Cloudblame
EN TR
Sign in Run a free cost scanFree scan

Cost control for every cloud bill · live today on every AWS service and Kubernetes

Your bill tells you a day late. Cloudblame names the cause the same hour.

Cloudblame prices a cost spike within minutes and names the change behind it: the deploy, alert rule or setting, and the team that owns it. You get a fix you can undo, and the result is read from your own bill.

Run a free cost scan Read the case, minute by minute

Connects in about ten minutes: one CloudFormation stack, one read-only role with your external ID. No agent, nothing installed in your cluster.

The red line on the left is one scenario, from 14:02 to 14:26. Scroll and the page follows it to the month-end bill.The red line under the menu follows the page: one scenario from 14:02 to 14:26, then the product.

Reads today: every AWS service on your bill, and Kubernetes, through one read-only role. Writes nothing to your cloud account.Not only on AWS? See what is next

PR #1832 · finding #003 · illustrative scenario

14:02 – 14:26Case file

Illustrative scenarioFictional identitiesRun rates at list price

22 nodes in four minutes. Priced in ten. Named the same hour.

A pull request raised CPU requests from 1 to 8 vCPU on 40 replicas, and Karpenter added 22 nodes in four minutes. Left running, AWS would report it the next day as “EC2 usage increased”. Cloudblame priced the launch at 14:12 and named the pull request, the team and a one-line fix.

In this scenario the investigation starts the moment the alert fires. On a connected account events are read every five minutes, and an automatic investigation starts once an event has stayed open for 30 minutes.

already runningnew after the PRdrained after the revert
  1. 14:02cost starts

    In this example, a pull request merges

    PR #1832 merged: matchmaking CPU requests 1 → 8 vCPU on 40 replicas. The deploy rolls out.

    PR #1832 · deployment game-services/matchmaking
    replicas: 40
    resources.requests.cpu: "1"
    resources.requests.cpu: "8"

    14:03320 vCPU requested, 38 pods pending. Karpenter starts launching nodes.

  2. 14:12priced Cloudblame Detect

    Cloudblame prices the launch

    Cloudblame alert: 22 × m6i.8xlarge launched by Karpenter in four minutes, about $34 an hour at list price.

    Evidence · 2 ids

    • CloudTrail RunInstances ×22 · role/karpenter-prod · eventID 9c4d…e1
    • NodeClaim general-x7k2q → pending pods game-services/matchmaking
  3. 14:16named Cloudblame Attribute

    The message names the change and its owner

    The message: who, what, why, and a brake with its undo. Revert the pull request, or cap the node pool.

    Cloudblame14:16 · #cloud-cost · finding #003Spike

    22 × m6i.8xlarge launched for game-services/matchmaking in 4 minutes

    Who
    gameplay team · PR #1832 · deployment matchmaking
    What
    CPU requests 1 → 8 vCPU on 40 replicas; Karpenter added 22 nodes (704 vCPU)
    Why
    CPU on the new nodes averages 4%: the capacity was requested, not used
    Run rate
    $34/h at list price · $811/day
    Brake · you run it · undo next to itgit revert <merge of PR #1832> # undo: merge it again

    Evidence · 3 ids

    • requests.cpu = 8 on deployment game-services/matchmaking
    • CloudWatch CPUUtilization on the new nodes ≈ 4%
    • deployment annotation 3f9c2d1… = PR #1832, gameplay team
  4. 14:26stopped Brake

    The team runs the brake

    The gameplay team reverts the pull request. The 22 nodes drain.

    The brakes on the messageYou run them · each comes with its undo
    Revert PR #1832git revert <merge of PR #1832>Undo: merge it again.
    Cap the node pool at 400 vCPUkubectl patch nodepool general --type merge -p '{"spec":{"limits":{"cpu":"400"}}}'Undo: remove the limit.

eventID 9c4d…e1 · general-x7k2q · 3f9c2d1… · finding #003

+24 hThe two reports

What your provider says. What Cloudblame says.

AWS explains anomalies for free, and we read that first on every account. For a spike like this one it names the service and the usage type. What AWS’s own tools already list never counts toward our share.

