AWS cost optimization, from a read-only role
AWS is where CloudJaeger is strongest, because it is where we have proven the most on our own bill. A read-only IAM role turns your Cost and Usage data into owned, ranked findings — bill-backed, projected until graded, and never acted on without you.
Built for engineering-led SaaS teams, mostly on AWS, without a dedicated FinOps hire.
The problem: AWS spend outgrows the people watching it
AWS makes it trivial to add cost and hard to attribute it. Cost Explorer shows the totals, the CUR holds the detail, and yet the practical questions stay unanswered: which service and account drove this month’s increase, which team owns that service, which of the ranked “recommendations” are safe to act on, and what any of them are really worth once the invoice lands. Teams end up either ignoring the numbers or chasing them manually, one spreadsheet at a time.
The gap is rarely data — AWS gives you plenty. The gap is a trustworthy, owned, ranked view that connects a spend line to a person and a safe next step. That is the specific problem CloudJaeger is built to close on AWS first.
A read-only IAM role with a policy you see first
Connecting AWS means creating a read-only IAM role whose exact policy we publish before you connect. No agent runs in your account, nothing is installed on your workloads, and the role is yours to delete at any time. From it, CloudJaeger reads cost, inventory, utilization metrics and configuration; the default role can create, change or delete nothing, and the one opt-in write is Athena query results into the CUR bucket you designate, if you connect a CUR.
Where you have Cost Explorer and the Cost and Usage Report configured, CloudJaeger uses them as the source of truth. Spend is bill-backed: synced from your bill and reconciled against it rather than estimated. On our own AWS estate, on the June 2026 bill, that reconciliation landed within about 1% of the CUR, window-aligned — and on yours the same check gives a result once your Cost and Usage Report is connected, naming what is missing until then, so the numbers you act on are the numbers your finance team already sees. The production CUR import ran again on 27 September 2026. September’s CUR, through the 26th, agrees with Cost Explorer to the cent; August’s is $17.07 short and under investigation, so the June 2026 check remains the last clean one.
Services, ownership, topology, and findings — in one place
Once the bill is in view, CloudJaeger builds the working context around it. Spend lands on services with an owner source on every row, so unowned cost is visible instead of buried. An auto-generated topology map shows resources by account, region, and VPC with inferred relationship edges, so you can see where spend lives in the architecture. And the waste, right-sizing, commitment and anomaly engines feed one ranked queue of advisory findings, each with its evidence attached.
Every dollar figure is projected: an estimate, tagged as such, until a real invoice moves and grades it against your bill. Nothing is shown as money already saved. That restraint is what makes the numbers usable in a real FinOps conversation rather than a marketing one.
- 1Bill-backed spend An EC2 family’s cost is read from the CUR line — not an estimate.
- 2Owner source The instance resolves to a configured or inferred owner, so the finding has a destination.
- 3Ranked, reversible A right-size with a 14-day utilization basis ranks by confidence, risk, and reversibility.
- 4Projected, then graded The figure stays a projection until the next invoice grades it against your real bill.
No automatic execution — you stay in control
CloudJaeger does not act on your AWS account. This build has no execution path: nothing is applied to your cloud, with or without an approval. Approving a recommendation records a decision; nothing is applied. CloudJaeger does the analysis and ranks the choices; a human decides what changes, and your team makes the change in your own tools. For a system that reads production spend, that is the feature, not a limitation.
Beyond AWS, we stay honest about scope: AWS runs on real bills today; Azure and Google Cloud sync real cost and inventory, and stay in Preview until checked against a real bill. AWS is proven on our own money; Azure and GCP are never presented as equal to it.
CloudJaeger runs a ten-team design partner programme. Access is reviewed personally — no public signup. No account is created until access is approved.
Request access and it is reviewed personally — a read-only first scan comes before anything else.
Turn your AWS bill into owned, ranked findings.
Read-only role, published policy, first findings in the first meeting — then you decide.
