Labsco
aarora79 logo

AWS Cost Explorer & Bedrock Logs

★ 127

from aarora79

Retrieve AWS spend data from Cost Explorer and Amazon Bedrock usage data from CloudWatch logs.

🔥🔥🔥🔥✓ VerifiedPaid serviceNeeds API keys
#payments#cloud#devops#git#maps#security#news

AWS Cost Explorer and Amazon Bedrock Model Invocation Logs MCP Server & Client

An MCP server for getting AWS spend data via Cost Explorer and Amazon Bedrock usage data via Model invocation logs in Amazon Cloud Watch through Anthropic's MCP (Model Control Protocol). See section on "secure" remote MCP server to see how you can run your MCP server over HTTPS.

Copy & paste — that's it
flowchart LR
    User([User]) --> UserApp[User Application]
    UserApp --> |Queries| Host[Host]
    
    subgraph "Claude Desktop"
        Host --> MCPClient[MCP Client]
    end
    
    MCPClient --> |MCP Protocol over HTTPS| MCPServer[AWS Cost Explorer MCP Server]
    
    subgraph "AWS Services"
        MCPServer --> |API Calls| CostExplorer[(AWS Cost Explorer)]
        MCPServer --> |API Calls| CloudWatchLogs[(AWS CloudWatch Logs)]
    end

You can run the MCP server locally and access it via the Claude Desktop or you could also run a Remote MCP server on Amazon EC2 and access it via a MCP client built into a LangGraph Agent.

🚨You can also use this MCP server to get AWS spend information from other accounts as long as the IAM role used by the MCP server can assume roles in those other accounts🚨

Demo video

AWS Cost Explorer MCP Server Deep Dive

Overview

This tool provides a convenient way to analyze and visualize AWS cloud spending data using Anthropic's Claude model as an interactive interface. It functions as an MCP server that exposes AWS Cost Explorer API functionality to Claude Desktop, allowing you to ask questions about your AWS spend in natural language.

Features

  • Amazon EC2 Spend Analysis: View detailed breakdowns of EC2 spending for the last day
  • Amazon Bedrock Spend Analysis: View breakdown by region, users and models over the last 30 days
  • Service Spend Reports: Analyze spending across all AWS services for the last 30 days
  • Detailed Cost Breakdown: Get granular cost data by day, region, service, and instance type
  • Interactive Interface: Use Claude to query your cost data through natural language

Docker Support

A Dockerfile is included for containerized deployment:

Copy & paste — that's it
docker build -t aws-cost-explorer-mcp .
docker run -v ~/.aws:/root/.aws aws-cost-explorer-mcp

Development

Project Structure

  • server.py: Main server implementation with MCP tools
  • pyproject.toml: Project dependencies and metadata
  • Dockerfile: Container definition for deployments

Adding New Cost Analysis Tools

To extend the functionality:

  1. Add new functions to server.py
  2. Annotate them with @mcp.tool()
  3. Implement the AWS Cost Explorer API calls
  4. Format the results for easy readability

Secure "remote" MCP server

We can use nginx as a reverse-proxy so that it can provide an HTTPS endpoint for connecting to the MCP server. Remote MCP clients can connect to nginx over HTTPS and then it can proxy traffic internally to http://localhost:8000. The following steps describe how to do this.

  1. Enable access to TCP port 443 from the IP address of your MCP client (your laptop, or anywhere) in the inbound rules in the security group associated with your EC2 instance.

  2. You would need to have an HTTPS certificate and private key to proceed. Let's say you use your-mcp-server-domain-name.com as the domain for your MCP server then you will need an SSL cert for your-mcp-server-domain-name.com and it will be accessible to MCP clients as https://your-mcp-server-domain-name.com/sse. While you can use a self-signed cert but it would require disabling SSL verification on the MCP client, we DO NOT recommend you do that. If you are hosting your MCP server on EC2 then you could generate an SSL cert using no-ip or Let' Encrypt or other similar services. Place the SSL cert and private key files in /etc/ssl/certs and /etc/ssl/privatekey folders respectively on your EC2 machine.

  3. Install nginx on your EC2 machine using the following commands.

    Copy & paste — that's it
    sudo apt-get install nginx
sudo nginx -t
sudo systemctl reload nginx

  4. Get the hostname for your EC2 instance, this would be needed for configuring the nginx reverse proxy.

    Copy & paste — that's it
    TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && curl -H "X-aws-ec2-metadata-token: $TOKEN" -s http://169.254.169.254/latest/meta-data/public-hostname

  5. Copy the following content into a new file /etc/nginx/conf.d/ec2.conf. Replace YOUR_EC2_HOSTNAME, /etc/ssl/certs/cert.pem and /etc/ssl/privatekey/privkey.pem with values appropriate for your setup.

    Copy & paste — that's it
    server {
 listen 80;
 server_name YOUR_EC2_HOSTNAME;

 # Optional: Redirect HTTP to HTTPS
 return 301 https://$host$request_uri;
 }

 server {
     listen 443 ssl;
     server_name YOUR_EC2_HOSTNAME;

     # Self-signed certificate paths
     ssl_certificate     /etc/ssl/certs/cert.pem;
     ssl_certificate_key /etc/ssl/privatekey/privkey.pem; 

     # Optional: Good practice
     ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         HIGH:!aNULL:!MD5;

     location / {
         # Reverse proxy to your local app (e.g., port 8000)
         proxy_pass http://127.0.0.1:8000;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
 }

  6. Restart nginx.

    Copy & paste — that's it
    sudo systemctl start nginx

  7. Start your MCP server as usual as described in the remote setup section.

  8. Your MCP server is now accessible over HTTPS as https://your-mcp-server-domain-name.com/sse to your MCP client.

  9. On the client side now (say on your laptop or in your Agent) configure your MCP client to communicate to your MCP server as follows.

    Copy & paste — that's it
    MCP_SERVER_HOSTNAME=YOUR_MCP_SERVER_DOMAIN_NAME
AWS_ACCOUNT_ID=AWS_ACCOUNT_ID_TO_GET_INFO_ABOUT # if set to empty or if the --aws-account-id switch is not specified then it gets the info about the AWS account MCP server is running in
python mcp_sse_client.py --host $MCP_SERVER_HOSTNAME --port 443 --aws-account-id $AWS_ACCOUNT_ID

    Similarly you could run the chainlit app to talk to remote MCP server over HTTPS.

    Copy & paste — that's it
    export MCP_SERVER_URL=YOUR_MCP_SERVER_DOMAIN_NAME
export MCP_SERVER_PORT=443
chainlit run app.py --port 8080

    Similarly you could run the LangGraph Agent to talk to remote MCP server over HTTPS.

    Copy & paste — that's it
    python langgraph_agent_mcp_sse_client.py --host $MCP_SERVER_HOSTNAME --port 443 --aws-account-id $AWS_ACCOUNT_ID

License

MIT License

Acknowledgments

  • This tool uses Anthropic's MCP framework
  • Powered by AWS Cost Explorer API
  • Built with FastMCP for server implementation
  • README was generated by providing a text dump of the repo via GitIngest to Claude