you ask about EC2 spend last month, compare the answer against your saved report for that timeframe.
Request the VQL query. Ask the agent to show you the VQL it used. Add “Show the VQL you used” to your prompt or ask in a follow-up message. Review the VQL to understand what data the agent accessed and confirm the filters and groupings align with your intent.
Cross-reference between surfaces. If you receive an unexpected answer in Slack, try the same prompt in the console (or vice versa). Conversations are independent, so you can use one as a sanity check for the other.

Limitations

Understanding the agent’s limitations helps you set appropriate expectations and get the most out of your interactions.

No automatic web browsing

The agent doesn’t browse the internet unless a tool explicitly provides that information. It can’t fetch live pricing from websites unless you provide it or a tool returns it.

Tooling and account access

The agent can only access what the Vantage MCP and Vantage Docs MCP tools return, plus anything you share directly in the conversation. All access is scoped to your RBAC permissions.

No system control

The agent can’t run commands, deploy code, or change infrastructure outside Vantage. It can suggest provider commands, but you must run them yourself. In the console it can propose changes—for example, opening a GitHub issue with the Terraform edits for a rightsizing recommendation—but it does not execute cost remediations itself; those run through the Slack approval workflow.

No console-based remediation actions

The console agent can describe and explain cost recommendations, and—if GitHub is connected—open a GitHub issue with the Terraform changes for a rightsizing recommendation. It cannot itself purchase Savings Plans or Reserved Instances or execute rightsizing changes; those remediations and approvals run through the Slack workflow today.

Misinterpretation

The agent may misinterpret ambiguous requests. Be specific—provide workspace, time range, and the exact resource or service whenever possible.

Context limits

The agent only sees the current chat context. It doesn’t carry context between Slack and the console, and it doesn’t remember previous Slack threads or console conversations unless they’re part of the current thread.

File support

The agent currently accepts text-based files, including CSVs. Image analysis and other file formats are not supported today; additional formats are planned.

No sensitive data inference

The agent doesn’t access personal data unless you provide it explicitly. It can’t read your emails, tickets, or external dashboards without you pasting content or granting access via tools.

Overview

Getting Started

FinOps Practice

At Scale

AI & Automation

FinOps AI Prompt Guide

What the Agent Can Do

Prompting Building Blocks

1. Intent

2. Scope

3. Direction

1. Intent

Ask the Agent Questions

Ask the Agent to Perform Actions

2. Scope

Specify a Workspace

Specify a Folder

Specify Time Windows

Reference Existing Reports

3. Direction

Putting It All Together

Ready-to-Use Prompts

Understand Responses

Limitations

​What the Agent Can Do

​Prompting Building Blocks

1. Intent

2. Scope

3. Direction

​1. Intent

​Ask the Agent Questions

​Ask the Agent to Perform Actions

​2. Scope

​Specify a Workspace

​Specify a Folder

​Specify Time Windows

​Reference Existing Reports

​3. Direction

​Putting It All Together

​Ready-to-Use Prompts

​Understand Responses

​Limitations

What the Agent Can Do

Prompting Building Blocks

1. Intent

Ask the Agent Questions

Ask the Agent to Perform Actions

2. Scope

Specify a Workspace

Specify a Folder

Specify Time Windows

Reference Existing Reports

3. Direction

Putting It All Together

Ready-to-Use Prompts

Understand Responses

Limitations