Do I need to give Fortem access to my AWS account?

No. Skill runs on your machine with your local credentials. Nothing sent to Fortem.

What if I don't use Claude Code?

Works with any CLI agent — Codex, Gemini CLI, OpenCode, any agent that runs bash. Also has test mode (FORTEM_TEST_MODE=1) — generates example output without AWS access.

What does "read-only" mean exactly?

6 ecs:List* and ecs:Describe* permissions only. No Create/Update/Delete/Put of any kind. Cannot modify infrastructure. Policy is visible in the skill file — review before applying.

What happens after I get the report?

Nothing, unless you want something. If savings are meaningful, the report ends with a booking link. 20-min call, no pitch — we check if numbers hold and if Fortem fits. If it doesn't, we'll say so in the first 5 minutes.

How long does the scan take?

5–15 minutes depending on cluster count and regions. Agent asks 5 questions upfront, then runs AWS CLI commands. You watch it work.

1 prompt · read-only · 0 bytes uploaded

Your full ECS fleet cost,
mapped by an AI agent
in 15 minutes

Copy one line into your CLI agent. It reads the skill, runs read-only ECS calls, and writes a per-environment cost breakdown to your disk. Nothing is transmitted — no login, no AWS credentials for us.

Read https://fortem.dev/audit.md then run a read-only Fleet Audit of my ECS Fargate fleet.

+ any CLI agent

Want a dry run first? Add FORTEM_TEST_MODE=1 — example data, zero AWS calls.

Read the skill source ↗No CLI agent? Book a 20-min call →

Exactly what you'll get

A complete cost breakdown with your real environment names, modeled per-environment costs, and a clear path to savings — before you talk to anyone. Three files land on your machine, nothing is uploaded.

Example output — your numbers will differ

fortem-discovery-report.html — saved locally

Your Fortem Fleet Report

Generated just now · us-east-1 · acme-corp

Environments

Monthly cost

$4,200

With scheduling

$1,360

Savings

−$2,840/mo

Environment breakdown

Environment	Stage	Svcs	Cost/mo
use1-prod-main	prod	12	$2,400
use1-dev-qa1	dev	8	$520
usw2-staging-main	stag	10	$890
usw2-dev-ml1	dev	4	$220
euw2-dev-demo	dev	6	$170

Modeled savings: ~$2,840/month.
Fortem costs $790/mo — break even in ~1 week.
Projected net savings: ~$25k/year.

Book a call →

fortem-discovery-report.html

HTML cost report. Open in browser. Real env names, modeled per-env costs, ROI callout.

fortem-discovery.yaml

Your fleet in Fortem config format. Bring to a call — no re-discovery needed.

diy-scheduler.yaml

Working CloudFormation scheduler. Understand what DIY looks like — and what it misses.

Why your ECS bill is bigger than it should be

The invisible waste. Dev/staging run 24/7 — nights, weekends, holidays — at full Fargate on-demand. For 10 dev envs that's ~$800–2,400/mo you could turn off tonight.

The overhead nobody counts. Compute is often only ~60% of an env's real cost. ALB, NAT Gateway, CloudWatch, ECR add $60–100/env/mo that Cost Explorer can't attribute cleanly.

The DIY trap. You could write an EventBridge + Lambda scheduler. It works for 3 months — then a tag convention changes, a cron fires in the wrong timezone, and you're on-call for your cost-saving script.

Your data never leaves your machine

The skill uses 6 read-only ECS calls, plus two auxiliary read-only lookups (sts:GetCallerIdentity and ec2:DescribeRegions). An optional Cost Explorer cross-check (ce:GetCostAndUsage, ~$0.01/call) runs only if your credentials already allow it. No credentials, no account IDs, no environment variable values are transmitted anywhere. The HTML report is a local file. We don't see your AWS data.

ecs:ListClusters
ecs:DescribeClusters
ecs:ListServices
ecs:DescribeServices
ecs:DescribeTaskDefinition
ecs:ListTagsForResource
ec2:DescribeRegions
sts:GetCallerIdentity

No Create / Update / Delete / Put permissions. Read-only.

The worst this can do

Read your ECS metadata via the read-only calls above (plus sts:GetCallerIdentity and ec2:DescribeRegions). It will never write, delete, or transmit. It reads environment variable names, never their values. If any step asks for more than that — stop.

The prompt points your agent at a live file. Read exactly what it will run before you paste it: view the skill source (or fetch fortem.dev/audit.md yourself). If you want to pin a known version, save the file and run that copy instead of the live URL.

Verify the file you fetch matches what we published:

curl -s https://fortem.dev/audit.md | shasum -a 256

expected: 9ac158c6cd83f56174df9a5d03c5d74095ce34956ee4674ff77d79c1539ef5d1

How to run it

1
Copy the prompt
Hit the Copy Prompt button above. That one line points your agent at the skill — no file to download, no setup.
2
Paste it into your agent
Open Claude Code, Codex, Cursor, Gemini CLI — any CLI agent — and paste. It fetches fortem.dev/audit.md and starts the read-only audit on its own.
3
Answer 5 questions
The agent asks 5 questions about your AWS setup, runs the read-only ECS API calls, and writes 3 files to your disk: the cost report, a Fortem config, and a DIY scheduler. No AWS access configured? It runs on example data instead, so you still get the full report.

Prefer to read it first? View the full skill source, or download it and install as a reusable Claude Code skill at .claude/skills/fortem-fleet-audit/SKILL.md — then invoke it any time with /fortem-fleet-audit.

Common questions

Your fleet. Your numbers. In 15 minutes.

Copy the prompt. Paste it into your agent. Read-only, nothing transmitted — a full cost breakdown before you talk to anyone.

Read https://fortem.dev/audit.md then run a read-only Fleet Audit of my ECS Fargate fleet.

+ any CLI agent

Want a dry run first? Add FORTEM_TEST_MODE=1 — example data, zero AWS calls.

Read-only AWS access. Nothing leaves your machine. Or download the .md

Rather have us run it with you? Book a 20-min call →

Your full ECS fleet cost, mapped by an AI agent in 15 minutes