trueno
Free · No signup

AWS cost check in 30 seconds.

A one-shot read of your last 30 days of AWS spend, by service, with a daily trend. No account, no email, no persistence. Close the tab and it's gone. We just need a tiny IAM role that can call Cost Explorer.

01 · How it works

Read-only. Scoped to one API call.

The role you'll create is the narrowest possible: Cost Explorer's GetCostAndUsage and nothing else. The cost-check assumes the role via STS, makes two calls, then drops the temporary credentials. Two API calls cost about $0.02 on your AWS bill.

01

Your one-time external ID

Generated locally + stored in your browser. Stays the same across page reloads so you can create the IAM role once and reuse it for follow-up checks.

Generating your external ID…
02

Create the IAM role (suggested name: TruenoScannerRole)

In your AWS console: IAM → Roles → Create role → Custom trust policy. Paste the JSON below. Then attach the inline permissions policy.

Trust policy
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowTruenoCostCheck",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::513189074059:role/TruenoScannerCrossAccount"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "(generating your external ID…)"
        }
      }
    }
  ]
}
Inline permissions
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TruenoCostCheckRead",
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage"
      ],
      "Resource": "*"
    }
  ]
}
03

Paste the role ARN and scan

The scan calls AWS Cost Explorer twice (~$0.02 of API spend on your AWS bill). Nothing is stored on our side. Close the tab and the result is gone.

02 · The cost-check, honestly

What this is and isn't.

What does this actually scan?

Two AWS Cost Explorer calls. One MONTHLY by SERVICE for the top-spender list, one DAILY for the trend bar chart. Both cover the last 30 days. Nothing else.

What do you save on your side?

Nothing. There is no row written to a database for an anonymous cost-check. The result lives only in your browser tab. Close it and it's gone.

What about the external ID in localStorage?

Just an opaque id used to scope your IAM trust policy to your browser. It isn't a credential. Clearing localStorage just means you'd need to re-create the role on next visit.

What's the catch?

None, but the cost-check is a one-shot. To get continuous monitoring (weekly digests, alerts, drift detection, the full dashboard), sign up Free. It's the same IAM-role pattern with a broader permission set.

Is this rate-limited?

Three checks per hour per IP. Generous enough for retries after fixing trust-policy mistakes, tight enough that Cost Explorer's per-call cost stays bounded on the platform side.

Can I revoke this after?

Yes. Delete the IAM role from your AWS console. From that moment forward no AssumeRole call from us can succeed against it. There's nothing else to wind down on our side.

03 · Liked what you saw?

The Free tier covers everything except scale.

Connect your real AWS account, get weekly digests, scan-failed alerts, security findings, cost recommendations, and the eight cloud-intelligence modules. Up to one AWS account on Free, no credit card.

Continue with the full product

Free → 1 AWS account, 1 seat, 7-day history. Command (paid) → 5 accounts, scheduled scans, exports. Control (paid) → 15 accounts, alerts, executive reporting.
Start FreeSee pricing