AWS cost diagnostics
Trim the excess. Fill the gaps.
Connect your AWS account read-only. Ballast draws your infrastructure as an architecture diagram and pinpoints where money leaks, with the evidence attached.
Sign up and start right away — no invite code needed. Diagnostics are free during beta.
Numbers shown are sample data. · See a report from a real account →
Why it matters
27–32% of cloud spend is wasted
Flexera 2025 State of the CloudIdle compute accounts for 35% of that waste, overprovisioning for 25%. Most of it is mechanically detectable.
The problem is not a lack of tools. Billing dashboards show you the number, but not the point in your architecture where it comes from.
The report
See the where, not just the number
Ballast auto-discovers your resources, draws the architecture, and backs every savings recommendation with the underlying metrics and observation window from official engines like AWS Compute Optimizer.
How it works
From connection to report in three steps
Connect a read-only role
Five minutes with the IAM template we provide.
Automatic discovery and analysis
We collect your resources and analyze architecture and cost signals together.
Receive your diagnostic report
What leaks, where, and how much, with the evidence laid out.
We never ask for write permissions. You can revoke the role yourself at any time.
Security
Security principles
Read-only, audit-policy scope
Read access within the AWS managed audit policy — we call only the reads diagnosis needs.
Cross-account role with External ID
Structural protection against confused-deputy attacks.
No write credentials stored
We never hold keys that can change your account.
Changes only with your approval
Infrastructure changes ship only as pull requests you review. On the roadmap after launch.
FAQ
Frequently asked questions
Is it free?
Diagnostic reports are free during beta, limited to the first 15. Paid plans follow after launch.
Do you support GCP?
It is on the roadmap. We are validating AWS diagnostics first.
What permissions do you need?
A single read-only IAM role. No write access, and you can revoke the role yourself at any time.
Where is my data stored?
In the AWS Seoul region (ap-northeast-2).
The connection is read-only — nothing in your account changes. Free during beta.