Free AWS waste audit
Connect one read-only role. Within 24 hours you get a written report of the waste we found in your AWS accounts: the total, the largest cuts with the evidence for each, and a plain verdict on whether Spendsaw is worth paying for. No card, and nothing in your account is changed.
Design partners Audits are part of the design-partner pilot and are by request. Spendsaw is pre-launch, there is no sign-up, and we set up each audit by hand, so we take a few at a time and may ask you to wait. What runs today
Who it is for
Dev agencies and small MSPs that spend at least $5,000 a month on AWS and have nobody whose job is the bill.
The threshold is there because waste scales with spend. The one real result we have is our own organization: 4 accounts, about $52 a month of waste found. That is a true number and it would not justify a $49 plan. Below about $5,000 a month the audit is likely to tell you the same thing, and the free MCP server is the better fit.
What you get
A written report of one or two pages, sent by email to the person who asked, as a PDF and as plain text. It holds:
- The total estimated monthly waste, with each resource counted once, and a plain statement of whether it passes the 3x rule.
- The largest cuts, largest first: the resource id and region, what is wrong with it, the evidence (for example, how long a volume has been unattached), and the risk tier of the fix.
- An estimated monthly cost for each, and where that number comes from. In an audit that is the AWS list price for the resource's region. It is an estimate, written as "about $47/mo", and it does not include your discounts.
- Hygiene items that cost nothing today, such as log groups with no retention, as a count. They are never added to the total.
- Which findings rest on weaker evidence, marked as low confidence.
The full list of findings, and the exact AWS CLI commands that would make any of the cuts, are available on request as text for you to review. We do not run them. The resource types the scanner covers are listed under findings and cost sources.
What you deploy
One CloudFormation stack in each account you want audited. The stack creates one IAM role, CostAgentReadOnly, and nothing else. There are no access keys to hand over and no agent to install.
- We send a CloudFormation quick-create link with three things filled in: the template URL, our AWS account id, and an ExternalId generated for you.
- You open it while signed in to the account, read the template, tick the IAM acknowledgement and create the stack.
- You tell us the account ids. We start the scan.
The role can be assumed only from our account and only with your ExternalId. For an AWS Organization, the same template can go out as a service-managed StackSet; the management account then gets the role from the link. The parameters are described under connect an AWS account.
What is read, and what is not
The role attaches the AWS-managed policy ViewOnlyAccess and one inline policy of ours. Together they allow list and describe calls and nothing that writes. The inline policy ends with an explicit deny on reading your data, which overrides any allow.
| Read | Denied in the role |
|---|---|
| Resource ids, names, tags and configuration: size, type, attachment, age | S3 object contents |
| CloudWatch metric statistics, used as evidence that something is idle | Log events and log queries |
| Cost Explorer totals and public AWS price lists | DynamoDB items |
| Reservations and Savings Plans, so rightsizing can account for them | Secret values and SSM parameter values, and kms:Decrypt |
| AWS's own recommendations for the account | Lambda function code, container images, CodeCommit contents |
| Bedrock inventory and token counts per model | Bedrock agent memory and knowledge-base retrieval |
| The list of accounts in the organization | Queue messages, stream records, Athena query results |
Every statement of the policy, action by action, is on the trust page. The hosted service makes no model call today, so nothing from your account is sent to a model during an audit.
The 24 hours
The clock starts when the role is connected in every account you want audited and you have told us. The scan itself is short: on our own organization, 68 account-regions took about 70 seconds. The rest of the time is a person reading the findings before the report goes out. If we are going to miss 24 hours we will tell you before it passes.
The 3x rule
If the audit does not find waste worth at least three times what Spendsaw would cost you, we will tell you not to buy.
At the draft prices that means about $147 a month of waste for the Team plan at $49, or $45 a month per managed account for the MSP plan at $15. You keep the report either way. Prices are a draft and billing is not live; see pricing.
What the audit is not
- It changes nothing. The role cannot write, and the commands in the report are text.
- The amounts are estimates at list price, not verified savings. Billed cost and savings checked against the bill are built and not hosted yet.
- A rightsizing estimate can be too high when a reservation or Savings Plan held in another account of your organization covers the instance.
- It is not a security review, an architecture review or a guarantee that the listed resources are safe to remove. A person who knows the account has to decide that.
- It is not a contract. The terms, privacy policy and data processing addendum are drafts under legal review and are not in force.
Removing access
Delete the CloudFormation stack. That deletes the role, and we can no longer assume it. A session issued before the delete can last until it expires, at most 3600 seconds.
The findings from your audit stay in the hosted service until your tenant is removed. There is no automatic expiry and no defined deletion process yet (see data retention). If you do not go ahead, ask, and we will remove your tenant and its findings by hand.
How to ask
Write to hello@spendsaw.com with the subject "Spendsaw free audit" and three facts:
- How many AWS accounts you run, and whether they are in one AWS Organization.
- Roughly what you spend on AWS in a month.
- Whether the infrastructure is in Terraform.
If the audit passes the 3x rule, the next step is the design-partner pilot: free for 60 days, with weekly feedback. Nothing is changed in your account during the pilot without an approval from a person you name.
Sources: cloudformation/cost-agent-readonly.yaml, docs/live-validation.md, infra/terraform/modules/onboarding/, infra/terraform/modules/tenant/.