feat: crud-pricing initial implementation

Complete CRUD service for AWS pricing operations - single source of truth.

Features:
- Dual pricing model (retail + account-specific with auto EDP/PPA detection)
- Get/Put pricing operations with intelligent caching
- AWS Pricing API integration for public list prices
- AWS Cost Explorer integration for account-specific pricing
- Access counting for self-learning 14-day refresh
- Query most-accessed instances (powers smart refresh)
- TTL: 30 days (retail), 7 days (account-specific)

Architecture:
- All other lambdas use this for pricing operations
- No direct DynamoDB access from other components
- Consistent schema enforcement
- Complete IAM setup for Pricing API, Cost Explorer, STS

Infrastructure:
- Complete Terraform configuration
- Full CI/CD pipeline (Jenkinsfile)
- Comprehensive documentation
- Production-ready scaffolding

Part of Phase 1 - foundation for pricing system.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/aws_pricing.rs

@@ -0,0 +1,383 @@
+use aws_sdk_pricing::types::Filter;
+use aws_sdk_pricing::Client as PricingClient;
+use chrono::Utc;
+use serde_json::Value;
+use std::collections::HashMap;
+use tracing::{error, info, warn};
+
+use crate::models::{
+    Ec2Pricing, OnDemandPricing, PricingData, PricingType, ReservedOption, ReservedPricing,
+    ReservedTerm,
+};
+
+/// Fetch EC2 instance pricing from AWS Pricing API
+pub async fn fetch_ec2_pricing(
+    client: &PricingClient,
+    instance_type: &str,
+    region: &str,
+) -> Result<PricingData, String> {
+    info!("Fetching pricing from AWS Pricing API for {} in {}", instance_type, region);
+
+    let location_name = region_to_location_name(region);
+
+    let response = client
+        .get_products()
+        .service_code("AmazonEC2")
+        .filters(
+            Filter::builder()
+                .field("instanceType")
+                .value(instance_type)
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .filters(
+            Filter::builder()
+                .field("location")
+                .value(location_name)
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .filters(
+            Filter::builder()
+                .field("operatingSystem")
+                .value("Linux")
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .filters(
+            Filter::builder()
+                .field("tenancy")
+                .value("Shared")
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .filters(
+            Filter::builder()
+                .field("capacitystatus")
+                .value("Used")
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .filters(
+            Filter::builder()
+                .field("preInstalledSw")
+                .value("NA")
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .send()
+        .await
+        .map_err(|e| format!("AWS Pricing API call failed: {}", e))?;
+
+    let price_list = response.price_list();
+
+    if price_list.is_empty() {
+        return Err(format!("No pricing found for {} in {}", instance_type, region));
+    }
+
+    info!("Parsing {} pricing items", price_list.len());
+
+    // Parse the first (and usually only) price item
+    let pricing = parse_pricing_response(price_list[0].as_str(), instance_type, region)?;
+
+    Ok(pricing)
+}
+
+/// Parse AWS Pricing API response
+fn parse_pricing_response(
+    price_json: &str,
+    instance_type: &str,
+    region: &str,
+) -> Result<PricingData, String> {
+    let item: Value = serde_json::from_str(price_json)
+        .map_err(|e| format!("Failed to parse pricing JSON: {}", e))?;
+
+    // Extract instance attributes
+    let attributes = item["product"]["attributes"]
+        .as_object()
+        .ok_or("Missing product attributes")?;
+
+    let vcpus: i32 = attributes
+        .get("vcpu")
+        .and_then(|v| v.as_str())
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(0);
+
+    let memory_str = attributes
+        .get("memory")
+        .and_then(|v| v.as_str())
+        .unwrap_or("0 GiB");
+    let memory_gb: f64 = memory_str
+        .replace(" GiB", "")
+        .replace(",", "")
+        .parse()
+        .unwrap_or(0.0);
+
+    let instance_family = attributes
+        .get("instanceFamily")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+
+    let processor_architecture = attributes
+        .get("processorArchitecture")
+        .and_then(|v| v.as_str())
+        .unwrap_or("x86_64");
+
+    let architectures = vec![processor_architecture.to_string()];
+
+    // Parse OnDemand pricing
+    let on_demand = parse_on_demand_pricing(&item)?;
+
+    // Parse Reserved pricing (optional)
+    let reserved = parse_reserved_pricing(&item).ok();
+
+    // Spot pricing not available in Pricing API (would need EC2 Spot Price API)
+    let spot = None;
+
+    let ec2_pricing = Ec2Pricing {
+        instance_family,
+        vcpus,
+        memory_gb,
+        architectures,
+        on_demand,
+        reserved,
+        spot,
+    };
+
+    let pricing_data = PricingData {
+        instance_type: instance_type.to_string(),
+        region: region.to_string(),
+        pricing_type: PricingType::Retail,
+        aws_account_id: None,
+        ec2_pricing,
+        source: "aws-pricing-api".to_string(),
+        last_updated: Utc::now().to_rfc3339(),
+        access_count: 0,
+        last_accessed: None,
+        first_cached: Some(Utc::now().to_rfc3339()),
