How a dev agency checks its clients' AWS bills without asking for the keys to the account

Techlio is a software development agency with offices in Dallas and Lahore. Most of its clients run on AWS, and most of them don't have a dedicated DevOps person, so nobody is watching the bill. Mahsam Sherazi, Founder and Director of Technology at Techlio, wanted a way to find that waste for clients without a long engagement, and without asking a client to trust a new vendor with access to their account.

What he did

In October, Mahsam ran cloudcostwise, the free, source-available CLI, against one client's AWS account. It ran on his own machine with read-only credentials, across every region, with the Cost Explorer checks turned off so that the scan cost nothing. No access was given to CloudWise, and no data left his machine.

He wrote up the findings for the client himself.

The three findings that looked off

While reviewing the results, and before anything went to the client, Mahsam caught three findings that he didn't think were right. He was right: they were false positives in cloudcostwise. All three were fixed, and the fixes shipped in a new version the same day.

What his clients need before they say yes

Client sign-off comes first. Mahsam was clear about what that takes:

• Trust. The tool has to be safe to run on a client's account. cloudcostwise refuses any AWS call that would change or delete something, and every call it makes shows up in the client's own CloudTrail log as a read.
• A report a non-technical reader can follow. The client sees a summary and the first things to do, not a raw list.
• A fix and a risk note for each finding, so the client's team knows what changing it could affect.

Techlio now offers these scans to selected AWS clients, with each client's sign-off.

"Most of our clients run on AWS without anyone watching the bill. cloudcostwise lets me check an account with read-only access, on my own machine, without asking the client to trust another vendor. When I flagged three findings that looked wrong, the fixes shipped the same day. That responsiveness is why I'm comfortable offering it to more of our clients."

Mahsam Sherazi, Founder and Director of Technology, Techlio

Run it on one of your clients

pipx install cloudcostwise
cloudcostwise scan --profile CLIENT_PROFILE --regions all --no-cost-explorer

The --no-cost-explorer flag skips the Reserved Instance and Savings Plans checks, which call Cost Explorer (AWS bills those at $0.01 a request). Consultancies can book a free 30-minute review on one client account at cloudcostwise.io/partners.