AWS cost optimization for engineering and finance teams.
Find out why your AWS bill grew, and what to cut. Omni FinOps reads Cost Explorer, your inventory and CloudWatch CPU through a read-only IAM role. It explains every jump in plain dollars and lists the waste, each lead with the AWS CLI command your team runs.
No card. Read-only access. Omni FinOps never changes your cloud.
In this example AWS account, Omni FinOps found 5 savings leads worth $584/mo, ranked by dollars. Each one names the resource, why it was flagged and the AWS CLI command to fix it.
- db-reporting$350/modb.r5.2xlarge, peak CPU 18% for two weeks: rightsize to db.r5.xlarge
- i-0a41f9c2e7b3$140/mom5.2xlarge, peak CPU 22% for two weeks: rightsize to m5.xlarge
- vol-07c2d81a5e$50/mo500 GiB gp2, attached to nothing: snapshot, then delete
- snap-0e5d2a7f31$40/mo800 GiB, 312 days old, backs no AMI: delete
- eipalloc-0c19b4e2$3.65/moElastic IP, attached to nothing: release
What it finds in AWS
Every refresh checks each resource against these rules. A match becomes a lead with its monthly saving, the evidence behind it and the command to fix it. Nothing changes until your team runs it.
- Idle instancesCPU under 5% every day for two weeks. Stop it, or delete it if nothing needs it.Guide
- Oversized instances and databasesPeak CPU under 40% for two weeks. Move to the next size down.Guide
- Dev and staging running 24/7Tagged dev, test, staging, QA or sandbox and running around the clock. Run it weekdays 08:00–20:00 only.Guide
- x86 instances with a cheaper Graviton twinThe same vCPU and memory costs less on arm64. Rebuild the image for arm64, then move.Guide
- Unattached volumes and disksAttached to no instance. Delete it, after a snapshot if anyone might need it.Guide
- gp2 volumesAny EBS volume still on gp2. Migrate it to gp3, online.Guide
- Old snapshotsOlder than 180 days and backing no image. Delete it once no backup plan needs it.Guide
- Unused AMIsNo instance or launch template uses it. Deregister it and delete its snapshots.Guide
- Unused public IPsReserved, but attached to nothing. Release it.Guide
- Steady compute with no commitmentOn-demand EC2 and Fargate spend with a steady floor over 60 days. Buy a 1-year Compute Savings Plan at 80% of that floor.Guide
How connecting AWS works
One CloudFormation stack creates a read-only IAM role that trusts only your company’s External ID. Omni FinOps assumes it for an hour at a time, and only to read.
- 1Enter your AWS account ID. In Cloud accounts, add AWS and type the 12-digit ID of the account to read. A management account covers its members; connect one or the other, not both.
- 2Create the role in one click. Omni FinOps opens CloudFormation with the omni-finops-readers template filled in. Press Create stack. Prefer the terminal? Download the template and deploy it with the AWS CLI.
- 3The first refresh reads the bill. Up to 14 months of daily cost from Cost Explorer, your inventory in every region, 30 days of CloudWatch CPU and AWS list prices. Leads and anomalies appear as soon as it finishes.
Cost Explorer must be on in the account: open Billing → Cost Explorer once if it’s new. Each refresh makes a few Cost Explorer calls, which AWS bills at $0.01 each.
Can read
- Daily cost and usage, from Cost Explorer
- Inventory: EC2 instances, volumes, snapshots, public IPs, NAT gateways, images and RDS
- CPU metrics, from CloudWatch
Can’t
- Start, stop, change or delete anything
- Read files in S3 or rows in your databases
- See secrets, keys or passwords
- Connect without your External ID
Delete its CloudFormation stack and access ends.
Questions about AWS
- Can Omni FinOps change anything in my AWS account?
- No. The role can read cost, inventory and CPU metrics, and has no permission to start, stop, change or delete anything. Every lead comes with the AWS CLI command for your team to run with its own credentials.
- How much history does it read?
- Up to 14 months of daily cost from Cost Explorer on the first refresh, then the last 7 days on each refresh after that. CPU comes from the last 30 days of CloudWatch.
- Which AWS services does it cover?
- Cost covers every service on your bill, because it comes from Cost Explorer. The waste rules check EC2 instances, EBS volumes and snapshots, AMIs, public IPv4 addresses and RDS today, plus a Compute Savings Plan sized to your steady usage.
- Does it cost anything on the AWS side?
- A little. Each refresh makes a few Cost Explorer API calls, and AWS bills them at $0.01 each to the connected account.
- Can I connect an AWS Organization?
- Yes: connect the management account, or its member accounts one by one, but not both, so no cost is counted twice.
- How do I revoke access?
- Delete the omni-finops-readers CloudFormation stack. The role goes with it, and Omni FinOps can no longer read anything.
Get the AWS bill back under control this week.
No card. Read-only access. Omni FinOps never changes your cloud.