+    };
+
+    Ok(pricing_data)
+}
+
+/// Parse OnDemand pricing from terms
+fn parse_on_demand_pricing(item: &Value) -> Result<OnDemandPricing, String> {
+    let on_demand_terms = item["terms"]["OnDemand"]
+        .as_object()
+        .ok_or("Missing OnDemand terms")?;
+
+    // Get first (and usually only) term
+    let term = on_demand_terms
+        .values()
+        .next()
+        .ok_or("No OnDemand term found")?;
+
+    let price_dimensions = term["priceDimensions"]
+        .as_object()
+        .ok_or("Missing priceDimensions")?;
+
+    let price_dim = price_dimensions
+        .values()
+        .next()
+        .ok_or("No price dimension found")?;
+
+    let hourly_str = price_dim["pricePerUnit"]["USD"]
+        .as_str()
+        .ok_or("Missing USD price")?;
+
+    let hourly: f64 = hourly_str
+        .parse()
+        .map_err(|e| format!("Failed to parse hourly price: {}", e))?;
+
+    let monthly = hourly * 730.0; // Hours per month
+
+    Ok(OnDemandPricing { hourly, monthly })
+}
+
+/// Parse Reserved pricing from terms
+fn parse_reserved_pricing(item: &Value) -> Result<ReservedPricing, String> {
+    let reserved_terms = item["terms"]["Reserved"]
+        .as_object()
+        .ok_or("Missing Reserved terms")?;
+
+    let mut standard: HashMap<String, ReservedTerm> = HashMap::new();
+    let mut convertible: HashMap<String, ReservedTerm> = HashMap::new();
+
+    for (_, term) in reserved_terms {
+        let term_attributes = term["termAttributes"]
+            .as_object()
+            .ok_or("Missing termAttributes")?;
+
+        let lease_contract_length = term_attributes
+            .get("LeaseContractLength")
+            .and_then(|v| v.as_str())
+            .unwrap_or("");
+
+        let purchase_option = term_attributes
+            .get("PurchaseOption")
+            .and_then(|v| v.as_str())
+            .unwrap_or("");
+
+        let offering_class = term_attributes
+            .get("OfferingClass")
+            .and_then(|v| v.as_str())
+            .unwrap_or("standard");
+
+        // Parse the pricing
+        if let Ok(pricing) = parse_reserved_option(term) {
+            let term_key = if lease_contract_length.contains("1yr") || lease_contract_length.contains("1 year") {
+                "1yr"
+            } else if lease_contract_length.contains("3yr") || lease_contract_length.contains("3 year") {
+                "3yr"
+            } else {
+                continue; // Skip unknown terms
+            };
+
+            let option_type = if purchase_option.contains("All Upfront") {
+                "all_upfront"
+            } else if purchase_option.contains("Partial Upfront") {
+                "partial_upfront"
+            } else if purchase_option.contains("No Upfront") {
+                "no_upfront"
+            } else {
+                continue; // Skip unknown options
+            };
+
+            // Add to appropriate collection
+            let collection = if offering_class.contains("convertible") {
+                &mut convertible
+            } else {
+                &mut standard
+            };
+
+            let term_entry = collection
+                .entry(term_key.to_string())
+                .or_insert_with(|| ReservedTerm {
+                    all_upfront: ReservedOption::default(),
+                    partial_upfront: ReservedOption::default(),
+                    no_upfront: ReservedOption::default(),
+                });
+
+            match option_type {
+                "all_upfront" => term_entry.all_upfront = pricing,
+                "partial_upfront" => term_entry.partial_upfront = pricing,
+                "no_upfront" => term_entry.no_upfront = pricing,
+                _ => {}
+            }
+        }
+    }
+
+    if standard.is_empty() && convertible.is_empty() {
+        return Err("No valid reserved pricing found".to_string());
+    }
+
+    Ok(ReservedPricing {
+        standard,
+        convertible,
+    })
+}
+
+/// Parse a single reserved pricing option
+fn parse_reserved_option(term: &Value) -> Result<ReservedOption, String> {
+    let price_dimensions = term["priceDimensions"]
+        .as_object()
+        .ok_or("Missing priceDimensions")?;
+
+    let mut total_upfront = 0.0;
+    let mut hourly_rate = 0.0;
+
+    for (_, price_dim) in price_dimensions {
+        let unit = price_dim["unit"]
+            .as_str()
+            .unwrap_or("");
+
+        let price_str = price_dim["pricePerUnit"]["USD"]
+            .as_str()
+            .unwrap_or("0");
+
+        let price: f64 = price_str.parse().unwrap_or(0.0);
+
+        if unit == "Quantity" {
+            total_upfront = price;
+        } else if unit == "Hrs" {
+            hourly_rate = price;
+        }
+    }
+
+    let effective_hourly = if total_upfront > 0.0 {
+        // Calculate effective hourly from upfront
+        let term_attributes = term["termAttributes"]
+            .as_object()
+            .ok_or("Missing termAttributes")?;
+
+        let lease_length = term_attributes
+            .get("LeaseContractLength")
+            .and_then(|v| v.as_str())
+            .unwrap_or("");
+
+        let hours = if lease_length.contains("1yr") || lease_length.contains("1 year") {
+            8760.0  // Hours in 1 year
+        } else if lease_length.contains("3yr") || lease_length.contains("3 year") {
+            26280.0  // Hours in 3 years
