Cost control software for every cloud bill · live today on every AWS service and Kubernetes
Your bill tells you a day late. Cloudblame names the cause the same hour.
Cloudblame prices a cost spike within minutes and names the change behind it: the deploy, alert rule or setting, and the team that owns it. It shows a fix you run and can undo, and reads the result from your own bill.
A self-serve web app: sign up, connect AWS with one read-only CloudFormation role, and Cloudblame reads your bill every day and your account’s changes every five minutes. Findings arrive in your console, Slack and email.
Connects in about ten minutes: one CloudFormation stack, one read-only role with your external ID. No agent, nothing installed in your cluster.
The red line on the left is one scenario, from 14:02 to 14:26. Scroll and the page follows it to the month-end bill.The red line under the menu follows the page: one scenario from 14:02 to 14:26, then the product.
Reads today: every AWS service on your bill, and Kubernetes, through one read-only role. Writes nothing to your cloud account.Not only on AWS? See what is next
PR #1832 · finding #003 · illustrative scenario
14:02 – 14:26Example · one cost spike
Illustrative scenarioFictional identitiesRun rates at list price
22 nodes in four minutes. Priced in ten. Named the same hour.
A pull request raised CPU requests from 1 to 8 vCPU on 40 replicas, and Karpenter added 22 nodes in four minutes. Had it been left running, AWS would have reported it the next day as “EC2 usage increased”. Cloudblame priced the launch at 14:12 and named the pull request, the team and a one-line fix.
In this scenario the investigation starts the moment the alert fires. On a connected account, account changes are read every five minutes, and an event that stays open for 30 minutes is queued for an investigation.
- 14:02cost starts
In this example, a pull request merges
PR #1832 merged: matchmaking CPU requests 1 → 8 vCPU on 40 replicas. The deploy rolls out.
PR #1832 · deployment game-services/matchmaking replicas: 40-resources.requests.cpu: "1"+resources.requests.cpu: "8"14:03320 vCPU requested, 38 pods pending. Karpenter starts launching nodes.
- 14:12priced Cloudblame Detect
Cloudblame prices the launch
Cloudblame alert: 22 × m6i.8xlarge launched by Karpenter in four minutes, about $34 an hour at list price.
Evidence · 2 ids
- CloudTrail RunInstances ×22 · role/karpenter-prod · eventID 9c4d…e1
- NodeClaim general-x7k2q → pending pods game-services/matchmaking
- 14:16named Cloudblame Attribute
The message names the change and its owner
The message: who, what, why, and a brake with its undo. Revert the pull request, or cap the node pool.
Cloudblame14:16 · #cloud-cost · finding #003Spike22 × m6i.8xlarge launched for game-services/matchmaking in 4 minutes
- Who
- gameplay team · PR #1832 · deployment matchmaking
- What
- CPU requests 1 → 8 vCPU on 40 replicas; Karpenter added 22 nodes (704 vCPU)
- Why
- CPU on the new nodes averages 4%: the capacity was requested, not used
- Run rate
- $34/h at list price · $811/day
Brake · you run it · undo next to itgit revert <merge of PR #1832> # undo: merge it againEvidence · 3 ids
- requests.cpu = 8 on deployment game-services/matchmaking
- CloudWatch CPUUtilization on the new nodes ≈ 4%
- deployment annotation 3f9c2d1… = PR #1832, gameplay team
- 14:26stopped Brake
The team runs the brake
The gameplay team reverts the pull request. The 22 nodes drain.
The brakes on the messageYou run them · each comes with its undoRevert PR #1832git revert <merge of PR #1832>Undo: merge it again.Cap the node pool at 400 vCPUkubectl patch nodepool general --type merge -p '{"spec":{"limits":{"cpu":"400"}}}'Undo: remove the limit.
eventID 9c4d…e1 · general-x7k2q · 3f9c2d1… · finding #003
+24 hThe two reports
What your provider says. What Cloudblame says.