Your provider’s own report · a day later

AWS Cost Anomaly Detection

  1. Service: Amazon EC2 – Compute
  2. Usage type: EUC1-BoxUsage:m6i.8xlarge
  3. Account: production
  4. Region: eu-central-1
  5. Stops here.

Cloudblame · the same hour

Finding #003

  1. CloudTrail RunInstances × 22 by karpenter-prod · eventID 9c4d…e1
  2. NodeClaims → pending pods in game-services/matchmaking: 40 × 8 vCPU requested
  3. CPU on the new nodes averages 4%: the capacity was requested, not used
  4. Deployment annotation 3f9c2d1… = PR #1832 “raise matchmaking requests”, gameplay team
  5. Fix: requests back to 1 vCPU, HPA at 70%. The diff and its undo are on the message.
Six links, one finding idHow far the chain goes depends on what your deploys write on the workload.
  1. Bill lineEC2 · +$34/h
  2. IAM principalkarpenter-prod
  3. NodeClaimgeneral-x7k2q
  4. Pending pods38 · game-services
  5. Deploy annotation3f9c2d1…
  6. PR and team#1832 · gameplay

AWS stops at the usage typeCloudblame keeps walking

eventID 9c4d…e1 · 3f9c2d1… · PR #1832

Month endRead from the bill

At month end the bill shows 24 minutes, not a month.

Cloudblame reads the same line on your own AWS bill. In this scenario the EC2 line carries about 9 extra node-hours on the day of the pull request, about $14 at list price, and is back on its baseline the next day. A stopped spike is a cost you did not keep paying. It is not a saving, and no success share is taken on it.

Illustrative · the scenario’s EC2 line · m6i.8xlarge node-hours a day

Before the pull request192
The day of the pull request≈ 201
The days after192
Had it kept running · never on the bill720
Illustrative figures: 8 nodes all day is 192 node-hours; 22 more for 24 minutes adds about 9; left running they would add 528 a day.

A saving is something else: a fix to spend that was already running.

After such a fix Cloudblame re-reads the line against a frozen baseline and unit price, and it counts only when your bill shows it for a full month. The plan is a fixed monthly price; the success share is taken only on this number, for twelve months per fix.

Statement · layoutEvery row is illustrative
FindingBaselineBilledFrom the bill
#005NAT → S3 gateway endpoint (payments) Illustrative2.1 TB/day0.3 TB/day$4,860
#007DynamoDB orders table, provisioned → on-demand Illustrative3,000 WCU640 WCU$2,180
#009CloudWatch Logs, debug level off in checkout Illustrative410 GB/day95 GB/day$1,240
Total in this layout$8,280
Bill on the Scale plan: $599 + success share $229 (10% above $5,990)$828
Every row here is illustrative. In a real statement each row carries the aws ce get-cost-and-usage command that prints the same figure in your own account.
Run a free cost scan Read the measurement annex

frozen baseline · your own unit price · 12 months per fix

Coverage

We read every line of your bill, down to the resource behind it.

Your provider stops at the service and the usage type. Cloudblame keeps going: the resource that bills, the change that started it, the team that owns it, and a fix you run yourself.

How deep one line goesIllustrative
  1. 01 Bill line EBS:VolumeUsage.gp3 rose 40% in March Read from Cost Explorer, every line, every day
  2. 02 Resource 14 unattached gp3 volumes, 1.4 TiB, no I/O for 30 days Read through your read-only role
  3. 03 Change and owner Created by deploy-ci on 12 March · payments team From CloudTrail and your tags
  4. 04 Fix you run One stack in your account: snapshot, then delete Undo from the snapshot · the result is read from your bill

Where we go to the bottom today

Compute

  • EC2 idle and oversized instances, large launches priced as they happen within minutes
  • ECS and Fargate forgotten services, oversized tasks, Spot-ready workloads
  • Lambda retry loops, idle provisioned concurrency within minutes
  • EKS idle pod requests and the nodes they hold