+        } else {
+            8760.0  // Default to 1 year
+        };
+
+        (total_upfront / hours) + hourly_rate
+    } else {
+        hourly_rate
+    };
+
+    let effective_monthly = effective_hourly * 730.0;
+    let monthly_payment = hourly_rate * 730.0;
+
+    Ok(ReservedOption {
+        effective_hourly,
+        effective_monthly,
+        total_upfront,
+        monthly_payment,
+    })
+}
+
+impl Default for ReservedOption {
+    fn default() -> Self {
+        Self {
+            effective_hourly: 0.0,
+            effective_monthly: 0.0,
+            total_upfront: 0.0,
+            monthly_payment: 0.0,
+        }
+    }
+}
+
+/// Convert AWS region code to location name used by Pricing API
+pub fn region_to_location_name(region: &str) -> &str {
+    match region {
+        "us-east-1" => "US East (N. Virginia)",
+        "us-east-2" => "US East (Ohio)",
+        "us-west-1" => "US West (N. California)",
+        "us-west-2" => "US West (Oregon)",
+        "eu-west-1" => "EU (Ireland)",
+        "eu-west-2" => "EU (London)",
+        "eu-west-3" => "EU (Paris)",
+        "eu-central-1" => "EU (Frankfurt)",
+        "ap-southeast-1" => "Asia Pacific (Singapore)",
+        "ap-southeast-2" => "Asia Pacific (Sydney)",
+        "ap-northeast-1" => "Asia Pacific (Tokyo)",
+        "ap-northeast-2" => "Asia Pacific (Seoul)",
+        "ap-south-1" => "Asia Pacific (Mumbai)",
+        "sa-east-1" => "South America (Sao Paulo)",
+        "ca-central-1" => "Canada (Central)",
+        _ => {
+            warn!("Unknown region: {}, using as-is", region);
+            region
+        }
+    }
+}

src/cost_explorer.rs

@@ -0,0 +1,265 @@
+use aws_config::Region;
+use aws_sdk_costexplorer::types::{
+    DateInterval, Dimension, DimensionValues, Expression, Granularity, Metric,
+};
+use aws_sdk_costexplorer::Client as CostExplorerClient;
+use aws_sdk_sts::Client as StsClient;
+use chrono::{Duration, Utc};
+use tracing::{error, info, warn};
+
+use crate::models::{Ec2Pricing, OnDemandPricing, PricingData, PricingType};
+
+/// Fetch account-specific pricing from Cost Explorer
+/// This automatically includes EDP/PPA discounts!
+pub async fn fetch_account_specific_pricing(
+    sts_client: &StsClient,
+    instance_type: &str,
+    region: &str,
+    aws_account_id: &str,
+    role_arn: &str,
+) -> Result<PricingData, String> {
+    info!(
+        "Fetching account-specific pricing for {} in {} (account: {})",
+        instance_type, region, aws_account_id
+    );
+
+    // 1. Assume role into customer account
+    let credentials = sts_client
+        .assume_role()
+        .role_arn(role_arn)
+        .role_session_name("pathfinder-pricing-query")
+        .duration_seconds(900) // 15 minutes
+        .send()
+        .await
+        .map_err(|e| format!("Failed to assume role: {}", e))?;
+
+    let creds = credentials
+        .credentials()
+        .ok_or("No credentials returned from assume role")?;
+
+    info!("✅ Successfully assumed role into account {}", aws_account_id);
+
+    // 2. Create Cost Explorer client with assumed credentials
+    let config = aws_config::from_env()
+        .credentials_provider(aws_sdk_sts::config::Credentials::new(
+            creds.access_key_id(),
+            creds.secret_access_key(),
+            Some(creds.session_token().to_string()),
+            None,
+            "assumed-role",
+        ))
+        .region(Region::new(region.to_string()))
+        .load()
+        .await;
+
+    let ce_client = CostExplorerClient::new(&config);
+
+    // 3. Query Cost Explorer for historical usage and costs
+    let end_date = Utc::now();
+    let start_date = end_date - Duration::days(30);
+
+    info!(
+        "Querying Cost Explorer from {} to {}",
+        start_date.format("%Y-%m-%d"),
+        end_date.format("%Y-%m-%d")
+    );
+
+    let response = ce_client
+        .get_cost_and_usage()
+        .time_period(
+            DateInterval::builder()
+                .start(start_date.format("%Y-%m-%d").to_string())
+                .end(end_date.format("%Y-%m-%d").to_string())
+                .build()
+                .map_err(|e| format!("Failed to build date interval: {}", e))?,
+        )
+        .granularity(Granularity::Daily)
+        .metrics(Metric::UnblendedCost)
+        .metrics(Metric::UsageQuantity)
+        .filter(
+            Expression::builder()
+                .dimensions(
+                    DimensionValues::builder()
+                        .key(Dimension::InstanceType)
+                        .values(instance_type)
+                        .build()
+                        .map_err(|e| format!("Failed to build dimension: {}", e))?,
+                )
+                .build(),
+        )
+        .send()
+        .await
+        .map_err(|e| format!("Cost Explorer API call failed: {}", e))?;
+
+    // 4. Calculate average hourly cost from actual usage
+    let results = response.results_by_time();
+
+    if results.is_empty() {
+        return Err(format!(
+            "No usage data found for {} in account {}. Instance may not be in use.",
+            instance_type, aws_account_id
+        ));
+    }
+
+    let (total_cost, total_hours) = results.iter().fold((0.0, 0.0), |(cost_acc, hours_acc), result| {
+        let cost: f64 = result
+            .total()
+            .and_then(|t| t.get("UnblendedCost"))
+            .and_then(|m| m.amount())
