// Read-only AWS scans · weekly digest

Find the resources
no one is using.
Before finance
does.

Read-only scans across every AWS account and region. Each week, one email: what sits idle and what it costs you per month. The full report lives in the app.

EmailEmailSlackSlackMicrosoft TeamsTeams
30 free scans · no credit card · 5-minute setup
inbox · weekly digestMon 09:00
unusd.cloud<digest@unusd.cloud>to amelie@acme.io
Weekly scan · acme · $4,812/mo of waste detected
6 accounts · 14 regions · 51+ rules
Top findings this week$/month
EC2
working hours · 9
$1,240
EBS
unattached volumes · 37
$1,204
EC2
idle instances · 14
$968
SM
idle endpoints · 1
$480
RDS
stopped > 7d · 4
$312
NAT
low throughput · 2
$134
Open full report in appnext scan: Mon 09:00

Sample weekly digest. Delivered on your schedule, in your timezone.

read-only IAM · no agents · 51+ detection rules · every region · listed on AWS Marketplace
// How it works
01

Deploy a read-only role

CloudFormation, Terraform, or StackSets. You inspect the template first. Startup+ can register every account through the public API, including a large org.

02

We scan every region

30+ services, 51+ rules. Nothing changes in your account.

03

Digest, then the app

Weekly email you can forward. Full report in the app when you want the detail.

// Detections

51+ rules. Same input, same finding.

51+ fixed rules on standard AWS read-only APIs, across 30+ services and every region. Waste, idle, drift, RI/SP coverage, hygiene. The rules decide. You act.

// new rules ship monthly
Compute

Idle instances, office-hours EC2, and over-provisioned Lambda.

EC2 · SageMaker · Lambda
Storage

Volumes nobody attached, old snapshots, gp2 still billed as gp2.

EBS · Snapshots
Database & cache

RDS busy only on weekdays, silent ElastiCache, unused DynamoDB.

RDS · ElastiCache · DynamoDB
Networking

NAT with no traffic, unused load balancers, idle VPC endpoints.

NAT · ELB · VPC
Operations

Log groups that never expire, unused secrets, stale images.

CloudWatch · Secrets · ECR

Also: Graviton candidates, Cost Optimization Hub, extended support surcharges. The full list is in the dashboard after you connect.

ebs/unattached-volumeone rule, in full
match
EBS volume in state available (attached to nothing)
price
size x GB-month rate from the AWS Pricing API, per region and volume type
skip
volumes carrying your whitelist tag
clears
when a later complete scan no longer sees it
// Delivery

Digest in your inbox.
Full web report in the app.

One weekly email you can forward, on every plan. Slack or Teams alerts when a scan lands. Trends, drill-downs, and realized savings live in the app.

cost optimization reportscan #3f7a
Working hours
3 resources · busy Mon-Fri 08-18
if stopped
$349
EC2
dev-bastion
$48/mo
EC2
jenkins
$91/mo
RDS
analytics-dev
$210/mo

Trends, accounts, and regions on the same findings as the email. Realized savings are findings that cleared, not a guess.

Enterprise can also publish findings to SNS as JSON for automation, ITSM, or archive.

// navi · business

An agent over your scans and web report.

The AI layer on top of your deterministic scans. Ask what costs the most, what changed, or for a message to the owner. On Business and Enterprise, off until you enable it in Settings.

  • Grounded in your scan findings and the in-app report, not the open web
  • Threaded chats. Memory is opt-in.
  • We do not use your prompts or scan data to train models. Nothing runs in AWS without you.
Navi
acme · 6 connected accounts
online
Y
What's costing me the most this week and why?
N
Your top 3 cost drivers (week 16):
m5.4xlarge i-0a1b2…
$612/mo
acme-prod / eu-west-1
3% CPU · idle 10d
18 unattached gp3
$498/mo
acme-staging
last attached > 30d
2 NAT gateways
$134/mo
acme-dev
< 1MB egress/day
Source: scan 3f7a · cited rules: ec2/idle-instance, ebs/unattached-volume, nat/low-throughput
Y
Draft a Slack message I can send to the staging owner
N
draft · for #platform
hey @amelie - heads up: 18 unattached gp3 volumes in acme-staging eu-west-1 are costing us ~$498/mo. last attached > 30 days. safe to delete?
details: app.unusd.cloud/scan/3f7a
Ask Navi about your AWS bill…
Top 5 savingsEC2 cost trendCompare prod vs stagingWhat changed this week?
// Security

Boring on purpose.

hub-and-spoke
We never hold credentials. You deploy a role in your account, we sts:AssumeRole with a customer-unique ExternalId.
read-only
SecurityAudit + a small inline policy of standard, read-only AWS API calls. Inspectable in CloudFormation or Terraform before you deploy.
finding identity
We store resource IDs, ARNs, and whether a finding is still open, so we can report what cleared. We do not keep a second copy of your inventory. AES-256 at rest, TLS in transit.
no agents
No daemons in your VPC. Nothing to patch, nothing to break, no maintenance window.
public API
Startup+ can register and configure AWS accounts over HTTPS, including a large org. You can also trigger a scan and poll its status. We store an HMAC of the key, never the secret. Keys expire.

