AWS cost optimization · read-only

Cut your AWS bill.
Keep everything running.

Citadel AI reads your AWS accounts and finds the money you're spending on nothing: idle resources, on-demand prices on steady usage, old instance generations, servers that never sleep. Every dollar itemized, with the evidence and the fix.

Get your savings report See the results

Read-only, nothing installed Ten-minute setup From $20 a month

How much could you save?

estimate

Your monthly AWS bill

/ month

Savings per month

Savings per year

Estimate based on the average result Citadel AI customers achieve: 20% of the bill (range 10–29%). Connect your accounts to see your exact number, line by line.

Get your exact number

Read-only by designOne IAM role. No write permission, ever.

Hosted on AWSYour data never leaves AWS.

Whole OrganizationOne StackSet covers every account.

100+ checks, dailyAcross 40+ AWS services and every region.

Results

The month you connect, the bill starts falling.

Commitments and clean-ups land first: a purchase or a deletion, no engineering project. Schedules and modernization follow. Your bill bends down and stays down.

Monthly AWS billillustration · based on your number above

Illustration with usage growing ~1% a month and savings at the top of the range (29%) applied over five months. Your curve depends on what you choose to apply and when.

Bill after six months

Saved in the first six months

vs doing nothing

Engineering hours to find it

Citadel AI does the reading

What it finds

Six places your AWS money leaks.

Figures from an example organization: 14 accounts, a $62,480 monthly bill, $18,230 a month found.

Commitments

Steady compute and databases on on-demand prices. Savings Plans and reservations sized after the clean-up, so you never commit to waste.

example$5,870/mo

Idle & orphaned

Volumes attached to nothing, unused IPs, empty load balancers, idle databases and caches, all paid for by the hour.

example$2,610/mo

Scheduling

Dev and staging running all night and every weekend. Office-hours schedules cut their compute by about two thirds.

example$3,120/mo

Modernization

Previous generations, Graviton, Valkey, databases in paid Extended Support, checked against what AWS actually sells for your engine version.

example$4,120/mo

Rightsizing

Instances, databases, Lambda memory and IOPS sized to 30 days of real utilization, with the evidence behind every step down.

example$1,240/mo

Storage & clean-up

gp2 → gp3, S3 lifecycle and tiers, old snapshots and AMIs, log groups that keep everything forever.

example$1,270/mo

Coverage

The 40 AWS services you actually pay for.

104 cost checks across compute, databases, storage, networking and operations, in every enabled region, Local Zones included. Plus 20 security checks, coming soon.

Compute

EC2
EC2 Auto Scaling
EKS
ECS
Fargate
Lambda
EMR
SageMaker
WorkSpaces

Databases

RDS
Aurora
DynamoDB
ElastiCache
OpenSearch
Redshift
DocumentDB
Neptune

Storage

S3
S3 Glacier
EBS
EFS
ECR

Networking

VPC (NAT, endpoints)
Elastic Load Balancing
Transit Gateway
Client VPN
CloudFront
Route 53

Operations & security

CloudWatch
CloudTrail
KMS
Secrets Manager
IAM
GuardDuty

Data & integration

Kinesis
Amazon MQ
MWAA
Glue
Transfer Family
Savings Plans

The product

Not a list of alerts. A decision, ready to sign off.

Each recommendation carries its monthly saving, confidence, risk and effort, the numbers that triggered it and the exact steps. AWS's own Cost Optimization Hub results are merged in and never counted twice.

Recommendations47 open · $18,230/mo

Buy a Compute Savings Plan for steady compute$4,870prod-api · commitments

Move 23 instances to the current generation$3,4106 accounts · modernization

Put dev and staging on office-hours schedules$3,1203 accounts · scheduling

Delete 38 unattached EBS volumes$2,140sandbox · idle & orphaned

Switch 3 cache clusters from Redis OSS to Valkey$602prod-data · modernization

Upgrade PostgreSQL 12 out of paid Extended Support$292prod-data · modernization

Commitments

Cover steady compute with a Compute Savings Plan

Saves$4,870/mo

ConfidenceHigh

RiskLow

EffortLow

AI analysis
41% of your steady compute still runs at on-demand prices. The baseline has held for three months, so committing to the steady part cuts its price without touching a single server.

Review the suggested hourly commitment and term.
Purchase it in the AWS Billing console.
Mark done. Coverage updates on the next daily refresh.

Mark doneSnoozeDismiss

Zero risk to production

Citadel AI can look. It cannot touch.

Your team applies what you approve. Citadel AI never writes to your accounts. Not because we promise, but because the role does not allow it.