+            .and_then(|a| a.parse().ok())
+            .unwrap_or(0.0);
+
+        let usage_quantity: f64 = result
+            .total()
+            .and_then(|t| t.get("UsageQuantity"))
+            .and_then(|m| m.amount())
+            .and_then(|a| a.parse().ok())
+            .unwrap_or(0.0);
+
+        (cost_acc + cost, hours_acc + usage_quantity)
+    });
+
+    if total_hours == 0.0 {
+        return Err(format!(
+            "No usage hours found for {} (zero usage in past 30 days)",
+            instance_type
+        ));
+    }
+
+    let avg_hourly_cost = total_cost / total_hours;
+    let monthly_cost = avg_hourly_cost * 730.0;
+
+    info!(
+        "✅ Calculated account-specific pricing: ${:.4}/hr, ${:.2}/mo (from {} hours usage)",
+        avg_hourly_cost, monthly_cost, total_hours
+    );
+
+    // 5. Build pricing data
+    // Note: We don't have vcpu/memory from Cost Explorer, so we'd need to get that from Pricing API
+    // For now, we'll query Pricing API for instance specs and use Cost Explorer for pricing
+    let instance_specs = fetch_instance_specs(instance_type, region).await?;
+
+    let ec2_pricing = Ec2Pricing {
+        instance_family: instance_specs.instance_family,
+        vcpus: instance_specs.vcpus,
+        memory_gb: instance_specs.memory_gb,
+        architectures: instance_specs.architectures,
+        on_demand: OnDemandPricing {
+            hourly: avg_hourly_cost,
+            monthly: monthly_cost,
+        },
+        reserved: None, // Reserved pricing from Cost Explorer is complex, skip for now
+        spot: None,     // Spot pricing not in Cost Explorer
+    };
+
+    let pricing_data = PricingData {
+        instance_type: instance_type.to_string(),
+        region: region.to_string(),
+        pricing_type: PricingType::AccountSpecific,
+        aws_account_id: Some(aws_account_id.to_string()),
+        ec2_pricing,
+        source: "cost-explorer".to_string(),
+        last_updated: Utc::now().to_rfc3339(),
+        access_count: 0,
+        last_accessed: None,
+        first_cached: Some(Utc::now().to_rfc3339()),
+    };
+
+    Ok(pricing_data)
+}
+
+/// Simple struct for instance specs
+struct InstanceSpecs {
+    instance_family: String,
+    vcpus: i32,
+    memory_gb: f64,
+    architectures: Vec<String>,
+}
+
+/// Fetch instance specifications from Pricing API
+/// We need this because Cost Explorer only gives us costs, not specs
+async fn fetch_instance_specs(
+    instance_type: &str,
+    region: &str,
+) -> Result<InstanceSpecs, String> {
+    info!("Fetching instance specs for {}", instance_type);
+
+    // Create new pricing client from default config
+    let config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let pricing_client = aws_sdk_pricing::Client::new(&config);
+
+    let location_name = crate::aws_pricing::region_to_location_name(region);
+
+    let response = pricing_client
+        .get_products()
+        .service_code("AmazonEC2")
+        .filters(
+            aws_sdk_pricing::types::Filter::builder()
+                .field("instanceType")
+                .value(instance_type)
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .filters(
+            aws_sdk_pricing::types::Filter::builder()
+                .field("location")
+                .value(location_name)
+                .r#type("TERM_MATCH")
+                .build()
+                .map_err(|e| format!("Failed to build filter: {}", e))?,
+        )
+        .send()
+        .await
+        .map_err(|e| format!("Failed to fetch instance specs: {}", e))?;
+
+    let price_list = response.price_list();
+
+    if price_list.is_empty() {
+        return Err(format!("No instance specs found for {}", instance_type));
+    }
+
+    // Parse just the attributes we need
+    let item: serde_json::Value = serde_json::from_str(price_list[0].as_str())
+        .map_err(|e| format!("Failed to parse pricing JSON: {}", e))?;
+
+    let attributes = item["product"]["attributes"]
+        .as_object()
+        .ok_or("Missing product attributes")?;
+
+    let vcpus: i32 = attributes
+        .get("vcpu")
+        .and_then(|v| v.as_str())
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(0);
+
+    let memory_str = attributes
+        .get("memory")
+        .and_then(|v| v.as_str())
+        .unwrap_or("0 GiB");
+    let memory_gb: f64 = memory_str
+        .replace(" GiB", "")
+        .replace(",", "")
+        .parse()
+        .unwrap_or(0.0);
+
+    let instance_family = attributes
+        .get("instanceFamily")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+
+    let processor_architecture = attributes
+        .get("processorArchitecture")
+        .and_then(|v| v.as_str())
+        .unwrap_or("x86_64");
+
+    let architectures = vec![processor_architecture.to_string()];
+
+    Ok(InstanceSpecs {
+        instance_family,
+        vcpus,
+        memory_gb,
+        architectures,
+    })
+}

src/db.rs

@@ -0,0 +1,272 @@
+use aws_sdk_dynamodb::types::AttributeValue;
+use aws_sdk_dynamodb::Client as DynamoDbClient;
+use chrono::Utc;
+use std::collections::HashMap;
+use tracing::{error, info};
+
+use crate::models::{CommonInstance, PricingData, PricingType};
+
+const TTL_DAYS_RETAIL: i64 = 30;
+const TTL_DAYS_ACCOUNT_SPECIFIC: i64 = 7;
+
+/// Get pricing from DynamoDB cache
+pub async fn get_pricing(
+    client: &DynamoDbClient,
