AWS cost diagnostics
Trim the excess. Fill the gaps.
Connect your AWS account read-only. Ballast draws your infrastructure as an architecture diagram and pinpoints where money leaks, with the evidence attached.
Diagnostic reports are free during beta, limited to 15.
Numbers shown are sample data.
Why it matters
27–32% of cloud spend is wasted
Flexera 2025 State of the CloudIdle compute accounts for 35% of that waste, overprovisioning for 25%. Most of it is mechanically detectable.
The problem is not a lack of tools. Billing dashboards show you the number, but not the point in your architecture where it comes from.
The report
See the where, not just the number
Ballast auto-discovers your resources, draws the architecture, and backs every savings recommendation with the underlying metrics and observation window from official engines like AWS Compute Optimizer.
How it works
From connection to report in three steps
Connect a read-only role
Five minutes with the IAM template we provide.
Automatic discovery and analysis
We collect your resources and analyze architecture and cost signals together.
Receive your diagnostic report
What leaks, where, and how much, with the evidence laid out.
We never ask for write permissions. You can revoke the role yourself at any time.
Security
Security principles
Read-only, least privilege
We request only the describe and list access needed for diagnosis.
Cross-account role with External ID
Structural protection against confused-deputy attacks.
No write credentials stored
We never hold keys that can change your account.
Changes only with your approval
Infrastructure changes ship only as pull requests you review. On the roadmap after launch.
FAQ
Frequently asked questions
Is it free?
Diagnostic reports are free during beta, limited to the first 15. Paid plans follow after launch.
Do you support GCP?
It is on the roadmap. We are validating AWS diagnostics first.
What permissions do you need?
A single read-only IAM role. No write access, and you can revoke the role yourself at any time.
Where is my data stored?
In the AWS Seoul region (ap-northeast-2).
Beta diagnostic reports are limited to 15.