Connect AWS. Run your first scan.

Search every AWS resource across accounts and regions. Drill into a resource for tags, findings, recommendations, and change history.

Spend by service and account, top savings opportunities, anomalies, and exports. Apply filters or run a fresh scan from the module page.

Risky IAM, stale access keys, KMS, secrets, and policy posture. Findings carry severity and remediation guidance.

Public routes, internet-facing resources, DNS exposure, and edge-protection coverage across accounts.

ECS, EKS, ECR, Lambda, DynamoDB, API Gateway, queues, and orchestration findings grouped by workload.

CloudTrail, AWS Config, AWS Backup, and native AWS security signals (Security Hub, GuardDuty, Inspector, Macie on Enterprise).

Alarms, log groups, backup health, target health, and failed workflows across your fleet.

Organization-wide visibility, native security integrations, edge protection, and data-platform coverage.

Open the Filters menu in /dashboard/cost-analyzer to filter by severity, status, AWS account, region, search query, and minimum monthly savings. Filters are URL-driven so the view is shareable.

Use Export → Export filtered cost findings as CSV to download the currently visible findings as a spreadsheet.

Use Export → Export savings report as PDF to generate a printable summary with top services, top accounts, and the highest-impact opportunities.

Every savings figure is an estimate — treat it as a directional ceiling. Rightsizing and Cost Optimization Hub figures come from AWS's own recommendation APIs; unattached-EBS and idle-NAT figures use standard published list prices (not your region-specific or negotiated rates), so actual savings depend on your pricing and on cleanly removing or rightsizing the resource.

Cost Analyzer reads from Cost Explorer (spend + rightsizing recommendations), AWS Budgets (flags accounts with none configured), Reserved Instance expirations, Savings Plans utilization, and Cost Optimization Hub. Findings from these combine with the unattached-EBS, idle-NAT, and cost-concentration checks into one ranked list.

Run inventory and cost scans on a daily, weekly, or monthly cadence. Defaults are provisioned the moment you connect an AWS account.

Refresh recommendations on a tight cadence so newly-detected critical findings are surfaced within minutes.

Compare current spend against your recent baseline and open anomalies when something spikes.

Roll up trends, savings, and findings into a digest your stakeholders read on Monday morning.

Route new work to owners by severity, service, account, or module.

Surface unattached EBS, idle NAT gateways, old access keys, and unused load balancers so they don't accumulate.

1 AWS account, 1 seat, 1 scan/day, 7 days of findings history. Resource Inventory and a lite version of Cost Analyzer.

Up to 5 connected AWS accounts, unlimited paid seats, unlimited scans, 90 days of history. Adds Network Exposure, Containers & Serverless, basic automation, CSV exports, and saved views.

Up to 15 connected AWS accounts, unlimited paid seats, unlimited scans, unlimited history. Adds Identity & Access, Audit & Compliance, Operations & Reliability, advanced automation, alerts, cross-account intelligence, executive reporting, and priority support.

Custom accounts, custom seats, custom scan volume, custom retention. Adds Enterprise Intelligence (AWS Organizations, native security integrations, data-platform coverage), dedicated support, and SLA options. SSO/SAML is available by arrangement (roadmap).

trueno never asks for AWS access keys. The role you create in your AWS account attaches AWS-managed read-only policies only.

Each workspace generates a unique external ID. AssumeRole calls are gated on this external ID so the confused-deputy pattern is defeated at the AWS layer.

AWS SDK code runs server-side only. The build blocks any regression that would leak AWS SDK code into a client bundle.

Delete the IAM role you created in AWS and AssumeRole calls return AccessDenied immediately. You don't need to file a support request to disconnect.

You create one IAM role in your account with a trust policy that lets trueno's AWS principal assume it. trueno calls STS AssumeRole at scan time for short-lived credentials. There are no long-lived keys to leak or rotate.

The role attaches AWS-managed read-only policies (e.g. SecurityAudit + ViewOnlyAccess) plus a small grouped inline policy for a few list/describe actions those don't cover. No write, no data-plane read (no S3 object contents, no DB rows), only configuration metadata.

Your workspace generates a unique external ID. The role's trust policy requires it on every AssumeRole, which defeats the confused-deputy problem: another trueno tenant can't trick AWS into assuming your role.

On connect, trueno runs per-check diagnostics: it confirms the role assumes, that GetCallerIdentity returns your account, and that key read permissions resolve. The account isn't marked connected until these pass.

Each module reads specific services: Identity & Access reads IAM/KMS/Secrets; Network Exposure reads VPC/EC2/ELB; Cost Analyzer reads Cost Explorer/Budgets/Savings Plans; and so on. The read-only policy set covers all of them.

If the role can't reach a service, the scan records it as a permission gap instead of failing silently. The in-product Coverage page surfaces a coverage-confidence score and the exact IAM actions to add, so you can run least-privilege and widen only where needed.

Slack channel alerts + bot-token DMs, PagerDuty/Opsgenie keys, GitHub/Jira/Linear tokens, API keys, and signed webhooks, with the exact scopes and where to find each value.

Read-only REST over findings, recommendations, resources, and accounts. Bearer-key auth, endpoints, response schemas, webhooks, and the OpenAPI 3.1 spec: the full reference.