+    table_name: &str,
+    instance_type: &str,
+    region: &str,
+    pricing_type: &PricingType,
+    aws_account_id: Option<&str>,
+) -> Result<Option<PricingData>, String> {
+    let (pk, sk) = build_keys(instance_type, region, pricing_type, aws_account_id);
+
+    info!("Querying pricing: PK={}, SK={}", pk, sk);
+
+    let result = client
+        .get_item()
+        .table_name(table_name)
+        .key("PK", AttributeValue::S(pk))
+        .key("SK", AttributeValue::S(sk))
+        .send()
+        .await
+        .map_err(|e| format!("Failed to query DynamoDB: {}", e))?;
+
+    match result.item() {
+        Some(item) => {
+            let pricing = parse_pricing_item(item)?;
+
+            // Check if expired
+            if is_expired(&pricing) {
+                info!("Pricing data is expired");
+                Ok(None)
+            } else {
+                info!("Cache hit for {} in {}", instance_type, region);
+                Ok(Some(pricing))
+            }
+        }
+        None => {
+            info!("Cache miss for {} in {}", instance_type, region);
+            Ok(None)
+        }
+    }
+}
+
+/// Store pricing in DynamoDB cache
+pub async fn put_pricing(
+    client: &DynamoDbClient,
+    table_name: &str,
+    pricing_data: &PricingData,
+) -> Result<(), String> {
+    let (pk, sk) = build_keys(
+        &pricing_data.instance_type,
+        &pricing_data.region,
+        &pricing_data.pricing_type,
+        pricing_data.aws_account_id.as_deref(),
+    );
+
+    // Calculate expiration timestamp
+    let ttl_days = match pricing_data.pricing_type {
+        PricingType::Retail => TTL_DAYS_RETAIL,
+        PricingType::AccountSpecific => TTL_DAYS_ACCOUNT_SPECIFIC,
+    };
+
+    let expires_at = Utc::now().timestamp() + (ttl_days * 24 * 60 * 60);
+
+    info!("Storing pricing: PK={}, SK={}, TTL={} days", pk, sk, ttl_days);
+
+    let mut item = HashMap::new();
+    item.insert("PK".to_string(), AttributeValue::S(pk));
+    item.insert("SK".to_string(), AttributeValue::S(sk));
+    item.insert("GSI1PK".to_string(), AttributeValue::S("PRICING".to_string()));
+
+    // Store pricing data as JSON
+    let pricing_json = serde_json::to_string(pricing_data)
+        .map_err(|e| format!("Failed to serialize pricing data: {}", e))?;
+    item.insert("pricingData".to_string(), AttributeValue::S(pricing_json));
+
+    // Metadata fields
+    item.insert("instanceType".to_string(), AttributeValue::S(pricing_data.instance_type.clone()));
+    item.insert("region".to_string(), AttributeValue::S(pricing_data.region.clone()));
+    item.insert("pricingType".to_string(), AttributeValue::S(format!("{:?}", pricing_data.pricing_type)));
+    item.insert("lastUpdated".to_string(), AttributeValue::S(pricing_data.last_updated.clone()));
+    item.insert("expiresAt".to_string(), AttributeValue::N(expires_at.to_string()));
+
+    // Access tracking
+    item.insert("accessCount".to_string(), AttributeValue::N(pricing_data.access_count.to_string()));
+    if let Some(last_accessed) = &pricing_data.last_accessed {
+        item.insert("lastAccessed".to_string(), AttributeValue::S(last_accessed.clone()));
+    }
+    if let Some(first_cached) = &pricing_data.first_cached {
+        item.insert("firstCached".to_string(), AttributeValue::S(first_cached.clone()));
+    }
+
+    client
+        .put_item()
+        .table_name(table_name)
+        .set_item(Some(item))
+        .send()
+        .await
+        .map_err(|e| format!("Failed to put pricing: {}", e))?;
+
+    info!("✅ Pricing cached successfully");
+    Ok(())
+}
+
+/// Query most accessed instances (for refresh)
+pub async fn query_most_accessed(
+    client: &DynamoDbClient,
+    table_name: &str,
+    limit: usize,
+    min_access_count: Option<u32>,
+) -> Result<Vec<CommonInstance>, String> {
+    info!("Querying most accessed instances (limit={}, min_count={:?})", limit, min_access_count);
+
+    let mut query = client
+        .query()
+        .table_name(table_name)
+        .index_name("AccessCountIndex")
+        .key_condition_expression("GSI1PK = :pk")
+        .expression_attribute_values(":pk", AttributeValue::S("PRICING".to_string()))
+        .scan_index_forward(false) // Descending order (highest access count first)
+        .limit(limit as i32);
+
+    // Optional: filter by minimum access count
+    if let Some(min_count) = min_access_count {
+        query = query
+            .filter_expression("accessCount >= :min")
+            .expression_attribute_values(":min", AttributeValue::N(min_count.to_string()));
+    }
+
+    let result = query
+        .send()
+        .await
+        .map_err(|e| format!("Failed to query most accessed: {}", e))?;
+
+    let items = result.items().iter()
+        .filter_map(|item| parse_common_instance(item).ok())
+        .collect();
+
+    Ok(items)
+}
+
+/// Increment access count for an instance
+pub async fn increment_access_count(
+    client: &DynamoDbClient,
+    table_name: &str,
+    instance_type: &str,
+    region: &str,
+    pricing_type: &PricingType,
+    aws_account_id: Option<&str>,
+) -> Result<(), String> {
+    let (pk, sk) = build_keys(instance_type, region, pricing_type, aws_account_id);
+    let now = Utc::now().to_rfc3339();
+
+    // Increment access count and update last accessed
+    client
+        .update_item()
+        .table_name(table_name)
+        .key("PK", AttributeValue::S(pk))
