Cloudblame
Menu
Türkçe Run a free cost scanFree scan

Entry 01 · Cover

Cost control for every cloud bill · live on AWS and Kubernetes today

Your bill tells you a day late. Cloudblame names the cause the same hour.

Cloudblame prices a cost spike within minutes and names the change behind it: the deploy, alert rule or setting, and the team that owns it. You get a fix you can undo, and the result is read from your own bill.

Run a free cost scan Read the case, minute by minute

Connects in about ten minutes: one CloudFormation stack, one read-only role with your external ID. No agent, nothing installed in your cluster.

The red line on the left is one scenario, from 14:02 to 14:26. Scroll and the page follows it to the month-end bill.The red line under the menu is one scenario, from 14:02 to 14:26. Scroll and the page follows it to the month-end bill.

Reads today: AWS and Kubernetes, through one read-only role. Writes nothing to your cloud account.Not only on AWS? See what is next

PR #1832 · finding #003 · illustrative scenario

14:02 – 14:26Entry 02 · Case file

Illustrative scenarioFictional identitiesRun rates at list price

22 nodes in four minutes. Priced in ten. Named the same hour.

A pull request raised CPU requests from 1 to 8 vCPU on 40 replicas, and Karpenter added 22 nodes in four minutes. Left running, AWS would report it the next day as “EC2 usage increased”. Cloudblame priced the launch at 14:12 and named the pull request, the team and a one-line fix.

In this scenario the investigation starts the moment the alert fires. On a connected account events are read every five minutes, and an automatic investigation starts once an event has stayed open for 30 minutes.

14:12 · 22 new nodes
already runningnew after the PRdrained after the revert
  1. 14:02

    PR #1832 merged: matchmaking CPU requests 1 → 8 vCPU on 40 replicas. The deploy rolls out.

  2. 14:03

    320 vCPU requested, 38 pods pending. Karpenter starts launching nodes.

  3. 14:12
    CloudblameDetect

    Cloudblame alert: 22 × m6i.8xlarge launched by Karpenter in four minutes, about $34 an hour at list price.

    Evidence · 2 ids

    CloudTrail RunInstances ×22 · role/karpenter-prod · eventID 9c4d…e1

    NodeClaim general-x7k2q → pending pods game-services/matchmaking

  4. 14:16
    CloudblameAttribute

    The message: who, what, why, and a brake with its undo. Revert the pull request, or cap the node pool.

    Evidence · 3 ids

    requests.cpu = 8 on deployment game-services/matchmaking

    CloudWatch CPUUtilization on the new nodes ≈ 4%

    deployment annotation 3f9c2d1… = PR #1832, gameplay team

  5. 14:26
    Brake

    The gameplay team reverts the pull request. The 22 nodes drain.

  6. +24 h
    AWS

    Had it kept running, this is when AWS Cost Anomaly Detection would report it: “EC2 usage increased.” Root cause: service, account, region, usage type.

  7. Month end

    Left running, this was $811 a day at list price, about $24,300 a month. That is a run rate, not a saving: it was stopped the same afternoon, so the bill never shows it.

Cloudblame14:16 · #cloud-cost · finding #003Spike

22 × m6i.8xlarge launched for game-services/matchmaking in 4 minutes

Who
gameplay team · PR #1832 · deployment matchmaking
What
CPU requests 1 → 8 vCPU on 40 replicas; Karpenter added 22 nodes (704 vCPU)
Why
CPU on the new nodes averages 4%: the capacity was requested, not used
Run rate
$34/h at list price · $811/day
Brake · you run it · undo next to itgit revert <merge of PR #1832> # undo: merge it again
The brakes on the messageYou run them · each comes with its undo
Revert PR #1832git revert <merge of PR #1832>Undo: merge it again.
Cap the node pool at 400 vCPUkubectl patch nodepool general --type merge -p '{"spec":{"limits":{"cpu":"400"}}}'Undo: remove the limit.

eventID 9c4d…e1 · general-x7k2q · 3f9c2d1… · finding #003

+24 hEntry 03 · The two reports

What your provider says. What Cloudblame says.

