SEAWALL Engine.
AWS FinOps as Code.
Terraform-managed cost guardrails, a Grafana cost dashboard, anomaly detection wired to your comms channel, and cost-governance evidence aligned to DORA / NIS2 / ISO 27001 objectives, shipped as a product, not a Time-and-Materials gamble.
Thresholds and counts are read from the shipped template. The ~30% waste figure used elsewhere on this page is an industry benchmark (Flexera 2026), not a claim about your estate or our results.
Your AWS bill is bleeding. Quietly.
By independent estimate, around 30% of cloud spend is wasted (Flexera State of the Cloud 2026) - on resources nobody uses, nobody tagged, and nobody owns. Every month it compounds. Every audit makes it worse. Every quarter your CFO asks the same question with sharper edges.
Zombie resources accumulating
Idle EC2, un-attached EBS, orphaned NAT gateways, oversized RDS. Each one bleeds money quietly until quarter-end when finance asks why the bill grew again this quarter.
Anomaly detection is theoretical
AWS Budgets configured once, never tuned. Cost Anomaly Detection enabled in the console with default thresholds. Nobody gets paged when spend spikes 3x at 02:00.
Click-ops, no tagging discipline
Half the stack provisioned in the console, the other half in stale Terraform state. Tags applied inconsistently. Finance has no per-team cost attribution.
The anomaly desk, the ledger, and the kit itself.
Three views of the real kit: the anomaly procedure the SOP documents, an interactive waste ledger built on the five dashboard panels, and the template file tree you can read before you buy. Every fact is from the shipped template, not a mock-up.
What ships inside SEAWALL Engine.
No screenshots of a SaaS UI. No locked dashboards. Five concrete layers of code + configuration + documentation that land in your Git repository on day one.
Three Terraform Modules
- modules/budgets: an AWS monthly budget at 80 / 100 / 115% thresholds, plus Cost Anomaly Detection at $100 absolute impact, both publishing to one KMS-encrypted SNS topic (email + Slack)
- modules/cur: a Cost & Usage Report delivered to S3 in Parquet and queryable through Athena, the data the dashboard runs on
- modules/scps: two Service Control Policies, deny expensive EC2 families (p*, x*, mac*) and deny operations outside your approved EU regions
- A root main.tf that wires the three together from your terraform.tfvars, with versions.tf pinning the provider
Five-Panel Cost Dashboard
- The Black Hole: untagged spend with no Owner or Project tag, the leak that hides from showback
- Zombie instances: average CPU utilization over 30 days, so idle compute is obvious
- Orphaned EBS volumes: unattached storage still billing at full price
- NAT Gateway drain: hourly and per-GB data-processing charges, even on idle gateways
- Top 10 services by 30-day spend: where the money actually goes this month
Cross-Account Bootstrap
- cloudformation/leakproof-bootstrap.yaml: a scoped IAM role deployed via your management account
- An External ID on the role, with no long-lived access keys
- ReadOnly for the read-only work; write access only when you ask us to run it, with a documented blast radius
- Detach anytime: remove the role and nothing on our side is load-bearing
Tagging Framework + SOP
- docs/LEAKPROOF_SOP.md: a written tagging taxonomy (Owner / Project / Environment) and the triage playbook, not an enforced org tag policy - the framework, honestly labelled
- A SEV-1 to SEV-4 escalation matrix, so an anomaly gets the response it deserves and no more
- The recommended CI rule to fail pipelines that provision untagged resources (tflint), yours to wire in
- The Black Hole panel plus the SOP is how untagged spend stops being invisible
Cost-Governance Evidence
- Quarterly evidence snapshot: spend, anomalies, tag coverage and drift, with timestamps
- Versioned in your own S3 bucket + Git repo - you keep the evidence, not us
- Control-objective notes for DORA, NIS2 and ISO 27001 (designed-around, not a certified framework mapping)
- Evidence you can bring to a cyber-insurance renewal conversation
Read the code before you pay.
Two excerpts, the way they land in your repository. If a claim on this page is not in the template, it should not be here.
resource "aws_ce_anomaly_subscription" "finops" {
frequency = "IMMEDIATE"
threshold_expression {
dimension {
key = "ANOMALY_TOTAL_IMPACT_ABSOLUTE"
match_options = ["GREATER_THAN_OR_EQUAL"]
values = ["100"] # absolute USD, not a percent
}
}
subscriber { type = "SNS" address = aws_sns_topic.finops_alerts.arn }
}Why absolute dollars, not a percentage: a percent threshold lets a real leak hide behind a large base spend. $100 pages you whether the account bills $2k or $200k.
{
"Sid": "DenyAllOutsideApprovedRegions",
"Effect": "Deny",
"NotAction": ["iam:*", "sts:*", "cloudfront:*"],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": var.allowed_regions
}
}
}Why the EU lock: region enforcement is the cheapest GDPR / ISO 27001 data-residency control there is, and it blocks a whole class of accidental spend in regions you never meant to use.
Want to read the SOP and a runbook before paying €199? Ask, and we send LEAKPROOF_SOP.md and RUNBOOK-04-anomaly-response.md as-is. Ask for the files.
Buy the code. Or have us run it.
Two tiers, the same Terraform kit under both. The only difference is who runs it - you, or the engineer who built it.
DIY
Self-deploy. Buy once, own forever.
Best for
In-house team comfortable with Terraform that wants the SEAWALL blueprint without an engagement.