+        .key("SK", AttributeValue::S(sk))
+        .update_expression("SET accessCount = if_not_exists(accessCount, :zero) + :inc, lastAccessed = :now")
+        .expression_attribute_values(":inc", AttributeValue::N("1".to_string()))
+        .expression_attribute_values(":zero", AttributeValue::N("0".to_string()))
+        .expression_attribute_values(":now", AttributeValue::S(now))
+        .send()
+        .await
+        .map_err(|e| format!("Failed to increment access count: {}", e))?;
+
+    Ok(())
+}
+
+/// Build DynamoDB keys
+fn build_keys(
+    instance_type: &str,
+    region: &str,
+    pricing_type: &PricingType,
+    aws_account_id: Option<&str>,
+) -> (String, String) {
+    let pk = format!("INSTANCE#{}", instance_type);
+
+    let sk = match (pricing_type, aws_account_id) {
+        (PricingType::Retail, _) => {
+            format!("REGION#{}#RETAIL", region)
+        }
+        (PricingType::AccountSpecific, Some(account_id)) => {
+            format!("REGION#{}#ACCOUNT#{}", region, account_id)
+        }
+        (PricingType::AccountSpecific, None) => {
+            // Fallback to retail if account ID missing
+            format!("REGION#{}#RETAIL", region)
+        }
+    };
+
+    (pk, sk)
+}
+
+/// Parse pricing data from DynamoDB item
+fn parse_pricing_item(item: &HashMap<String, AttributeValue>) -> Result<PricingData, String> {
+    let pricing_json = item
+        .get("pricingData")
+        .and_then(|v| v.as_s().ok())
+        .ok_or("Missing pricingData field")?;
+
+    let pricing: PricingData = serde_json::from_str(pricing_json)
+        .map_err(|e| format!("Failed to parse pricing data: {}", e))?;
+
+    Ok(pricing)
+}
+
+/// Parse common instance from DynamoDB item
+fn parse_common_instance(item: &HashMap<String, AttributeValue>) -> Result<CommonInstance, String> {
+    let instance_type = item
+        .get("instanceType")
+        .and_then(|v| v.as_s().ok())
+        .ok_or("Missing instanceType")?
+        .to_string();
+
+    let region = item
+        .get("region")
+        .and_then(|v| v.as_s().ok())
+        .ok_or("Missing region")?
+        .to_string();
+
+    let access_count = item
+        .get("accessCount")
+        .and_then(|v| v.as_n().ok())
+        .and_then(|n| n.parse().ok())
+        .unwrap_or(0);
+
+    let last_accessed = item
+        .get("lastAccessed")
+        .and_then(|v| v.as_s().ok())
+        .map(|s| s.to_string());
+
+    let last_updated = item
+        .get("lastUpdated")
+        .and_then(|v| v.as_s().ok())
+        .ok_or("Missing lastUpdated")?
+        .to_string();
+
+    Ok(CommonInstance {
+        instance_type,
+        region,
+        access_count,
+        last_accessed,
+        last_updated,
+    })
+}
+
+/// Check if pricing data is expired
+fn is_expired(pricing: &PricingData) -> bool {
+    let ttl_days = match pricing.pricing_type {
+        PricingType::Retail => TTL_DAYS_RETAIL,
+        PricingType::AccountSpecific => TTL_DAYS_ACCOUNT_SPECIFIC,
+    };
+
+    let expires_at = chrono::DateTime::parse_from_rfc3339(&pricing.last_updated)
+        .map(|dt| dt.timestamp() + (ttl_days * 24 * 60 * 60))
+        .unwrap_or(0);
+
+    let now = Utc::now().timestamp();
+    now > expires_at
+}

src/main.rs

@@ -0,0 +1,287 @@
+mod aws_pricing;
+mod cost_explorer;
+mod db;
+mod models;
+
+use aws_config::BehaviorVersion;
+use aws_sdk_dynamodb::Client as DynamoDbClient;
+use aws_sdk_pricing::Client as PricingClient;
+use aws_sdk_sts::Client as StsClient;
+use lambda_runtime::{service_fn, Error, LambdaEvent};
+use serde_json::Value;
+use std::env;
+use tracing::{error, info};
+
+use crate::models::{PricingOperation, PricingRequest, PricingResponse, PricingType};
+
+#[tokio::main]
+async fn main() -> Result<(), Error> {
+    tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::INFO)
+        .with_target(false)
+        .without_time()
+        .json()
+        .init();
+
+    lambda_runtime::run(service_fn(function_handler)).await
+}
+
+async fn function_handler(event: LambdaEvent<Value>) -> Result<Value, Error> {
+    let (payload, _context) = event.into_parts();
+
+    info!("Received pricing request: {:?}", payload);
+
+    // Parse request
+    let request: PricingRequest = match serde_json::from_value(payload) {
+        Ok(req) => req,
+        Err(e) => {
+            error!("Invalid request: {}", e);
+            let response = PricingResponse::error(400, &format!("Invalid request: {}", e));
+            return Ok(serde_json::to_value(response)?);
+        }
+    };
+
+    // Load AWS config and create clients
+    let config = aws_config::load_defaults(BehaviorVersion::latest()).await;
+    let dynamodb_client = DynamoDbClient::new(&config);
+    let pricing_client = PricingClient::new(&config);
+    let sts_client = StsClient::new(&config);
+
+    let table_name = env::var("TABLE_NAME").unwrap_or_else(|_| "pathfinder-dev-pricing".to_string());
+
+    // Route operation
+    let result = handle_operation(
+        request.operation,
+        &dynamodb_client,
+        &pricing_client,
+        &sts_client,
+        &table_name,
+    )
+    .await;
+
+    let response = match result {
+        Ok(data) => PricingResponse::success(data),
+        Err(e) => {
+            error!("Operation failed: {}", e);
+            PricingResponse::error(500, &e)
+        }
+    };
+
+    Ok(serde_json::to_value(response)?)