Full security pack · DPA, subprocessors, deletion, operator.

unusd-spoke-role.ymlCloudFormation · excerpt
AssumeRolePolicyDocument:
  Statement:
    - Effect: Allow
      Principal:
        AWS: "arn:aws:iam::<unusd-hub>:role/scanner"
      Action: sts:AssumeRole
      Condition:
        StringEquals:
          sts:ExternalId: "<your-customer-id>"

ManagedPolicyArns:
  - arn:aws:iam::aws:policy/SecurityAudit

Policies:
  - PolicyName: unusd-cost-readonly
    PolicyDocument:
      Statement:
        - Effect: Allow
          Action:
            - ce:GetCostAndUsage
            - ce:GetCostForecast
            - cloudwatch:GetMetricData
            - cost-optimization-hub:ListRecommendations
            - pricing:GetProducts
          Resource: "*"
full template · CloudFormation, Terraform, StackSets

Why SecurityAudit? SecurityAudit is the read-only baseline AWS maintains for auditors: Describe, List, and Get on resource configuration. AWS keeps it current as services ship, so new rules rarely need a role update. It does not grant reading S3 object contents or secret values. A small inline policy adds the read-only calls it lacks, such as Cost Explorer, CloudWatch metrics, Cost Optimization Hub, and Pricing.

// Pricing

Priced by what you scan. Not per account.

One forgotten m5.4xlarge costs more each month than the Startup plan.

// billed annually · AWS Marketplace
Individual
$0/mo
resources / week
30 free scans
accounts
1
Navi
-
drift
-
notify
EmailEmail
Start free
Startup
$149/mo
resources / week
~3,50015,000 credits
accounts
unlimited
Navi
-
drift
notify
EmailSlackEmail · Slack
Marketplace
Businessmost teams
$500/mo
resources / week
~12,00050,000 credits
accounts
unlimited
Navi
Navi
drift
notify
EmailSlackMicrosoft TeamsEmail · Slack · Teams
Marketplace
Enterprise
$1,000/mo
resources / week
~25,000100,000 credits
accounts
unlimited
Navi
Navi
drift
notify
EmailSlackMicrosoft TeamsSNSTelegramEmail · Slack · Teams · SNS · Telegram
Marketplace

1 credit is 1 resource on one scan. Credits pool across every account you connect. Unlimited accounts from Startup. On a weekly schedule, Startup (15,000 credits) covers about 3,500 resources, Business (50,000) about 12,000, Enterprise (100,000) about 25,000. Daily scans use more credits. Prices are monthly, billed annually. Individual is 30 free scans on one account, no card. AWS Marketplace is how procurement pays.

Need a private offer, NDA, or invoicing terms?Talk to us →
// FAQ

Answers for security, FinOps, and AI.

Quick facts for procurement, platform teams, and anyone evaluating read-only AWS cost tooling.

Is unusd.cloud read-only on AWS?+

Yes. We use standard AWS read-only APIs and a read-only IAM role you deploy. Nothing is changed in your accounts unless you act on findings yourself.

Why does the role use the SecurityAudit policy?+

SecurityAudit is the read-only baseline AWS maintains for auditors: Describe, List, and Get on resource configuration. AWS keeps it current as services ship, so new rules rarely need a role update. It does not grant reading S3 object contents or secret values. A small inline policy adds the read-only calls it lacks, such as Cost Explorer, CloudWatch metrics, Cost Optimization Hub, and Pricing.

What AWS services and regions do you scan?+

We run deterministic rules across 30+ services and every enabled region (51+ detection types). After you connect an account, the dashboard lists every check that ran.

Can I scan more than one AWS account?+

Yes. Connect an Organization or as many accounts as you need. Individual is one account. Startup and above are unlimited accounts, billed by credits, not by account count. Register them in the app or through the public API. The API is how you onboard a large org in one pass. The read-only IAM role still deploys per account (CloudFormation, Terraform, or StackSets).

How does pricing work?+

1 credit is 1 resource on one scan. Credits pool across every account you connect. Unlimited accounts from Startup. On a weekly schedule, Startup (15,000 credits) covers about 3,500 resources, Business (50,000) about 12,000, Enterprise (100,000) about 25,000. Daily scans use more credits. Prices are monthly, billed annually. Individual is 30 free scans on one account, no card. AWS Marketplace is how procurement pays.

What do I get in email vs the app?+

Email carries a concise weekly digest you can forward. Slack and Teams get scan alerts, including how many findings cleared since the last complete scan. The full web report, trends, and drill-downs live in the dashboard. Navi, on Business, sits on that report. On Enterprise, the executive digest can also post to a Telegram Channel. Trends follow each unused AWS resource over time. Realized savings are findings that actually cleared.

Can I add AWS accounts from an API?+

Yes on Startup and above. Admins mint an expiring API key in Team settings. The public API creates, updates, and removes AWS accounts, including schedule, notifications, and tags. You can also trigger a scan and poll its status. A script of PUT calls is enough for a hundred accounts. The read-only IAM role is still deployed in each AWS account. Individual stays on the dashboard.

How do you know a finding was fixed?+

A later complete scan no longer sees it. Delete it, attach it, or whitelist it: same signal. The dashboard calls that cleared. Incomplete scans do not mark missing regions as cleared.

How is Navi different from a generic chatbot?+

Navi is on Business and Enterprise, off until you enable it in Settings. It is grounded in your scan results and in-app report context, not open-web search. Optional memory is opt-in. On Enterprise, a Settings note covers org facts the scan cannot see.

Are my prompts or scan data used to train AI models?+

We do not use your prompts or scan data to train models. Navi is off until you enable it. Then it sends scan-grounded context to OpenAI, whose API terms state that API data is not used to train their models. What we store, subprocessors, deletion, and how to request a DPA: unusd.cloud/security.

// get started

Connect an AWS account.
First scan runs right away.

Deploy the read-only role in one click. The scan starts as soon as the role is in place, and the digest follows by email.

30 free scans · no credit card · 5-minute setup