Idle EC2
Low CPU and almost no network for 14 days.
WEEKLY AWS WASTE REPORT
The Monday email that says which AWS resources are quietly billing you.
Connect a read-only role in about two minutes. Cloud Watchdog prices the idle stuff in dollars and hands you a command for each one. You run the command. We never stop or delete anything.
Delete the CloudFormation stack and our access is gone. We drop the stored scan 30 days after you disconnect.
No access keys
We store a role ARN and a unique external ID. The trust policy refuses the role without it.
Read-only on purpose
Describe, metrics, and cost reads. Not the AWS ReadOnlyAccess policy, which can also read S3 objects.
Numbers from code
An LLM may rephrase the email. If it changes a dollar, a percent, or a resource ID, we throw that draft away.
If you already open Cost Optimization Hub every Monday, you may not need this.
AWS already finds a lot of this waste, for free, once someone turns the tools on. We win on delivery: a push email, plain English, the fix command, and a note about what showed up or disappeared since last week.
1. Create the role
One CloudFormation stack. You can read the policy on this site before you click Create.
2. We scan
Idle compute, orphaned disks, old snapshots, unused addresses, quiet load balancers and databases. Dollar math stays in code.
3. Monday, in your inbox
Top waste by estimated dollars, what is new, and what dropped off. Mark something expected and we stop flagging it.
What the first scan looks for
Unattached EBS
Disks that are not attached to anything, still billed by the GB.
Old snapshots
Older than 180 days, with no AMI and no live volume.
Unused Elastic IPs
Public addresses that are not attached to an instance.
Idle load balancers
No healthy targets and almost no requests.
Idle or oversized RDS
Quiet databases, and ones that could drop a size.
Idle NAT gateways
The hourly charge, even when almost no bytes move.
Previous-gen and gp2
Older instance types, and gp2 volumes that can become gp3.
Estimates use public on-demand list rates, labeled as estimates. A weekly scan makes about one Cost Explorer request, billed to your account at $0.01 per request.
The product is the trust model.
We do not ask for write access, and the template does not grant it. Confused-deputy attacks are blocked with a random external ID per customer. Sessions that assume your role last an hour.
- Cross-account role only. No long-lived keys from your account.
- No S3 GetObject, no logs contents, no database rows.
- The policy is in this repo at cloudformation/watchdog-role.yaml.
- Offboarding is deleting the stack. Then we are locked out.
Flat prices. Not a cut of your bill.
Team sits under a typical small FinOps seat and does a narrower job. Annual billing, two months free, is wired when the annual Stripe prices are set.
Free scan
$0
One full report for a single account. Run it again after 90 days.
1 AWS account
Solo
$9/mo
One AWS account and a Monday email, with ignore and fixed tracking.
1 AWS account
Team
$29/mo
Five accounts, Slack, and a daily note when new waste crosses your line.
5 AWS accounts
Startup
$79/mo
Twenty accounts, everything in Team, plus CSV export.
20 AWS accounts
The first 100 paid customers keep these prices. Founder pricing is a promise we will honor in Stripe, not a coupon that exists yet.
Not ready to connect an account?
Join the waitlist for build notes. The free scan and the fake demo report are available as soon as you create an account.