Data and storage

  • RDS and Aurora idle databases, Multi-AZ on dev, snapshots of deleted databases
  • ElastiCache oversized nodes, replicas nobody reads
  • DynamoDB provisioned capacity nobody consumes
  • S3 old versions, unfinished uploads, missing lifecycle rules one-click fix
  • EBS unattached volumes, orphaned snapshots one-click fix

Network

  • NAT and data transfer cross-zone routes, missing gateway endpoints within minutes
  • Load balancers no healthy target for 14 days

Observability

  • CloudWatch Logs debug floods, logs kept forever within minutes
  • Athena query storms and the dashboard behind them within minutes

Beyond AWS

Nextnot connected yet Cloudflare · Datadog · Grafana alert rules · Argo CD · Cost and Usage Report via Athena

On the roadmapnot built Google Cloud · Azure · Snowflake · OpenAI and Anthropic API spend · Vercel · MongoDB Atlas

Tell us which bill hurts

15 waste patterns live, each priced from your bill

Connect

One read-only role. Delete the stack and we are gone.

  1. 01

    Connect

    Launch one CloudFormation stack: a single read-only role with your external ID. About ten minutes, no agent, nothing installed in your cluster.

  2. 02

    Scan

    A free one-page answer: what AWS already explains, the largest lines it cannot, and a clear go or no-go.

  3. 03

    Investigate

    Named findings with their evidence ids and a fix you can undo. You run every change yourself: a command, a stack in your own account, or a draft pull request you merge.

  4. 04

    Read the bill

    After a full calendar month the line is read again on your own bill against the frozen baseline.

Run a free cost scan
CloudFormation · StacksCREATE_COMPLETE
cloudblame-readonlyabout a minute
KeyValueWhat it is
RoleArnarn:aws:iam::123456789012:role/CloudCostControlReadOnlyPaste into step 2 of the scan
KubernetesAccessnone (EksClusterNames empty)View access entries, only if you name a cluster
Parameters: ExternalId (generated in your browser) · EnableCurQueries = falseDelete the stack to revoke · the policy is published

What the role reads · one read-only role, published policy

  • CloudTrail · LookupEvents
  • CloudWatch · GetMetricData, ListMetrics
  • Cost Explorer · GetCostAndUsage, GetAnomalies
  • Cost Optimization Hub · ListRecommendations
  • EC2, EBS · Describe*
  • RDS, ElastiCache · Describe*
  • DynamoDB, Lambda · read configuration
  • CloudWatch Logs · DescribeLogGroups
  • EKS · DescribeCluster, ListNodegroups
  • Kubernetes API · optional, view only

Cloudblame has no write access to your cloud account. The one thing it can write is a pull request on a cloudblame/* branch in a repository you choose, opened as a draft where your GitHub plan allows it; it never merges.

Read policy.jsonRead the CloudFormation template

role CloudCostControlReadOnly · external ID · read-only

Pricing

A fixed plan from $49. A capped share of what your bill proves.

The plan covers the audit, the findings and the fixes. On top of it we take 10% of verified savings above ten times the plan price, and never more than three times the plan price in a month. Verified means read from your own AWS bill for a full calendar month after the fix, net of anything the fix left behind.

  • From $49 a month
  • Share capped at 3× the plan
  • 12 months per fix, then $0
PlanPer monthMost you pay
StarterAWS spend up to $10k a month$49$196
Growth$10k to $50k a month$199$796
Scale$50k to $250k a month$599$2,396
Above $250k a monthtalk to us
  • Free: connecting an account and the first scan. No card.
  • Included in the plan: verified savings up to ten times its price.
  • Each fix counts for 12 months after its fix date, then $0.
  • Never counted: early signals, modelled figures, and what AWS’s own tools already list.
  • Paying yearly costs ten months.

Plans and the success share are measured on your AWS bill only.

Card payments will go through Paddle and are not open yet; until then a connected account is not charged.

$6,000
Plan
$199
Success share
$401
Your bill
$600

10% above 10× the plan · capped at 3× · 12 months per fix

Free scan · about ten minutes · read-only

Go from surprised by the bill to warned the same hour.

Run a free cost scan See a sample report