Cost control for every cloud bill · live today on every AWS service and Kubernetes
Your bill tells you a day late. Cloudblame names the cause the same hour.
Cloudblame prices a cost spike within minutes and names the change behind it: the deploy, alert rule or setting, and the team that owns it. You get a fix you can undo, and the result is read from your own bill.
Connects in about ten minutes: one CloudFormation stack, one read-only role with your external ID. No agent, nothing installed in your cluster.
The red line on the left is one scenario, from 14:02 to 14:26. Scroll and the page follows it to the month-end bill.The red line under the menu follows the page: one scenario from 14:02 to 14:26, then the product.
Reads today: every AWS service on your bill, and Kubernetes, through one read-only role. Writes nothing to your cloud account.Not only on AWS? See what is next
PR #1832 · finding #003 · illustrative scenario
14:02 – 14:26Case file
Illustrative scenarioFictional identitiesRun rates at list price
22 nodes in four minutes. Priced in ten. Named the same hour.
A pull request raised CPU requests from 1 to 8 vCPU on 40 replicas, and Karpenter added 22 nodes in four minutes. Left running, AWS would report it the next day as “EC2 usage increased”. Cloudblame priced the launch at 14:12 and named the pull request, the team and a one-line fix.
In this scenario the investigation starts the moment the alert fires. On a connected account events are read every five minutes, and an automatic investigation starts once an event has stayed open for 30 minutes.
- 14:02cost starts
In this example, a pull request merges
PR #1832 merged: matchmaking CPU requests 1 → 8 vCPU on 40 replicas. The deploy rolls out.
PR #1832 · deployment game-services/matchmaking replicas: 40-resources.requests.cpu: "1"+resources.requests.cpu: "8"14:03320 vCPU requested, 38 pods pending. Karpenter starts launching nodes.
- 14:12priced Cloudblame Detect
Cloudblame prices the launch
Cloudblame alert: 22 × m6i.8xlarge launched by Karpenter in four minutes, about $34 an hour at list price.
Evidence · 2 ids
- CloudTrail RunInstances ×22 · role/karpenter-prod · eventID 9c4d…e1
- NodeClaim general-x7k2q → pending pods game-services/matchmaking
- 14:16named Cloudblame Attribute
The message names the change and its owner
The message: who, what, why, and a brake with its undo. Revert the pull request, or cap the node pool.
Cloudblame14:16 · #cloud-cost · finding #003Spike22 × m6i.8xlarge launched for game-services/matchmaking in 4 minutes
- Who
- gameplay team · PR #1832 · deployment matchmaking
- What
- CPU requests 1 → 8 vCPU on 40 replicas; Karpenter added 22 nodes (704 vCPU)
- Why
- CPU on the new nodes averages 4%: the capacity was requested, not used
- Run rate
- $34/h at list price · $811/day
Brake · you run it · undo next to itgit revert <merge of PR #1832> # undo: merge it againEvidence · 3 ids
- requests.cpu = 8 on deployment game-services/matchmaking
- CloudWatch CPUUtilization on the new nodes ≈ 4%
- deployment annotation 3f9c2d1… = PR #1832, gameplay team
- 14:26stopped Brake
The team runs the brake
The gameplay team reverts the pull request. The 22 nodes drain.
The brakes on the messageYou run them · each comes with its undoRevert PR #1832git revert <merge of PR #1832>Undo: merge it again.Cap the node pool at 400 vCPUkubectl patch nodepool general --type merge -p '{"spec":{"limits":{"cpu":"400"}}}'Undo: remove the limit.
eventID 9c4d…e1 · general-x7k2q · 3f9c2d1… · finding #003
+24 hThe two reports
What your provider says. What Cloudblame says.
AWS explains anomalies for free, and we read that first on every account. For a spike like this one it names the service and the usage type. What AWS’s own tools already list never counts toward our share.