AWS explains anomalies for free, and Cloudblame reads that first on every account. For a spike like this one it names the service and the usage type.
Your provider’s own report · a day later
AWS Cost Anomaly Detection
- Service: Amazon EC2 – Compute
- Usage type: EUC1-BoxUsage:m6i.8xlarge
- Account: production
- Region: eu-central-1
- Stops here.
Cloudblame · the same hour
Finding #003
- CloudTrail RunInstances × 22 by karpenter-prod · eventID 9c4d…e1
- NodeClaims → pending pods in game-services/matchmaking: 40 × 8 vCPU requested
- CPU on the new nodes averages 4%: the capacity was requested, not used
- Deployment annotation 3f9c2d1… = PR #1832 “raise matchmaking requests”, gameplay team
- Fix: requests back to 1 vCPU, HPA at 70%. The diff and its undo are on the message.
- Bill lineEC2 · +$34/h
- IAM principalkarpenter-prod
- NodeClaimgeneral-x7k2q
- Pending pods38 · game-services
- Deploy annotation3f9c2d1…
- PR and team#1832 · gameplay
AWS stops at the usage typeCloudblame keeps walking
eventID 9c4d…e1 · 3f9c2d1… · PR #1832
Month endRead from the bill
At month end the bill shows 24 minutes, not a month.
Cloudblame reads the same line on your own AWS bill. In this scenario the EC2 line carries about 9 extra node-hours on the day of the pull request, about $14 at list price, and is back on its baseline the next day. A stopped spike is a cost you did not keep paying. It is not a saving.
Illustrative · the scenario’s EC2 line · m6i.8xlarge node-hours a day
A saving is something else: a fix to spend that was already running.
After such a fix Cloudblame re-reads the line against a frozen baseline and unit price, and the console shows a verified saving only when your bill shows it for a full calendar month.
| Finding | Baseline | Billed | From the bill |
|---|---|---|---|
| #005NAT → S3 gateway endpoint (payments) Illustrative | 2.1 TB/day | 0.3 TB/day | $4,860 |
| #007DynamoDB orders table, provisioned → on-demand Illustrative | 3,000 WCU | 640 WCU | $2,180 |
| #009CloudWatch Logs, debug level off in checkout Illustrative | 410 GB/day | 95 GB/day | $1,240 |
| Total in this layout | $8,280 | ||
frozen baseline · your own unit price · a full calendar month
Coverage
Cloudblame reads every line of your bill, down to the resource behind it.
Your provider stops at the service and the usage type. Cloudblame keeps going: the resource that bills, the change that started it, the team that owns it, and a fix you run yourself.
- 01 Bill line
EBS:VolumeUsage.gp3 rose 40% in MarchRead from Cost Explorer, every line, every day - 02 Resource
14 unattached gp3 volumes, 1.4 TiB, no I/O for 30 daysRead through your read-only role - 03 Change and owner
Created by deploy-ci on 12 March · payments teamFrom CloudTrail and your tags - 04 Fix you run
One stack in your account: snapshot, then deleteUndo from the snapshot · the result is read from your bill
Where Cloudblame reads down to the resource today
Compute
- EC2 idle and oversized instances, large launches priced as they happen within minutes
- ECS and Fargate forgotten services, oversized tasks, Spot-ready workloads
- Lambda retry loops, idle provisioned concurrency within minutes
- EKS idle pod requests and the nodes they hold
Data and storage
- RDS and Aurora idle databases, Multi-AZ on dev, snapshots of deleted databases
- ElastiCache oversized nodes, replicas nobody reads
- DynamoDB provisioned capacity nobody consumes
- S3 old versions, unfinished uploads, missing lifecycle rules one-click fix
- EBS unattached volumes, orphaned snapshots one-click fix
Network
- NAT and data transfer cross-zone routes, missing gateway endpoints within minutes
- Load balancers no healthy target for 14 days
Observability
- CloudWatch Logs debug floods, logs kept forever within minutes
- Athena query storms and the dashboard behind them within minutes
Beyond AWS
Nextnot connected yet Cloudflare · Datadog · Grafana alert rules · Argo CD · Cost and Usage Report via Athena
On the roadmapnot built Google Cloud · Azure · Snowflake · OpenAI and Anthropic API spend · Vercel · MongoDB Atlas
Tell us which bill hurts15 waste patterns live, each priced from your bill
Connect
One read-only role. Delete the stack and access ends.
