A Client Cost Review With the Credentials You Already Have

You already have a profile for the client's account. An SSO role, a read-only role you assume, a ReadOnlyAccess user someone set up for the audit.

A cost review should not need anything more than that.

Most waste tools start by asking the client for something new: a cross-account role for the vendor, a stack to deploy, a data export. That is a security review and a week of email before you've looked at a single volume. The tool below skips it. It runs on your laptop, with the credentials you already hold, and sends nothing to us.

This is a walk-through of that review, including the places where it can mislead you.

Run it against the client profile

pipx install cloudcostwise
cloudcostwise scan --profile client-acme --regions all --format json > waste.json

--profile is the AWS profile name from your own config. Without it the tool uses the standard credential chain: environment variables, SSO, an instance role.

--regions all scans every enabled region, a few at a time (the default is four in parallel). The README puts a full multi-region run at roughly two to three minutes rather than ten. Leave --regions off and you get us-east-1 plus the profile's own region.

Pick the output for the audience. table is for you, markdown pastes into a ticket, json is the one to keep.

What it needs

AWS's managed ReadOnlyAccess is enough. If you'd rather scope a role down, the minimal policy the checks use ships in the repository as docs/iam-policy.json. It was derived from a scan of an account with most of the supported resource types, so if a check lacks a permission, the scan says so in its data warnings instead of failing.

That matters when the client's role is narrower than you expected. You'll get a gap, labelled as a gap.

What it will not do

Every AWS call the scanner makes goes through a guard that refuses any operation not starting with Describe, List, Get, Search or Lookup, whatever your credentials would allow. I wrote up the mechanism, with the code, last week in Read-Only by Construction, so I won't retell it.

Two things worth saying to a client who asks:

The guard is a second layer. Your credentials should be read-only too. Two layers that fail differently beat one.
It trusts AWS's naming. A few read-named operations have side effects, and the guard guards its own process, not a hostile one. The post above lists them.

The code is source-available under FSL-1.1-ALv2, so the client's engineer can read the guard instead of taking your word, or mine.

The one cost: Cost Explorer

The Cost Explorer API is not free. AWS bills it at $0.01 per request, and a scan makes about 13 of them, so roughly $0.13. That lands on the account the calls run in.

Those requests feed the Reserved Instance and Savings Plans checks. If the client has a cost-sensitive view of any charge appearing in their bill, skip them:

cloudcostwise scan --profile client-acme --regions all --no-cost-explorer

You lose the commitment checks, and extended-support surcharges fall back to estimates. The rest of the scan is unchanged. The output says which one you got.

What it checks

The local CLI runs 20 AWS services: EC2, Lambda, SageMaker, WorkSpaces, Lightsail, EBS, S3, EFS, ECR, RDS, DynamoDB, ElastiCache, Elastic IPs, NAT gateways and load balancers, VPC endpoints, dangling DNS records, CloudWatch logs and dashboards, security posture, RI and Savings Plans opportunities, and Compute Optimizer.

It is not a full audit of the account. It is a first pass at the things that bill quietly: unattached volumes, log groups that never expire, container images nobody cleaned up, idle load balancers. For idle EC2, RDS and NAT gateways, and for rightsizing, AWS's own tools cover the same ground, and you should use them too.

Reading the result honestly

This is the part that decides whether the review is worth the client's time.

The savings figure is an estimate. Each finding carries an estimated monthly saving and a confidence. Treat the total as "worth a look", not "will appear on the next invoice". Some waste types are marked advisory: they are listed, but never added to the total, because they could not be validated against a real AWS resource.

A failed read is reported as missing, not zero. If the credentials can't read a metric, the check says so in the data warnings (run with --verbose to see them). A finding that is absent because the read failed is not a clean bill of health. Look at warnings, errors and permission_errors in the JSON before you tell a client a service is clean.

A finding is a lead, not an instruction. Whether that volume is really unattached, or that load balancer really idle, is a question for the people who own the workload. Check before you delete anything. The tool never deletes anything, which is the point, but you will.

What you hand the client

The JSON is the useful artifact, and not only for the findings:

findings: waste type, region, resource, estimated monthly saving, confidence and the suggested action.
aws_api_calls: every AWS call the scan made, by service. This is the audit trail for the client's security person. They can check it against their own CloudTrail.
warnings, errors, permission_errors, coverage_notes: what the scan could not see.
checks_run: which checks ran at all.

Pair it with a short note of your own: which findings you'd act on first, which need the owner's input, and what the scan didn't cover. That note is the part a client is paying for. The tool just saves you the afternoon of clicking through consoles.

Hand over the file, and the account's resource names stay between you and them. Nothing was sent to CloudWise.

If you find a wrong answer

A false positive, a miss, or a dollar figure that looks off: post it in issue #1 on the repository, or email cloudwise@cloudcostwise.io. The waste type and counts are enough; leave out account IDs and resource names. A confirmed false positive gets fixed in the next release.

Try it

Free, read-only, source-available. Nothing is sent to CloudWise.

pipx install cloudcostwise

Details and the install line: cloudcostwise.io. If you run reviews like this for several clients, there is a page for consultancies at cloudcostwise.io/partners.