AWS explains anomalies for free, and we read that first on every account. For a spike like this one it names the service and the usage type. What AWS’s own tools already list never counts toward our share.

Your provider’s own report · a day later

AWS Cost Anomaly Detection

  1. Service: Amazon EC2 – Compute
  2. Usage type: EUC1-BoxUsage:m6i.8xlarge
  3. Account: production
  4. Region: eu-central-1
  5. Stops here.

Cloudblame · the same hour

Finding #003

  1. CloudTrail RunInstances × 22 by karpenter-prod · eventID 9c4d…e1
  2. NodeClaims → pending pods in game-services/matchmaking: 40 × 8 vCPU requested
  3. CPU on the new nodes averages 4%: the capacity was requested, not used
  4. Deployment annotation 3f9c2d1… = PR #1832 “raise matchmaking requests”, gameplay team
  5. Fix: requests back to 1 vCPU, HPA at 70%. The diff and its undo are on the message.
Six links, one finding idHow far the chain goes depends on what your deploys write on the workload.
  1. Bill lineEC2 · +$34/h
  2. IAM principalkarpenter-prod
  3. NodeClaimgeneral-x7k2q
  4. Pending pods38 · game-services
  5. Deploy annotation3f9c2d1…
  6. PR and team#1832 · gameplay

AWS stops at the usage typeCloudblame keeps walking

eventID 9c4d…e1 · 3f9c2d1… · PR #1832

Month endEntry 04 · Read from the bill

A saving counts only when your bill shows it for a full month.

After a fix Cloudblame re-reads the line on your own AWS bill against a frozen baseline and unit price. The plan is a fixed monthly price; the success share is taken only on this number, for twelve months per fix.

Illustrative · a query storm on Athena

Before the fix1.90 TB/day
After the fix0.11 TB/day
What a statement compares: the daily quantity on one bill line before the fix and after it. Illustrative figures.
Statement · layoutEvery row is illustrative
FindingBaselineBilledFrom the bill
#005NAT → S3 gateway endpoint (payments) Illustrative2.1 TB/day0.3 TB/day$4,860
#007DynamoDB orders table, provisioned → on-demand Illustrative3,000 WCU640 WCU$2,180
#009CloudWatch Logs, debug level off in checkout Illustrative410 GB/day95 GB/day$1,240
Total in this layout$8,280
Bill on the Scale plan: $599 + success share $229 (10% above $5,990)$828
Every row here is illustrative. In a real statement each row carries the aws ce get-cost-and-usage command that prints the same figure in your own account.
Run a free cost scan Read the measurement annex

frozen baseline · your own unit price · 12 months per fix

Entry 05 · Coverage

AWS is where we start, not where we stop.

The method is the same on every bill: read usage, find the change that caused it, hand over a fix you can undo, check the result on the bill. Here is where it works today, what is next, and what is on the roadmap.

Live todayconnected

  • AWS
  • Kubernetes on EKS
  • Slack
  • E-mail
  • GitHub draft PRs

AWS through one read-only role; Kubernetes on EKS, optional and view only. Findings go out as a Slack message and an e-mail. Fixes arrive on GitHub as a draft pull request you merge yourself, Terraform first.

On the roadmapnot built

  • Google Cloud
  • Azure
  • Snowflake
  • OpenAI and Anthropic API spend
  • Vercel
  • MongoDB Atlas

The other bills a cloud team pays. Tell us what you pay for; we build in the order customers ask.

Tell us which bill hurts Every number on this page comes from one illustrative AWS scenario. We have no case on another provider, so we show none.

What we blame today, on AWS and Kubernetes

  • Query stormsAthena, Logs Insights · minutes Your provider seesservice and usage type Cloudblame addsthe workgroup, the query pattern, the role behind it, and a brake
  • Log bloatCloudWatch Logs · minutes Your provider seesusage type Cloudblame addsthe log group and the deploy that raised the level
  • NAT and data transferVPC · minutes Your provider seesan idle NAT Cloudblame addsthe workload and the missing VPC endpoint
  • Over-provisioned and forgotten resourcesEC2, EBS, RDS · same day Your provider seesthe list, for free Cloudblame addswho created it, when, and the change to remove it
  • Kubernetes idle requestsEKS · same day Your provider seesnode level Cloudblame addsnamespace, workload, owner, the requests to change
  • Lambda retry stormsLambda · minutes Your provider seesthe principal Cloudblame addsthe retry setting and the loop
  • Large launches outside normal hoursEC2 · minutes Your provider seesa day later Cloudblame addspriced in minutes, with a brake

