How a Kostrix AWS cost audit works
- Access
- Read-only; 334 granted actions, no mutating call
- Regions
- Every enabled region, unless pinned
- Checks
- 235, each with its rule identifier
- Window
- Trailing 30 days, run rate
- Prices
- AWS Price List API, per region
- Coverage
- Savings Plans in spend, reservations in hours
From a work e-mail to a priced list of decisions
Only the first step asks anything of you before the scan; only the last asks anything after it.
- 01
Create an account and link an AWS account read-only
A work e-mail and a password; no AWS account id is typed in. On the next page you deploy the published CloudFormation stack (kostrix-scan-policy.yaml) in your own account, as a cross-account role with no keys stored or as a read-only access key, and Kostrix calls sts:GetCallerIdentity to record the account AWS itself reports.
- 02
Every enabled region is scanned
Not a default list and not the regions that happen to be cheap to query: every region enabled on the account, unless you pin the list yourself. Resources are described where they sit, so a volume in ap-south-1 or a NAT gateway in eu-west-3 is found where it is billed.
- 03
235 named checks run over a trailing 30-day window
Each check is a rule with an identifier it stamps on every finding it raises, across 15 service families: storage, compute, networking, databases, analytics, serverless, machine learning, security, observability and more. Monthly figures are a trailing 30-day run rate, never a partial month scaled up.
- 04
Every finding is priced from the AWS Price List API
Counts and sizes come from the account, the rate from the Price List API for that region and product, and every term is printed beside the result: multiply them and you land exactly on the saving shown. Where a rate cannot be fetched the finding is still raised, without a figure, because Kostrix never guesses a price.
- 05
The findings are reconciled against your bill
Kostrix walks the billed line items and marks the ones no rule touched. That uncovered list sits on screen beside the savings total, so a service the scanner has never examined cannot pass itself off as one it examined and cleared.
- 06
Savings Plans and reserved-instance coverage are measured separately
Savings Plans coverage as a share of eligible spend, reserved-instance coverage as a share of eligible hours, expiry cliffs as the scheduled cost increases they are, and a purchase recommendation sized at 80 percent of the uncovered amount so a quiet week does not leave you holding hours you never use.
- 07
You act; Kostrix never does
Findings pool by the action they require, so 2,113 unattached volumes arrive as one priced decision rather than 2,113 rows. You make the change in your own console with your own audit trail, and the next scan records what happened. Reports export, findings keep their history, and one month can be compared with the last.
An AWS cost audit is only as honest as its uncovered list
A scanner only knows what its rules know. The question a finance team should ask of any AWS cost review is not how much it found but what it did not look at, and most tools cannot answer. Kostrix answers it on the first screen: on WhizzyGeeks' own account, 18 of 34 billed line items had no rule covering them, and those 18 are printed beside the savings.
Read this list first
- Billed line items
- 34
- Covered by a rule
- 16
- Not yet covered
- 18
The other half of the bill: what is not under commitment
Idle resources are only half of an AWS bill. The other half is steady-state usage paying On-Demand rates because nobody sized a commitment for it. Kostrix measures both instruments and keeps their units apart.
- Savings Plans coverage and utilizationshare of eligible SPEND
- How much of your Savings-Plan-eligible compute and database spend over the trailing thirty days is already covered, how much is still paying On-Demand, and how much of what you have committed to is actually being used. Spend, never a blended percentage, because a Savings Plan is bought in dollars per hour.
- Reserved instance coverage and utilizationshare of eligible HOURS
- The same two questions for reservations across EC2, RDS, ElastiCache, Redshift, OpenSearch and MemoryDB - measured in hours, because that is the unit reservations are bought in, and reported separately from Savings Plans because the remedy is a different purchase.
- Expiry cliffsscheduled cost increases
- Reservations and Savings Plans whose term ends while the workload they cover is still running. This is a forecastable increase in next month's bill, not a saving, and it is deliberately kept out of the savings total.
- Sized purchase recommendationsone per instrument
- A Compute Savings Plan for SP-eligible compute and a Reserved Instance recommendation for RDS and Redshift, each sized at 80 percent of the uncovered amount so a quiet week does not leave you holding hours you never use.
Savings Plans coverage and RI utilization: how the gap is sized
share of eligible HOURS · denominator 18,240 eligible instance-hours
share of eligible SPEND · denominator 12,880.00 USD of eligible spend
blended coverage 52.2% never printed
Questions asked before the first scan
Short answers; each one is said at more length on the security, pricing and features pages.
- Is Kostrix read-only?
- Yes. The IAM policy you deploy grants 334 read actions - Describe, List and Get calls plus a few scoped reads under other verbs, each named on the security page - and there is no mutating AWS call anywhere in the product. CloudTrail on your side records exactly what it read.
- Does it change anything in my AWS account?
- No, and it cannot: the permission to stop an instance, delete a snapshot or resize a volume is never granted. Kostrix recommends; you act, with your own hands and your own audit trail.
- How many AWS accounts can I link?
- It depends on the plan, and that is the only thing plans differ in: Lite 1, Lite+ 2, Pro 5, Enterprise 20. Enterprise+ is by agreement. Every plan runs all 235 checks in every enabled region.
- Is there a free trial?
- Yes: every paid plan starts with 30 days free and no card. Create your account, connect an AWS account read-only and the full product is yours. Subscribe when you are ready, during the free days or after, with a card or, in India, UPI AutoPay; a one-off nominal charge registers the mandate. Subscribe during the free days and the first plan charge is on day 31; subscribe after them and it is the day you subscribe. Never subscribe and nothing is charged: your findings stay readable for seven days after the trial, then the account waits for a subscription. One free trial per organisation and per AWS account.
- Which currency am I billed in?
- The currency of the country you are billed in. Customers in India pay the rupee price, which includes all applicable taxes, by card or UPI AutoPay through Razorpay. Customers elsewhere pay in US dollars by card, with no tax added. Every charge comes with a numbered tax invoice.
- Can I subscribe through AWS Marketplace?
- Soon. The same plans are being published on AWS Marketplace as a monthly contract billed to your AWS account; the pricing page links to the listing the day it is live.
- Does the scan cost anything on the AWS side?
- Most of the calls Kostrix makes are free of charge. Some are charged by AWS to your account at AWS's published rates - requests to the AWS Cost Explorer API in particular, which Kostrix reads for coverage and reconciliation - and the Terms of Service say so plainly. Those charges are AWS's, not part of the Kostrix fee.
- What does a first scan not cover?
- Whatever the reconciliation says it did not cover: the audit breaks your AWS bill down by line item and marks every one no check examined. On our own account that was 18 of 34 billed line items, and the list is shown beside the savings rather than left for you to infer.
Run the audit on your own account: 30 days free.
The policy it runs under is published in full on the security page; the plans and the free trial are on the pricing page.