+}
+
+async fn handle_operation(
+    operation: PricingOperation,
+    dynamodb_client: &DynamoDbClient,
+    pricing_client: &PricingClient,
+    sts_client: &StsClient,
+    table_name: &str,
+) -> Result<Value, String> {
+    match operation {
+        PricingOperation::Get {
+            instance_type,
+            region,
+            pricing_type,
+            aws_account_id,
+            fetch_if_missing,
+        } => {
+            info!("Operation: Get (type={:?}, fetch_if_missing={})", pricing_type, fetch_if_missing);
+
+            // Check cache
+            let cached = db::get_pricing(
+                dynamodb_client,
+                table_name,
+                &instance_type,
+                &region,
+                &pricing_type,
+                aws_account_id.as_deref(),
+            )
+            .await?;
+
+            match cached {
+                Some(mut pricing) => {
+                    // Cache hit - increment access count asynchronously
+                    let client = dynamodb_client.clone();
+                    let table = table_name.to_string();
+                    let inst = instance_type.clone();
+                    let reg = region.clone();
+                    let pt = pricing_type.clone();
+                    let acc_id = aws_account_id.clone();
+
+                    tokio::spawn(async move {
+                        let _ = db::increment_access_count(
+                            &client,
+                            &table,
+                            &inst,
+                            &reg,
+                            &pt,
+                            acc_id.as_deref(),
+                        )
+                        .await;
+                    });
+
+                    pricing.access_count += 1; // Show incremented count in response
+                    Ok(serde_json::json!({
+                        "pricing": pricing,
+                        "cacheStatus": "hit"
+                    }))
+                }
+                None if fetch_if_missing => {
+                    // Cache miss - fetch from AWS
+                    info!("Cache miss, fetching from AWS API");
+
+                    let pricing = fetch_pricing(
+                        pricing_client,
+                        sts_client,
+                        &instance_type,
+                        &region,
+                        &pricing_type,
+                        aws_account_id.as_deref(),
+                    )
+                    .await?;
+
+                    // Cache it
+                    db::put_pricing(dynamodb_client, table_name, &pricing).await?;
+
+                    Ok(serde_json::json!({
+                        "pricing": pricing,
+                        "cacheStatus": "miss"
+                    }))
+                }
+                None => {
+                    Err("Pricing not found and fetch_if_missing=false".to_string())
+                }
+            }
+        }
+
+        PricingOperation::Put {
+            instance_type,
+            region,
+            pricing_type,
+            pricing_data,
+        } => {
+            info!("Operation: Put ({} in {})", instance_type, region);
+
+            db::put_pricing(dynamodb_client, table_name, &pricing_data).await?;
+
+            Ok(serde_json::json!({
+                "success": true,
+                "instanceType": instance_type,
+                "region": region,
+                "pricingType": pricing_type
+            }))
+        }
+
+        PricingOperation::ListCommon {
+            limit,
+            min_access_count,
+        } => {
+            info!("Operation: ListCommon (limit={}, min_access={})", limit, min_access_count.unwrap_or(0));
+
+            let common = db::query_most_accessed(dynamodb_client, table_name, limit, min_access_count).await?;
+
+            Ok(serde_json::json!({
+                "instances": common,
+                "count": common.len()
+            }))
+        }
+
+        PricingOperation::IncrementAccess {
+            instance_type,
+            region,
+        } => {
+            info!("Operation: IncrementAccess ({} in {})", instance_type, region);
+
+            // Default to retail for access counting
+            db::increment_access_count(
+                dynamodb_client,
+                table_name,
+                &instance_type,
+                &region,
+                &PricingType::Retail,
+                None,
+            )
+            .await?;
+
+            Ok(serde_json::json!({
+                "success": true,
+                "instanceType": instance_type,
+                "region": region
+            }))
+        }
+
+        PricingOperation::QueryAwsApi {
+            instance_type,
+            region,
+        } => {
+            info!("Operation: QueryAwsApi ({} in {})", instance_type, region);
+
+            let pricing = aws_pricing::fetch_ec2_pricing(pricing_client, &instance_type, &region).await?;
+
+            Ok(serde_json::json!({
+                "pricing": pricing,
+                "source": "aws-pricing-api"
+            }))
+        }
+
+        PricingOperation::QueryCostExplorer {
+            instance_type,
+            region,
+            aws_account_id,
+            role_arn,
+        } => {
+            info!(
+                "Operation: QueryCostExplorer ({} in {}, account={})",
+                instance_type, region, aws_account_id
+            );
+
+            let pricing = cost_explorer::fetch_account_specific_pricing(
+                sts_client,
+                &instance_type,
+                &region,
+                &aws_account_id,
+                &role_arn,
+            )
+            .await?;
+
+            Ok(serde_json::json!({
+                "pricing": pricing,
+                "source": "cost-explorer",
+                "includesEDP": true
+            }))
+        }
+    }
+}
+
+/// Fetch pricing based on type (retail or account-specific)
+async fn fetch_pricing(
+    pricing_client: &PricingClient,
+    sts_client: &StsClient,
