Know what matters in your AWS environment in under 60 seconds
Cloud Savant turns AWS cost, security, and operational data into prioritized actions—with clear guidance showing exactly how to fix issues and improve cloud health.
Most tools stop at findings. Cloud Savant shows you how to fix them.
Findings are only valuable when they lead to confident action. Cloud Savant turns AWS signals into a practical remediation workflow your team can actually follow.
- See what changed
- Understand why it matters
- Follow guided remediation steps
- Track improvement over time
What can you answer in 60 seconds?
Cloud Savant gives leaders a fast read on cost, risk, operational change, and whether AWS health is moving in the right direction.
- Where are we wasting money?
- What are our biggest security risks?
- What changed since last week?
- Which issues need attention now?
- Is our AWS environment getting healthier over time?
Who this is for
Cloud Savant is built for teams that need AWS findings organized into practical next steps, not another platform to operate.
Built for
- Directors and leaders responsible for cloud operations
- Program managers overseeing AWS workloads
- CIO and CTO staff tracking cloud health and risk
- FinOps and budget teams looking for waste reduction
- AWS administrators and engineers responsible for execution
Not built for
- Teams looking for automated resource remediation
- Teams that need a full SIEM, CSPM, or enterprise CNAPP
- Non-AWS cloud environments today
Why cloud teams struggle to improve
Cloud teams are surrounded by data, but improvement depends on knowing what matters, how to fix it, and whether the environment is getting healthier over time.
Too much information
AWS generates thousands of signals, findings, and recommendations.
Too little prioritization
Teams spend time deciding what matters instead of fixing problems.
No clear path to remediation
Many tools identify issues but leave teams to figure out how to solve them.
Limited visibility for leadership
Decision makers often can't tell whether cloud health is improving or deteriorating.
From visibility to prioritized next steps
Cloud Savant combines AWS security posture, cost signals, usage optimization, reliability checks, and Well-Architected health into findings you can act on quickly.
Connect read-only AWS access
Connect AWS accounts or AWS Organizations through a read-only CloudFormation role and let Cloud Savant collect cost, security, and operational signals.
Review prioritized findings
Get continuously updated visibility into spend trends, forecasts, spend drivers, and Well-Architected health — all framed as clear next steps.
Act before small issues grow
Use explainable findings for rightsizing, savings coverage, risky configurations, and reliability improvements before small issues become expensive problems.
Built on AWS-native signals
Start with read-only access, connect the environments you actually run, and let Cloud Savant organize cost, security, and reliability findings into decisions.
Built for AWS Organizations
Designed for single AWS accounts and AWS Organizations with a least-privilege, read-only setup.
AWS-native signal sources
Uses Cost Explorer, savings plan and reserved capacity coverage/utilization, Compute Optimizer findings, and security/reliability findings.
Why not just use AWS native tools?
AWS tools are excellent at collecting data. Cloud Savant helps turn that data into clear priorities for the people responsible for improving cloud health.
AWS gives you signals. Cloud Savant gives you priorities.
Cloud Savant helps you understand:
- what matters most
- why it matters
- how to fix it
- where to focus next
Example findings Cloud Savant surfaces
Cloud Savant turns scattered AWS signals into prioritized findings across cost, security, reliability, and operations.
Cost Optimization
- Unattached EBS volumes
- Old EBS snapshots
- Unassociated Elastic IPs
- NAT gateway cost signals
- Underutilized EC2 or EBS findings
- Savings Plan / Reserved Instance coverage gaps
Security
- IAM users without MFA
- Old or unused access keys
- S3 public access posture
- CloudTrail coverage gaps
- GuardDuty and Security Hub findings
Reliability / Operations
- Load balancers with no healthy targets
- Backup visibility gaps
- Well-Architected pillar score changes
- Account-level risk and severity trends
Each finding shows what changed, why it matters, and what to do next.
How it works
Connect read-only AWS access, review prioritized findings, and start with the next best action instead of digging through disconnected dashboards.
Connect your account or Organization
Deploy a read-only CloudFormation role so Cloud Savant can analyze cost, usage, security, and reliability signals without changing resources.
See what changed
Review spend trends, forecasts, usage optimization opportunities, risky configurations, and Well-Architected health in one mobile-first view.
Start with the next best action
Prioritized findings explain what matters, why it matters, and what to do next across cost, security, and reliability.
AWS onboarding from your phone
Watch the account connection flow: start in Cloud Savant, launch the AWS setup path, and return with your read-only role ready for forecasting, usage optimization, and prioritized findings.
App screenshots
A quick look at Health, Security, and FinOps views — designed for clarity, forecasting, and next-step prioritization in dark mode.
Health
Well-Architected trends and pillar scoring framed as next steps.
Security
Risky configurations and drift organized by severity and impact.
FinOps
Spend drivers, forecasts, savings coverage, and usage optimization signals.
FinOps on iPad
A wider layout for forecasting, spend drivers, and deeper FinOps drill-downs.
Your AWS environment stays under your control
Cloud Savant uses read-only access to analyze configuration metadata, security posture, cost signals, and reliability health. It cannot create, modify, or delete AWS resources, and you can remove access at any time by deleting the CloudFormation stack.
What we read
Configuration metadata, inventory, security settings, cost and usage signals needed to surface findings.
What we cannot do
Create AWS resources, modify existing resources, delete anything, change IAM users or policies, start or stop EC2 instances, or deploy software into your VPC.
What happens when you remove access
Delete the CloudFormation stack and the IAM role is removed. Cloud Savant can no longer access your AWS account.