Read-only IAM roleAWS-managed ViewOnlyAccess and SecurityAudit, plus billing reads. Nothing can be started, stopped, changed or deleted.
No access keys, no agentsTemporary credentials for at most an hour per pull. Nothing to install, nothing long-lived to leak.
Your own ExternalIdUnique per customer. Citadel AI refuses any role that would let it in without one, so nobody else can point it at your account.
Off in one clickDelete the stack and access ends that second. Every call is in your own CloudTrail.

citadel-readonly-role.yamlread-only

CitadelReadOnly:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      # only Citadel AI, only with your ExternalId
      Condition:
        StringEquals:
          sts:ExternalId: citadel-7f3a…
    ManagedPolicyArns:
      - …/job-function/ViewOnlyAccess
      - …/SecurityAudit
    # no Put*, Create*, Delete*, Start*, Stop*
    MaxSessionDuration: 3600

Your AWS account

CloudFormation stack

CitadelReadOnly role

read-only APIs

AWS STS

AssumeRole + ExternalId
1-hour credentials

AWS Cloud · EU

Citadel AI

Your data never leaves AWS. Citadel AI reads metadata only and runs on AWS too. No other cloud, no third-party data warehouse.

Isolated per customer. Every record is tied to your organization; nobody else's dashboard can show it.

Never sold, never shared. Your inventory and billing data are used for your recommendations only.

Pricing

Pays for itself on the first finding.

Early-access pricing. Flat monthly fee, no percentage of your savings, cancel any time.

Cost

$20 / month

Every cost recommendation, for your whole Organization.

100+ checks across 40+ services
Unlimited accounts in one Organization
Daily refresh, evidence and fix steps
AWS Cost Optimization Hub merged in

Start with Cost

Security · releasing soon

Cost + Security

$35 / month

Everything in Cost, plus the security posture of the same accounts.

Everything in Cost
Findings mapped to CIS, ISO 27001 and SOC 2
Same read-only connection

Coming soon

Organization

Let's talk

For AWS bills above $100,000 a month.

SSO and audit log
Volume pricing for large AWS bills
Custom terms and invoicing

FAQ

Questions buyers ask.

Can Citadel AI change anything in my AWS account?

No. The role you deploy has read-only AWS-managed policies (ViewOnlyAccess, SecurityAudit) plus billing reads. It has no permission to create, modify, start, stop or delete anything. Your team applies the recommendations you approve.

How long does setup take?

About ten minutes: deploy one CloudFormation stack (or Terraform module) per account, or one StackSet for the whole Organization, then paste the account id. The first results appear after the first pull.

Does it cost me anything on the AWS side?

Very little. Reading your inventory is free. Utilization metrics (CloudWatch) and billing data (Cost Explorer) are billed by AWS per request, which typically comes to a few cents per account per day, and a bit more for accounts with thousands of resources.

How is this different from AWS Cost Explorer or Trusted Advisor?

Cost Explorer shows where your money went, but not what to change. Trusted Advisor covers a limited set of cost checks, and the full set needs a Business or Enterprise support plan. Citadel AI runs 100+ checks across 40+ services and every account in your Organization, and turns each finding into a concrete action: the monthly saving, the evidence behind it, its risk and effort, and the steps to apply it. AWS's own Cost Optimization Hub recommendations are included too, so everything sits in one ranked list.

Where is my data stored?

Citadel AI is currently hosted on AWS in the EU. Citadel AI reads metadata only: resource settings, utilization metrics and billing totals. It never reads the contents of your files, databases or applications. Hosting in the US and other regions is coming soon, so you will be able to keep your data where your business needs it.

How fresh is the data?

Citadel AI pulls your inventory, utilization metrics and costs every day, and you can refresh an account at any time. The first results appear within minutes of connecting. Billing data from AWS Cost Explorer runs about a day behind, so the newest day appears the following morning.

Your savings report

See exactly where your AWS money goes.

Connect read-only in ten minutes. Every dollar itemized, with the evidence and the fix.

Create your account Log in Free trial · read-only · ten-minute setup

Cut your AWS bill.Keep everything running.

How much could you save?

The month you connect, the bill starts falling.

Six places your AWS money leaks.

Commitments

Idle & orphaned

Scheduling

Modernization

Rightsizing

Storage & clean-up

The 40 AWS services you actually pay for.

Compute

Databases

Storage

Networking

Operations & security

Data & integration

Not a list of alerts. A decision, ready to sign off.

Citadel AI can look. It cannot touch.

Pays for itself on the first finding.

Cost

Cost + Security

Organization

Questions buyers ask.

See exactly where your AWS money goes.

Cut your AWS bill.
Keep everything running.