Using CrewAI and Amazon Bedrock to cut my AWS bill by 40% worked, but it's not a magic

Why Trusted Advisor and Compute Optimizer aren't enough

I'm skeptical of "all-in-one" dashboards because they usually miss the granular stuff. AWS Trusted Advisor's free tier only hits 7 checks, often ignoring gp2 to gp3 migration opportunities or specific orphaned snapshots. Compute Optimizer is too narrow, focusing on EC2 and Lambda while ignoring the "silent killers" like unattached Elastic IPs that burn $3.60/month each. I needed a system that didn't just show me a graph of spending but gave me a specific list of resource IDs to terminate.

The multi-agent architecture

I initially tried a single-prompt approach, but it was a disaster. The LLM started hallucinating resource IDs because it was trying to handle the API data and the analysis simultaneously. Splitting the logic into three distinct roles solved the hallucination problem.

• The Scanner: Uses boto3 to pull raw facts on EC2, EBS, EIPs, and S3. It does zero reasoning; it just fetches data.
• The Optimizer: Takes the raw list and flags the waste. It looks for volumes without attachments and compares current instance types against potential Reserved Instance savings.
• The Report Writer: Converts the technical findings into a markdown list sorted by dollar impact and risk level.

The pipeline is sequential. The Scanner hands off to the Optimizer, who then hands off to the Writer. I used Bedrock Nova Pro for the reasoning layer because it handles the structured data from the AWS APIs without drifting.

Implementation details and the custom tool

The core of this is a custom tool that wraps boto3. Without a strictly defined tool, the agents try to "guess" what's in your account.

from crewai import Agent, Task, Crew, Process
from crewai.tools import BaseTool
import boto3

class AWSScannerTool(BaseTool):
    name: str = "aws_resource_scanner"
    description: str = "Scans AWS account for idle resources and cost leaks."

    def _run(self, query: str):
        ec2 = boto3.client('ec2')
        # Logic to fetch unattached volumes and idle EIPs
        volumes = ec2.describe_volumes(Filters=[{'Name': 'status', 'Values': ['available']}])
        return volumes['Volumes']

# Configure the LLM via Bedrock
from crewai import LLM
bedrock_llm = LLM(model="bedrock/amazon.nova-pro-v1:0")

Where this broke and the "gotchas"

It isn't all smooth sailing. Here is what actually happened during the build:

• IAM Permission Hell: If you don't attach the correct IAM role to the EC2 instance running the crew, the Scanner agent will fail with ClientError: An error occurred (UnauthorizedOperation). You need a policy that allows describe calls across all relevant services.
• Token Overflow: If you have hundreds of resources, the raw JSON from boto3 will blow out your context window. I had to implement a filtering layer in the AWSScannerTool to only send "available" or "idle" resources to the Optimizer, rather than the entire inventory.
• Cost of Running: While it saves money, running these agents isn't free. Depending on the volume of resources scanned, the Bedrock tokens can add up if you cron this hourly. Weekly is the sweet spot.

Performance breakdown

• Setup time: About 4 hours to get the boto3 tools stable.
• Execution time: Roughly 60 seconds to scan and report.
• Actual Savings: $125/month found in a $300 bill (mostly by killing snapshots from 2023 and moving gp2 to gp3).

If you're using Terraform, Infracost is better. But for those of us who "clicked things in the console" and forgot about them, this agentic approach is the only way to find the ghosts in the machine.