finops: cloud billing via agent package, cost_daily facts, AWS billing daily collector + analysis playbook - #34

Open

geisbruch wants to merge 77 commits into

mainfrom

Commits on Sep 10, 2026

finops: cloud billing via agent package (cloud-query), cost_daily facts, AWS billing daily collector

geisbruch
and
claude
committed
541becb
finops(cloud-query): release script — ECR Public login, multi-arch buildx push, digest in release.json

geisbruch
and
claude
committed
0419511
finops(cloud-query): release 0.0.1 → public.ecr.aws/nullplatform/agent-plugins/workflows/aws-cost-explorer (+ :latest); --latest flag

geisbruch
and
claude
committed
7393d80
finops(tool-cloud-query): run the released image by immutable reference (no platform package registration); agent run without pin via NP_ALLOWED_REGISTRIES

geisbruch
and
claude
committed
4891ccd
finops: per-customer role — AssumeRole ARN + ExternalId through wf1 and the tool; playbook §4b (pod identity via agent patch, cross-account trust, read-only policy)

geisbruch
and
claude
committed
ab43ec8
finops: multi-account dispatcher (wf0) — per-target agent tags, package version (pin → service account), AssumeRole, expected_account guard; docs

geisbruch
and
claude
committed
a4619bf
finops(wf0): spread each target into the collector inputs (forEach spreadItem)

geisbruch
and
claude
committed
b652a0b
finops(docs): IAM policies and trust policies for the cloud-query worker (single and multi-account)

geisbruch
and
claude
committed
114c697
finops(docs/iam): scope Pod Identity trust to the cluster, AssumeRole to listed accounts + ExternalId, Athena/Glue to workgroup and CUR tables

geisbruch
and
claude
committed
b31fcbf

Commits on Sep 11, 2026