NextNot built or not connected yet

  • CDN and egressCloudflare Cloudblame addsthe cache rule that sends bytes to origin
  • Observability billsDatadog Cloudblame addsthe deploy that added the cardinality
  • Alert rules and dashboardsGrafana Cloudblame addsthe rule or dashboard behind a query storm, and its owner
  • S3 access patterns and lifecycleAWS · no playbook yet Cloudblame addsthe requester and the lifecycle rule
  • AI spend on BedrockAWS · no playbook yet Cloudblame addsthe caller, the prompt growth, the model choice

7 playbooks live · 5 next

Entry 06 · Connect

One read-only role. Delete the stack and we are gone.

  1. 01

    Connect

    Launch one CloudFormation stack: a single read-only role with your external ID. About ten minutes, no agent, nothing installed in your cluster.

  2. 02

    Scan

    A free one-page answer: what AWS already explains, the largest lines it cannot, and a clear go or no-go.

  3. 03

    Investigate

    Named findings with their evidence ids and a fix you can undo. You run every change yourself: a command, a stack in your own account, or a draft pull request you merge.

  4. 04

    Read the bill

    After a full calendar month the line is read again on your own bill against the frozen baseline.

Run a free cost scan
CloudFormation · StacksCREATE_COMPLETE
cloudblame-readonlyabout a minute
KeyValueWhat it is
RoleArnarn:aws:iam::123456789012:role/CloudCostControlReadOnlyPaste into step 2 of the scan
KubernetesAccessnone (EksClusterNames empty)View access entries, only if you name a cluster
Parameters: ExternalId (generated in your browser) · EnableCurQueries = falseDelete the stack to revoke · the policy is published

What the role reads · one read-only role, published policy

  • CloudTrail · LookupEvents
  • CloudWatch · GetMetricData, ListMetrics
  • Cost Explorer · GetCostAndUsage, GetAnomalies
  • Cost Optimization Hub · ListRecommendations
  • EC2, EBS · Describe*
  • RDS, ElastiCache · Describe*
  • DynamoDB, Lambda · read configuration
  • CloudWatch Logs · DescribeLogGroups
  • EKS · DescribeCluster, ListNodegroups
  • Kubernetes API · optional, view only

Cloudblame has no write access to your cloud account. The one thing it can write is a pull request on a cloudblame/* branch in a repository you choose, opened as a draft where your GitHub plan allows it; it never merges.

Read policy.jsonRead the CloudFormation template

role CloudCostControlReadOnly · external ID · read-only

Entry 07 · Pricing

A fixed plan from $49. A capped share of what your bill proves.

The plan covers the audit, the findings and the fixes. On top of it we take 10% of verified savings above ten times the plan price, and never more than three times the plan price in a month. Verified means read from your own AWS bill for a full calendar month after the fix, net of anything the fix left behind.

  • From $49 a month
  • Share capped at 3× the plan
  • 12 months per fix, then $0
PlanPer monthMost you pay
StarterAWS spend up to $10k a month$49$196
Growth$10k to $50k a month$199$796
Scale$50k to $250k a month$599$2,396
Above $250k a monthtalk to us
  • Free: connecting an account and the first scan. No card.
  • Included in the plan: verified savings up to ten times its price.
  • Each fix counts for 12 months after its fix date, then $0.
  • Never counted: early signals, modelled figures, and what AWS’s own tools already list.
  • Paying yearly costs ten months.

Plans and the success share are measured on your AWS bill only.

Card payments will go through Paddle and are not open yet; until then a connected account is not charged.

$6,000
Plan
$199
Success share
$401
Your bill
$600

10% above 10× the plan · capped at 3× · 12 months per fix

Free scan · about ten minutes · read-only

Go from surprised by the bill to warned the same hour.

Run a free cost scan See a sample report