- 01
Connect
Launch one CloudFormation stack: a single read-only role with your external ID. About ten minutes, no agent, nothing installed in your cluster.
- 02
Scan
A free report, generated in a few minutes: what AWS already explains, the largest lines it cannot, and whether there is enough for an investigation to work on.
- 03
Investigate
Cloudblame’s investigation engine traces a cost change through CloudTrail, CloudWatch and your bill; the console shows the finding with its evidence ids and a fix you can undo. You run every change yourself: a command, a stack in your own account, or a draft pull request you merge.
- 04
Read the bill
After a full calendar month the line is read again on your own bill against the frozen baseline.
| Key | Value | What it is |
|---|---|---|
| RoleArn | arn:aws:iam::123456789012:role/CloudCostControlReadOnly | Paste into step 2 of the scan |
| KubernetesAccess | none (EksClusterNames empty) | View access entries, only if you name a cluster |
What the role reads · one read-only role, published policy
- CloudTrail · LookupEvents
- CloudWatch · GetMetricData, ListMetrics
- Cost Explorer · GetCostAndUsage, GetAnomalies
- Cost Optimization Hub · ListRecommendations
- EC2, EBS · Describe*
- RDS, ElastiCache · Describe*
- DynamoDB, Lambda · read configuration
- CloudWatch Logs · DescribeLogGroups
- EKS · DescribeCluster, ListNodegroups
- Kubernetes API · optional, view only
Cloudblame has no write access to your cloud account. The one thing it can write is a pull request on a cloudblame/* branch in a repository you choose, opened as a draft where your GitHub plan allows it; it never merges.
role CloudCostControlReadOnly · external ID · read-only
Pricing
Subscription plans from $49 a month. Free to connect.
Cloudblame is a monthly or yearly subscription, priced by the monthly AWS spend of the accounts you connect. Everything is delivered by the software, in your console and its alerts: there are no consultants, calls or hand-written reports.
- From $49 a month
- Monthly or yearly
- Free tier, no card
| Plan | Per month | Per year |
|---|---|---|
| StarterAWS spend up to $10k a month1 connected AWS account | $49 | $490 |
| Growth$10k to $50k a monthup to 5 connected AWS accounts | $199 | $1,990 |
| Scale$50k to $250k a monthup to 20 connected AWS accounts | $599 | $5,990 |
- Free tier: connecting an account, the free cost scan and the bill map. No card.
- Paying yearly costs ten months.
- Choose a plan, or cancel it, any time in the console.
- AWS spend above $250k a month: email hello@cloudblame.com for a larger plan.
Success share
On top of the plan, the console computes one savings-based fee, the success share, from your monthly statement: 10% of the verified savings from Cloudblame’s fixes above ten times the plan price, never more than three times the plan price in a month. A saving is verified only after your own AWS bill shows it for a full calendar month; each fix counts for 12 months, and early signals, modelled figures and what AWS’s own tools already list never count. How savings are measured
Card payments go through Paddle, the merchant of record, monthly or yearly; nothing is charged until you choose a plan.
Any plan payment is refunded in full on request within 14 days: refund policy.
Every plan includes
- The web console: bill map, findings and verified savings
- A daily read of every line on your AWS bill
- Account changes read every five minutes
- Investigations of your cost changes by Cloudblame’s engine, with evidence ids
- Alerts in Slack and email
- Generated fixes you run yourself, or a GitHub draft pull request you merge
- Read-only access through one CloudFormation role
No card. Choose a plan later in the console.
monthly or yearly · cancel in the console · 14-day refund
Free scan · about ten minutes · read-only