Find the resources
no one is using.
Before finance
does.
Read-only scans across every AWS account and region. Each week, one email: what sits idle and what it costs you per month. The full report lives in the app.
Sample weekly digest. Delivered on your schedule, in your timezone.
Deploy a read-only role
CloudFormation, Terraform, or StackSets. You inspect the template first. Startup+ can register every account through the public API, including a large org.
We scan every region
30+ services, 51+ rules. Nothing changes in your account.
Digest, then the app
Weekly email you can forward. Full report in the app when you want the detail.
51+ rules. Same input, same finding.
51+ fixed rules on standard AWS read-only APIs, across 30+ services and every region. Waste, idle, drift, RI/SP coverage, hygiene. The rules decide. You act.
Idle instances, office-hours EC2, and over-provisioned Lambda.
EC2 · SageMaker · LambdaVolumes nobody attached, old snapshots, gp2 still billed as gp2.
EBS · SnapshotsRDS busy only on weekdays, silent ElastiCache, unused DynamoDB.
RDS · ElastiCache · DynamoDBNAT with no traffic, unused load balancers, idle VPC endpoints.
NAT · ELB · VPCLog groups that never expire, unused secrets, stale images.
CloudWatch · Secrets · ECRAlso: Graviton candidates, Cost Optimization Hub, extended support surcharges. The full list is in the dashboard after you connect.
- match
- EBS volume in state available (attached to nothing)
- price
- size x GB-month rate from the AWS Pricing API, per region and volume type
- skip
- volumes carrying your whitelist tag
- clears
- when a later complete scan no longer sees it
Digest in your inbox.
Full web report in the app.
One weekly email you can forward, on every plan. Slack or Teams alerts when a scan lands. Trends, drill-downs, and realized savings live in the app.
Trends, accounts, and regions on the same findings as the email. Realized savings are findings that cleared, not a guess.
Enterprise can also publish findings to SNS as JSON for automation, ITSM, or archive.
An agent over your scans and web report.
The AI layer on top of your deterministic scans. Ask what costs the most, what changed, or for a message to the owner. On Business and Enterprise, off until you enable it in Settings.
- ▸Grounded in your scan findings and the in-app report, not the open web
- ▸Threaded chats. Memory is opt-in.
- ▸We do not use your prompts or scan data to train models. Nothing runs in AWS without you.
| Resource | Account / region | Monthly cost | Reason |
|---|---|---|---|
| m5.4xlarge i-0a1b2… | acme-prod / eu-west-1 | $612/mo | 3% CPU · idle 10d |
| 18 unattached gp3 | acme-staging | $498/mo | last attached > 30d |
| 2 NAT gateways | acme-dev | $134/mo | < 1MB egress/day |
details: app.unusd.cloud/scan/3f7a
Boring on purpose.
Full security pack · DPA, subprocessors, deletion, operator.
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
AWS: "arn:aws:iam::<unusd-hub>:role/scanner"
Action: sts:AssumeRole
Condition:
StringEquals:
sts:ExternalId: "<your-customer-id>"
ManagedPolicyArns:
- arn:aws:iam::aws:policy/SecurityAudit
Policies:
- PolicyName: unusd-cost-readonly
PolicyDocument:
Statement:
- Effect: Allow
Action:
- ce:GetCostAndUsage
- ce:GetCostForecast
- cloudwatch:GetMetricData
- cost-optimization-hub:ListRecommendations
- pricing:GetProducts
Resource: "*"Why SecurityAudit? SecurityAudit is the read-only baseline AWS maintains for auditors: Describe, List, and Get on resource configuration. AWS keeps it current as services ship, so new rules rarely need a role update. It does not grant reading S3 object contents or secret values. A small inline policy adds the read-only calls it lacks, such as Cost Explorer, CloudWatch metrics, Cost Optimization Hub, and Pricing.
Priced by what you scan. Not per account.
One forgotten m5.4xlarge costs more each month than the Startup plan.