+    instance_type: &str,
+    region: &str,
+    pricing_type: &PricingType,
+    aws_account_id: Option<&str>,
+) -> Result<crate::models::PricingData, String> {
+    match pricing_type {
+        PricingType::Retail => {
+            info!("Fetching retail pricing from AWS Pricing API");
+            aws_pricing::fetch_ec2_pricing(pricing_client, instance_type, region).await
+        }
+        PricingType::AccountSpecific => {
+            let account_id = aws_account_id.ok_or("aws_account_id required for account-specific pricing")?;
+
+            // Role ARN is expected to be in format: arn:aws:iam::{account_id}:role/pathfinder-pricing-access
+            let role_arn = format!("arn:aws:iam::{}:role/pathfinder-pricing-access", account_id);
+
+            info!("Fetching account-specific pricing from Cost Explorer");
+            cost_explorer::fetch_account_specific_pricing(
+                sts_client,
+                instance_type,
+                region,
+                account_id,
+                &role_arn,
+            )
+            .await
+        }
+    }
+}

src/models.rs

@@ -0,0 +1,199 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+/// Request payload for the Lambda function
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PricingRequest {
+    pub operation: PricingOperation,
+}
+
+/// Operations supported by crud-pricing
+#[derive(Debug, Deserialize)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum PricingOperation {
+    /// Get pricing from cache (optionally fetch from AWS if missing)
+    Get {
+        instance_type: String,
+        region: String,
+        pricing_type: PricingType,
+        #[serde(default)]
+        aws_account_id: Option<String>,
+        #[serde(default)]
+        fetch_if_missing: bool,
+    },
+
+    /// Put pricing data into cache
+    Put {
+        instance_type: String,
+        region: String,
+        pricing_type: PricingType,
+        pricing_data: PricingData,
+    },
+
+    /// List most commonly accessed instances
+    ListCommon {
+        #[serde(default = "default_limit")]
+        limit: usize,
+        #[serde(default)]
+        min_access_count: Option<u32>,
+    },
+
+    /// Increment access count for an instance
+    IncrementAccess {
+        instance_type: String,
+        region: String,
+    },
+
+    /// Query AWS Pricing API directly
+    QueryAwsApi {
+        instance_type: String,
+        region: String,
+    },
+
+    /// Query AWS Cost Explorer for account-specific pricing
+    QueryCostExplorer {
+        instance_type: String,
+        region: String,
+        aws_account_id: String,
+        role_arn: String,
+    },
+}
+
+fn default_limit() -> usize {
+    50
+}
+
+/// Type of pricing data
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum PricingType {
+    /// Public AWS list prices
+    Retail,
+    /// Account-specific prices (includes EDP/PPA automatically)
+    AccountSpecific,
+}
+
+/// Complete pricing data for an instance
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PricingData {
+    pub instance_type: String,
+    pub region: String,
+    pub pricing_type: PricingType,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub aws_account_id: Option<String>,
+
+    /// EC2 instance pricing
+    pub ec2_pricing: Ec2Pricing,
+
+    /// Metadata
+    pub source: String,  // "aws-pricing-api" or "cost-explorer"
+    pub last_updated: String,
+
+    /// Cache/access tracking
+    #[serde(default)]
+    pub access_count: u32,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_accessed: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub first_cached: Option<String>,
+}
+
+/// EC2 instance pricing details
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Ec2Pricing {
+    pub instance_family: String,  // "m6g", "t3", etc.
+    pub vcpus: i32,
+    pub memory_gb: f64,
+    pub architectures: Vec<String>,  // ["x86_64"], ["arm64"], etc.
+
+    /// OnDemand pricing
+    pub on_demand: OnDemandPricing,
+
+    /// Reserved pricing (if available)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reserved: Option<ReservedPricing>,
+
+    /// Spot pricing (if available)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub spot: Option<SpotPricing>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OnDemandPricing {
+    pub hourly: f64,
+    pub monthly: f64,  // hourly * 730
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ReservedPricing {
+    pub standard: HashMap<String, ReservedTerm>,  // "1yr", "3yr"
+    pub convertible: HashMap<String, ReservedTerm>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ReservedTerm {
+    pub all_upfront: ReservedOption,
+    pub partial_upfront: ReservedOption,
+    pub no_upfront: ReservedOption,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ReservedOption {
+    pub effective_hourly: f64,
+    pub effective_monthly: f64,
+    pub total_upfront: f64,
+    pub monthly_payment: f64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SpotPricing {
+    pub current_hourly: f64,
+    pub avg_hourly: f64,  // 30-day average
+    pub max_hourly: f64,
+    pub interruption_frequency: String,  // "<5%", "5-10%", etc.
+    pub savings_vs_on_demand_percent: i32,
+}
+
+/// Common instance returned by ListCommon operation
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CommonInstance {
+    pub instance_type: String,
+    pub region: String,
+    pub access_count: u32,
+    pub last_accessed: Option<String>,
+    pub last_updated: String,
+}
+
+/// Response envelope
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PricingResponse {
+    pub status_code: u16,
+    pub body: serde_json::Value,
+}
+
+impl PricingResponse {
+    pub fn success(data: impl Serialize) -> Self {
+        Self {
+            status_code: 200,
+            body: serde_json::to_value(data).unwrap_or(serde_json::Value::Null),
+        }
+    }
+
+    pub fn error(status_code: u16, message: &str) -> Self {
+        Self {
+            status_code,
+            body: serde_json::json!({ "error": message }),
+        }
+    }
+}