Every account on one screen, with the verdict first and the evidence underneath. Cloud_CTRL runs in your own AWS account, can only read, and your AWS data stays there.
Ask · an example organization
You asked: What changed in spend this month?
Spend is running ahead of last month, and one account explains most of the rise.
You asked: Which spend has no owner?
Most of the unowned spend sits in two accounts that predate your tag policy.
You asked: Which account drove this month's rise?
The production account drove most of it, and the growth is compute, not storage.
You asked: Which commitments expire soon?
The Savings Plan carrying most of compute expires before a renewal can be priced.
You asked: Where are the open findings?
Exposure is concentrated, and one account has stopped reporting.
Six pages
Run rate, pace against the window before it, and the services and accounts carrying the movement.
64%of this month's rise is one account
Cost Explorer
You declare the tags that count. Every taggable resource is scored against them, and what is left unowned is priced.
68%of taggable resources have an owner
Config · Cost Explorer
Bedrock on the bill and Claude bought direct from Anthropic, summed across all four token types.
$21,904over 30 days, both channels
Two billing channels
Open findings by severity, the accounts not reporting at all, and the identity hygiene behind them.
61open, 9 older than 30 days
Security Hub · IAM
Whether the guardrails held, on a timeline that says which day it was and what it was.
25/26days the guardrails held
AWS Health · Config
Everything you are running, by type, account and Region, down to the row and the tag it is missing.
18Regions with something running
AWS Config
Where it runs
Your AWS account
Your Region · encrypted at rest
The screens
One deploy, one organization. Not a seat on a platform of ours.
The reading
It can look at the bill and the inventory. It cannot change either.
The figures
Cached in your account, encrypted at rest.
What crosses this line
None of your AWS data. No copy of your bill, your inventory or your findings is held anywhere else.
“The monthly review went from two days of work to one screen we open in the meeting.”
Services
30% off eligible AWS compute, after our share. We hold the Savings Plans and Reserved Instances across a pool of companies, and you commit to nothing.
A compliant, multi-account AWS environment on Control Tower, hardened with security services and guardrails, deployed and owned by us from day one.
Senior AWS architects review your environment in Office Hours. Compare the plans.
30 minutes of one engineer · your AWS data stays in your account