- resources / week
- ~3,50015,000 credits
- accounts
- unlimited
- Navi
- -
- drift
- ●
- resources / week
- ~12,00050,000 credits
- accounts
- unlimited
- Navi
- Navi
- drift
- ●
- resources / week
- ~25,000100,000 credits
- accounts
- unlimited
- Navi
- Navi
- drift
- ●
1 credit is 1 resource on one scan. Credits pool across every account you connect. Unlimited accounts from Startup. On a weekly schedule, Startup (15,000 credits) covers about 3,500 resources, Business (50,000) about 12,000, Enterprise (100,000) about 25,000. Daily scans use more credits. Prices are monthly, billed annually. Individual is 30 free scans on one account, no card. AWS Marketplace is how procurement pays.
Answers for security, FinOps, and AI.
Quick facts for procurement, platform teams, and anyone evaluating read-only AWS cost tooling.
Is unusd.cloud read-only on AWS?+
Yes. We use standard AWS read-only APIs and a read-only IAM role you deploy. Nothing is changed in your accounts unless you act on findings yourself.
Why does the role use the SecurityAudit policy?+
SecurityAudit is the read-only baseline AWS maintains for auditors: Describe, List, and Get on resource configuration. AWS keeps it current as services ship, so new rules rarely need a role update. It does not grant reading S3 object contents or secret values. A small inline policy adds the read-only calls it lacks, such as Cost Explorer, CloudWatch metrics, Cost Optimization Hub, and Pricing.
What AWS services and regions do you scan?+
We run deterministic rules across 30+ services and every enabled region (51+ detection types). After you connect an account, the dashboard lists every check that ran.
Can I scan more than one AWS account?+
Yes. Connect an Organization or as many accounts as you need. Individual is one account. Startup and above are unlimited accounts, billed by credits, not by account count. Register them in the app or through the public API. The API is how you onboard a large org in one pass. The read-only IAM role still deploys per account (CloudFormation, Terraform, or StackSets).
How does pricing work?+
1 credit is 1 resource on one scan. Credits pool across every account you connect. Unlimited accounts from Startup. On a weekly schedule, Startup (15,000 credits) covers about 3,500 resources, Business (50,000) about 12,000, Enterprise (100,000) about 25,000. Daily scans use more credits. Prices are monthly, billed annually. Individual is 30 free scans on one account, no card. AWS Marketplace is how procurement pays.
What do I get in email vs the app?+
Email carries a concise weekly digest you can forward. Slack and Teams get scan alerts, including how many findings cleared since the last complete scan. The full web report, trends, and drill-downs live in the dashboard. Navi, on Business, sits on that report. On Enterprise, the executive digest can also post to a Telegram Channel. Trends follow each unused AWS resource over time. Realized savings are findings that actually cleared.
Can I add AWS accounts from an API?+
Yes on Startup and above. Admins mint an expiring API key in Team settings. The public API creates, updates, and removes AWS accounts, including schedule, notifications, and tags. You can also trigger a scan and poll its status. A script of PUT calls is enough for a hundred accounts. The read-only IAM role is still deployed in each AWS account. Individual stays on the dashboard.
How do you know a finding was fixed?+
A later complete scan no longer sees it. Delete it, attach it, or whitelist it: same signal. The dashboard calls that cleared. Incomplete scans do not mark missing regions as cleared.
How is Navi different from a generic chatbot?+
Navi is on Business and Enterprise, off until you enable it in Settings. It is grounded in your scan results and in-app report context, not open-web search. Optional memory is opt-in. On Enterprise, a Settings note covers org facts the scan cannot see.
Are my prompts or scan data used to train AI models?+
We do not use your prompts or scan data to train models. Navi is off until you enable it. Then it sends scan-grounded context to OpenAI, whose API terms state that API data is not used to train their models. What we store, subprocessors, deletion, and how to request a DPA: unusd.cloud/security.
Connect an AWS account.
First scan runs right away.
Deploy the read-only role in one click. The scan starts as soon as the role is in place, and the digest follows by email.
30 free scans · no credit card · 5-minute setup