Your provider’s own report · a day later
AWS Cost Anomaly Detection
- Service: Amazon EC2 – Compute
- Usage type: EUC1-BoxUsage:m6i.8xlarge
- Account: production
- Region: eu-central-1
- Stops here.
Cloudblame · the same hour
Finding #003
- CloudTrail RunInstances × 22 by karpenter-prod · eventID 9c4d…e1
- NodeClaims → pending pods in game-services/matchmaking: 40 × 8 vCPU requested
- CPU on the new nodes averages 4%: the capacity was requested, not used
- Deployment annotation 3f9c2d1… = PR #1832 “raise matchmaking requests”, gameplay team
- Fix: requests back to 1 vCPU, HPA at 70%. The diff and its undo are on the message.
- Bill lineEC2 · +$34/h
- IAM principalkarpenter-prod
- NodeClaimgeneral-x7k2q
- Pending pods38 · game-services
- Deploy annotation3f9c2d1…
- PR and team#1832 · gameplay
AWS stops at the usage typeCloudblame keeps walking
eventID 9c4d…e1 · 3f9c2d1… · PR #1832
Month endRead from the bill
At month end the bill shows 24 minutes, not a month.
Cloudblame reads the same line on your own AWS bill. In this scenario the EC2 line carries about 9 extra node-hours on the day of the pull request, about $14 at list price, and is back on its baseline the next day. A stopped spike is a cost you did not keep paying. It is not a saving, and no success share is taken on it.
Illustrative · the scenario’s EC2 line · m6i.8xlarge node-hours a day
A saving is something else: a fix to spend that was already running.
After such a fix Cloudblame re-reads the line against a frozen baseline and unit price, and it counts only when your bill shows it for a full month. The plan is a fixed monthly price; the success share is taken only on this number, for twelve months per fix.
| Finding | Baseline | Billed | From the bill |
|---|---|---|---|
| #005NAT → S3 gateway endpoint (payments) Illustrative | 2.1 TB/day | 0.3 TB/day | $4,860 |
| #007DynamoDB orders table, provisioned → on-demand Illustrative | 3,000 WCU | 640 WCU | $2,180 |
| #009CloudWatch Logs, debug level off in checkout Illustrative | 410 GB/day | 95 GB/day | $1,240 |
| Total in this layout | $8,280 | ||
| Bill on the Scale plan: $599 + success share $229 (10% above $5,990) | $828 | ||
frozen baseline · your own unit price · 12 months per fix
Coverage
AWS is where we start, not where we stop.
The method is the same on every bill: read usage, find the change that caused it, hand over a fix you can undo, check the result on the bill. Here is where it works today, what is next, and what is on the roadmap.
Live todayconnected
- AWS
- Kubernetes on EKS
- Slack
- GitHub draft PRs
AWS through one read-only role; Kubernetes on EKS, optional and view only. Findings go out as a Slack message and an e-mail. Fixes arrive on GitHub as a draft pull request you merge yourself, Terraform first.
Nextnot connected yet
- Cloudflare
- Datadog
- Grafana alert rules
- Argo CD
- Cost and Usage Report via Athena
Nothing reads these today, and we give no date. The playbooks below show what we will look for.
On the roadmapnot built
- Google Cloud
- Azure
- Snowflake
- OpenAI and Anthropic API spend
- Vercel
- MongoDB Atlas
The other bills a cloud team pays. Tell us what you pay for; we build in the order customers ask.
