Stop paying for cloud resources nobody uses
Connect your AWS account with a read-only role. Sentinel lists the resources you're paying for and not using, with the evidence for each one, so you can remove them with confidence.
- Read-only access
- Evidence for every finding
- All regions, many accounts
- Monthly savings per item
- Free cost estimates
- Works with AI agents
| Resource | Region | Unused for | Evidence | Per month |
|---|---|---|---|---|
| 184 snapshots | ap-south-1 | 14 months | Source volumes deleted | $91.10 |
| EBS volume, 500 GB | ap-south-1 | 41 days | Not attached to any instance | $40.00 |
| NAT gateway | us-east-1 | 30 days | 0.2 GB processed | $32.40 |
| Elastic IP | ap-south-1 | 22 days | Instance stopped | $3.60 |
How it works
4 steps to get going
- Step 1
Connect a role
Create a read-only cross-account role with an ExternalId and paste the Role ARN. No credentials are stored, and you can revoke access anytime.
- Step 2
Run a scan
Sentinel assumes the role for short-lived credentials, inspects your resources across regions, then discards the credentials.
- Step 3
Review findings
Get a ranked list (removable, investigate, or keep), each with a confidence score, estimated monthly savings, and the evidence.
- Step 4
Act and track
Remove what's safe, investigate the rest, and re-scan to track savings over time. Results are yours until you delete them.
What you get
A ranked list you can act on
A representative scan result. Findings mirror the tool's real output: verdict, confidence, estimated monthly savings, and evidence.
| Resource | Region | Verdict | Confidence | Est. savings / mo | Evidence |
|---|---|---|---|---|---|
| Unattached EBS volume · vol-0a1b2c | ap-south-1 | Safe to remove | 96% | $42 |
|
| Unused Elastic IP · 13.234.x.x | eu-west-1 | Safe to remove | 99% | $4 |
|
| Idle EC2 · t3.large (api-staging) | us-east-1 | Investigate | 71% | $61 |
|
| RDS snapshot · prod-2023-backup | ap-south-1 | Keep | — | — |
|
What you get with Cloud Cost Sentinel
Read-only, always
Sentinel can't create, change or delete anything in your account. You can remove its role whenever you like.
Evidence for every finding
Each item says why it was flagged, so you can check before you delete.
Free cost estimates
Price a setup before you build it, or compare regions. No account needed.
No stored credentials
A scoped cross-account role with an ExternalId, assumed for short-lived credentials at scan time. Nothing long-lived is kept, and you can revoke it instantly.
Your results, isolated
Findings are stored per organization, never shared, and kept only until you delete them.
Sentinel looks across your account for the usual sources of silent spend:
- Unattached EBS volumes & orphaned snapshots
- Idle or oversized EC2 instances
- Unused Elastic IPs & load balancers
- Idle RDS instances & stale snapshots
- Old, unreferenced AMIs
- Multi-account, all regions
Starts with AWS. Azure and GCP coverage are on the way.
For AI agents
Let your agent run Cloud Cost Sentinel
Cloud Cost Sentinel is on the Tomorrow Central MCP server, so an agent can run scans and read findings under your scoped role. Pricing and cost estimates need no account at all.
> Scan my AWS account and summarise what's safe to remove, with the monthly savings. MCP: https://api.tomorrowcentral.com/mcp
Free plan
- Price lookups and cost estimates, no account needed
- Scans of your own AWS account on the free plan
Questions
Can it delete resources on its own?
No. Sentinel is read-only and advisory. It shows what's safe to remove and the evidence; you (or your own tooling) decide and act.
What permissions does it need?
A read-only cross-account IAM role with an ExternalId, the standard least-privilege way to grant access. You create it, and you can revoke it anytime.
Do you store my credentials?
Never. We assume your role for short-lived credentials during a scan and discard them. Only connection details (like the Role ARN) are kept so you can re-scan.
Which clouds are supported?
AWS today, with Azure and GCP coming.
How much does it cost?
Free to start, no credit card required. If a tool has paid usage, it's disclosed before you incur it.