Add eos-cost-analysis skill and custom agent

[rajatgoy]

Description

Adds a new eos-cost-analysis skill and a matching custom agent that discover AWS resources approaching or past End of Standard Support (EOS) and calculate the Extended Support (ES) cost impact across all associated accounts, producing an actionable cost report.

Skill (skills/eos-cost-analysis):

• 5-phase workflow: Scope → Discover → Classify → Calculate → Report
• Services: EKS, RDS/Aurora, Lambda, ElastiCache, OpenSearch
• RDS covers standalone instances + Aurora clusters; ElastiCache covers redis/valkey/memcached across node clusters, replication groups, and serverless caches
• Lambda deprecated-runtime detection verified at runtime (no hardcoded list); mandatory pagination across all discovery APIs
• Per-version EOS date verification from AWS documentation (no guessing, no date-bleed); OpenSearch vs Elasticsearch engine families verified independently
• Live pricing from the AWS Pricing API; RDS usagetype is region-prefix-free; region prefixes resolved via pricing:GetAttributeValues; OpenSearch NIH factors doc-verified
• Year 1/2 vs Year 3 tiered pricing (boundary at ≥ 24 months); Multi-AZ doubling for RDS
• Reactive (current) vs proactive (projected) cost split with a cost-cliff metric; CSV artifact output

Custom agent (custom-agents/eos-cost-analysis):

• System prompt for dedicated/scheduled runs; cross-account; persisted CSV artifacts for week-over-week tracking

Infrastructure (cloudformation/devops-agent-skill-policies.yaml):

• Adds an EnableEosCostAnalysis toggle granting read-only discovery across the five services plus pricing:GetProducts / pricing:GetAttributeValues / pricing:DescribeServices

Type of change

• New skill
• New custom agent
• Update to an existing skill or agent
• Documentation or infrastructure change

Testing

Validated end-to-end against two AWS accounts across multiple regions (us-east-1, eu-west-1, ap-south-1) using CloudFormation-provisioned test fixtures covering a mix of EOS, approaching-EOS, and supported versions:

• EKS clusters on a deprecated version (in Extended Support) and a current version (control)
• RDS: standalone MySQL + Aurora MySQL and Aurora PostgreSQL clusters (validated DescribeDBClusters path and Year 3 tiering)
• ElastiCache: node clusters, a valkey replication group, and serverless caches across redis/valkey/memcached (validated DescribeCacheClusters, DescribeReplicationGroups, and DescribeServerlessCaches)
• OpenSearch: both OpenSearch_* and Elasticsearch_* engine-family domains (validated independent EOS calendars)
• Lambda: deprecated runtimes flagged as security risk (no ES charge)

Reviewed the agent's reasoning trace to confirm all discovery APIs were invoked (including serverless/replication-group paths), pricing came live from the AWS Pricing API with cross-account fallback, and EOS dates were verified from AWS documentation. The CloudFormation policy template validates via aws cloudformation validate-template.

Note: This is sample code, not intended for production use without additional review and testing. Validate in a non-production environment first. All output is AI-generated and must be independently verified before acting on it.

License confirmation

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache License 2.0.