What we blame today, on AWS and Kubernetes
- Query stormsAthena, Logs Insights · minutes Your provider seesservice and usage type Cloudblame addsthe workgroup, the query pattern, the role behind it, and a brake
- Log bloatCloudWatch Logs · minutes Your provider seesusage type Cloudblame addsthe log group and the deploy that raised the level
- NAT and data transferVPC · minutes Your provider seesan idle NAT Cloudblame addsthe workload and the missing VPC endpoint
- Over-provisioned and forgotten resourcesEC2, EBS, RDS · same day Your provider seesthe list, for free Cloudblame addswho created it, when, and the change to remove it
- Kubernetes idle requestsEKS · same day Your provider seesnode level Cloudblame addsnamespace, workload, owner, the requests to change
- Lambda retry stormsLambda · minutes Your provider seesthe principal Cloudblame addsthe retry setting and the loop
- Large launches outside normal hoursEC2 · minutes Your provider seesa day later Cloudblame addspriced in minutes, with a brake
NextNot built or not connected yet
- CDN and egressCloudflare Cloudblame addsthe cache rule that sends bytes to origin
- Observability billsDatadog Cloudblame addsthe deploy that added the cardinality
- Alert rules and dashboardsGrafana Cloudblame addsthe rule or dashboard behind a query storm, and its owner
- S3 access patterns and lifecycleAWS · no playbook yet Cloudblame addsthe requester and the lifecycle rule
- AI spend on BedrockAWS · no playbook yet Cloudblame addsthe caller, the prompt growth, the model choice
7 playbooks live · 5 next
Connect
One read-only role. Delete the stack and we are gone.
- 01
Connect
Launch one CloudFormation stack: a single read-only role with your external ID. About ten minutes, no agent, nothing installed in your cluster.
- 02
Scan
A free one-page answer: what AWS already explains, the largest lines it cannot, and a clear go or no-go.
- 03
Investigate
Named findings with their evidence ids and a fix you can undo. You run every change yourself: a command, a stack in your own account, or a draft pull request you merge.
- 04
Read the bill
After a full calendar month the line is read again on your own bill against the frozen baseline.
| Key | Value | What it is |
|---|---|---|
| RoleArn | arn:aws:iam::123456789012:role/CloudCostControlReadOnly | Paste into step 2 of the scan |
| KubernetesAccess | none (EksClusterNames empty) | View access entries, only if you name a cluster |
What the role reads · one read-only role, published policy
- CloudTrail · LookupEvents
- CloudWatch · GetMetricData, ListMetrics
- Cost Explorer · GetCostAndUsage, GetAnomalies
- Cost Optimization Hub · ListRecommendations
- EC2, EBS · Describe*
- RDS, ElastiCache · Describe*
- DynamoDB, Lambda · read configuration
- CloudWatch Logs · DescribeLogGroups
- EKS · DescribeCluster, ListNodegroups
- Kubernetes API · optional, view only
Cloudblame has no write access to your cloud account. The one thing it can write is a pull request on a cloudblame/* branch in a repository you choose, opened as a draft where your GitHub plan allows it; it never merges.
role CloudCostControlReadOnly · external ID · read-only
Pricing
A fixed plan from $49. A capped share of what your bill proves.
The plan covers the audit, the findings and the fixes. On top of it we take 10% of verified savings above ten times the plan price, and never more than three times the plan price in a month. Verified means read from your own AWS bill for a full calendar month after the fix, net of anything the fix left behind.
- From $49 a month
- Share capped at 3× the plan
- 12 months per fix, then $0
| Plan | Per month | Most you pay |
|---|---|---|
| StarterAWS spend up to $10k a month | $49 | $196 |
| Growth$10k to $50k a month | $199 | $796 |
| Scale$50k to $250k a month | $599 | $2,396 |
| Above $250k a month | talk to us | |
- Free: connecting an account and the first scan. No card.
- Included in the plan: verified savings up to ten times its price.
- Each fix counts for 12 months after its fix date, then $0.
- Never counted: early signals, modelled figures, and what AWS’s own tools already list.
- Paying yearly costs ten months.
Plans and the success share are measured on your AWS bill only.
Card payments will go through Paddle and are not open yet; until then a connected account is not charged.
- Plan
- $199
- Success share
- $401
- Your bill
- $600
10% above 10× the plan · capped at 3× · 12 months per fix
Free scan · about ten minutes · read-only