How access works
Cloud Savant reads configuration data from many AWS services to analyze security, cost, and reliability signals. The number of permissions reflects the breadth of AWS coverage, not the ability to make changes.
View IAM policy JSON Cloud Savant analysis permissions
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"sts:GetCallerIdentity",
"ce:GetCostAndUsage",
"ce:GetCostForecast",
"ce:GetDimensionValues",
"ce:GetCostCategories",
"ce:GetReservationCoverage",
"ce:GetReservationUtilization",
"ce:GetSavingsPlansCoverage",
"ce:GetSavingsPlansUtilization",
"ce:GetSavingsPlansPurchaseRecommendation",
"budgets:ViewBudget",
"budgets:DescribeBudgetAction",
"budgets:DescribeBudgetActionHistories",
"budgets:DescribeBudgetActionsForAccount",
"budgets:DescribeBudgetActionsForBudget",
"compute-optimizer:GetEnrollmentStatus",
"compute-optimizer:GetEC2InstanceRecommendations",
"compute-optimizer:GetEBSVolumeRecommendations",
"compute-optimizer:GetLambdaFunctionRecommendations",
"compute-optimizer:GetAutoScalingGroupRecommendations",
"compute-optimizer:GetECSServiceRecommendations",
"ec2:DescribeInstances",
"ec2:DescribeSecurityGroups",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeVolumes",
"ec2:DescribeSnapshots",
"ec2:DescribeAddresses",
"ec2:DescribeImages",
"ec2:DescribeRegions",
"ec2:DescribeNatGateways",
"ssm:DescribeInstanceInformation",
"iam:GetAccountSummary",
"iam:GetAccountPasswordPolicy",
"iam:ListUsers",
"iam:ListMFADevices",
"iam:ListAccessKeys",
"iam:GetAccessKeyLastUsed",
"iam:ListAttachedUserPolicies",
"iam:ListRoles",
"iam:ListAttachedRolePolicies",
"iam:GetRole",
"iam:ListRoleTags",
"s3:ListAllMyBuckets",
"s3:GetBucketPolicyStatus",
"s3:GetBucketPublicAccessBlock",
"s3:GetEncryptionConfiguration",
"s3:GetBucketVersioning",
"s3:GetBucketLogging",
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:GetLifecycleConfiguration",
"s3:GetAccountPublicAccessBlock",
"rds:DescribeDBInstances",
"rds:DescribeDBClusters",
"elasticfilesystem:DescribeFileSystems",
"backup:ListBackupPlans",
"guardduty:ListDetectors",
"guardduty:GetDetector",
"guardduty:ListFindings",
"guardduty:GetFindings",
"securityhub:DescribeHub",
"securityhub:GetFindings",
"pricing:GetProducts",
"cloudtrail:DescribeTrails",
"cloudtrail:GetTrailStatus",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTags",
"cloudwatch:DescribeAlarms",
"cloudwatch:DescribeAlarmsForMetric",
"cloudwatch:GetMetricStatistics",
"tag:GetResources",
"tag:GetTagKeys",
"tag:GetTagValues",
"organizations:DescribeOrganization",
"organizations:ListAccounts",
"organizations:ListAWSServiceAccessForOrganization",
"organizations:ListDelegatedAdministrators",
"organizations:ListParents",
"organizations:ListRoots",
"organizations:ListOrganizationalUnitsForParent",
"organizations:ListAccountsForParent",
"organizations:DescribeAccount",
"organizations:DescribeOrganizationalUnit",
"cur:DescribeReportDefinitions",
"glue:GetDatabases"
],
"Resource": "*",
"Effect": "Allow"
}
]
}Ready to see what is risky, wasteful, or drifting in your AWS accounts?
Connect a single account or AWS Organization with a read-only CloudFormation role, then review prioritized findings across security, cost, reliability, and cloud health—with guided remediation steps showing exactly how to fix issues and improve outcomes.
Connect One AWS Account for FreeStart with one AWS account free.
Upgrade when you want to monitor additional accounts or connect broader AWS Organizations coverage.
See Your Findings on Apple
See Your Findings on Android
FAQ
Common questions teams ask before onboarding.
Do I have to give Cloud Savant write access to my AWS accounts?
No. Cloud Savant uses a read-only role deployed through CloudFormation so it can analyze your environment without making changes.
Is this just another cost dashboard?
No. The focus is on prioritized next steps — what changed, why it matters, and what to do next across cost, security, and reliability.
Will this work if we manage multiple AWS accounts?
Yes. Cloud Savant supports both single accounts and AWS Organizations, so you get consistent visibility across the environments you actually run.
Can I use it on the go?
Yes. Cloud Savant is designed for phone visibility, with a readable, dark-mode-friendly experience that makes it easy to check findings anywhere.
How does onboarding work?
You deploy a read-only CloudFormation stack in your AWS account. This creates an IAM role Cloud Savant can assume to begin analysis. Single-account setup takes only a few minutes.
What platforms does Cloud Savant support?
Cloud Savant is currently available as an iOS app on iPhone and iPad, and as an app on Android with support for AWS environments of any size.
Is my AWS data stored by Cloud Savant?
Cloud Savant collects summarized signals and findings, not raw resource data. Analysis results are stored securely and used only to power your dashboard.
What AWS cost signals does Cloud Savant use?
Cloud Savant uses AWS-native signals such as Cost Explorer, forecasting data, savings plan and reserved capacity coverage/utilization, Compute Optimizer findings, and spend driver trends.