- Private GitHub repo: every Terraform module + Grafana dashboard JSON
- AWS Budgets, CUR pipeline, SCP modules ready to terraform apply
- Cost dashboard JSON (self-host Grafana, or use Grafana Cloud free tier)
- Step-by-step deployment runbook with screenshots
- A direct line to the engineer who built it (email)
- Lifetime updates to the template (Git pull keeps you current)
Outcome
You ship the controls yourself. Zero lock-in. Your code from day one.
Managed
We operate the guardrails. You ship product.
Best for
FinTech, Maritime, Legal and other regulated estates that want the engine run for them, with audit-ready cost records.
- We deploy and run every SEAWALL module in your AWS organization
- Hosted Grafana cost dashboard (single-tenant, your account, EU)
- Monthly savings report (PDF, board-ready)
- Next-business-day anomaly triage with root-cause + remediation PR (business hours, not a 24/7 SOC)
- Next-business-day SCP rollback when a deploy breaks a workload
- Quarterly cost-governance evidence export (spend, anomalies, tag coverage, drift)
- IaC maintenance, version upgrades and drift resolution included
- A direct line to the engineer who runs it (email), plus a quarterly review
Outcome
Predictable cloud economics, run by the engineer who built the kit, with next-business-day response.
Looking for a one-off diagnostic before committing to deploy? FinOps cost audit · free diagnostic
Every system it talks to, out of the box.
No middleware, no iPaaS, no premium connector add-ons. Native API + IaC integration with the surfaces your team already runs.
Built for EU-regulated estates.
SEAWALL is built for EU regulated entities. Every guardrail is designed around the control objectives your auditor cares about, and the cost-governance evidence export is part of the deliverable, not a paid add-on. It is designed-around those objectives, not a certified framework mapping.
ICT risk-management objectives (Article 6). Budgets, anomaly detection and SCP guardrails are designed around them, with timestamped evidence and remediation history.
Risk-management measures (Article 21). Tagging SOP, IAM baseline and logging evidence ship in the handover pack.
Annex A change-management and segregation-of-duties objectives, addressed for regulated EU operators.
Code-first. Git-native. Reviewable.
Your platform team sees the Terraform plan before any change lands. Every module is documented, versioned, and exits cleanly if you decide to leave.
Every Terraform module + Grafana dashboard JSON + SOP markdown sits in a private repo invited to your GitHub or GitLab on purchase. Tag-based release channel.
GitHub Actions workflow runs terraform plan on every PR and posts the diff as a review comment. Your engineers approve infrastructure changes the same way they approve code.
One CLI command revokes the SEAWALL IAM role across your AWS Organization. Terraform state stays in your bucket. Dashboards stay in your Grafana. Nothing on our side is load-bearing.
Stated limits
Microsoft AI Cloud Partner (PLA 7113951), Pax8 reseller. SEAWALL targets AWS today because that is where the template is production-ready. The Azure edition is in development, not beta - request early access. GCP is not planned. We do not resell AWS and hold no AWS spend incentive: the advice has no margin behind it.
Read-only cost review
A scoped review of agreed Azure, AWS or Google Cloud billing data. We map data quality, allocation gaps and decision candidates, then retain potential, approved and realised cost effects as separate values.
- Client-owned export or provider-specific read role.
- Written findings and review format agreed in scope.
- No obligation to buy a tier afterwards.
- No credentials or billing exports through the public form.
Under the hood
The review uses the provider exports and tools included in scope. Findings are reconciled with owners and engineering context before they become a decision backlog.
The questions FinOps leads ask before purchase.
How is SEAWALL different from Vantage, CloudHealth, Apptio Cloudability, or AWS Cost Explorer?
Those are dashboards. They tell you something is wrong, then bill you per user for showing you. SEAWALL ships the controls that stop the bleed: Terraform-managed Budgets, Service Control Policies, anomaly detection wired to your comms channel, and a tagging SOP your engineers actually follow. You keep the IaC. No per-seat SaaS fee, no vendor lock-in, no proprietary metric model that breaks when you switch tools.
Is the SEAWALL Terraform template really mine to keep?
Yes. Every module lives in your Git repository under a permissive internal-use license. We hand over the code, the state, the documentation, and the training. If you ever cancel a managed retainer, nothing breaks and nothing disappears. Your guardrails keep running.
We do not want anyone in our production AWS account. How does this work?
The DIY tier needs zero access from us: you clone, plan, apply. For the Managed tier, we provision a scoped IAM role using a CloudFormation StackSet with an External ID. ReadOnly during discovery; Write access only after a documented blast-radius review. You can revoke the SEAWALL role with a single CLI command at any time. All evidence is stored encrypted in the EU (Hetzner Falkenstein) and destroyed on request.
What counts as a "saving" in your reports?
Net reduction in monthly AWS invoice, measured against a frozen 90-day baseline, with anomalies and one-off spikes excluded. We do not count Reserved Instance purchases, Savings Plans, or promotional credits as savings - those are commitment decisions, not waste removal.
Does this work with multi-account AWS Organizations? Multi-region? Multi-cloud?
Multi-account: yes, that is the default. SEAWALL deploys via StackSets across your entire AWS Organization, including newly-created accounts automatically. Multi-region: yes, the guardrails follow your region allow-list. Multi-cloud: SEAWALL targets AWS today, the largest cloud-waste surface for most EU SMEs. An Azure equivalent is in development (Azure Budgets, Cost Management exports, Management Group policies, Azure Monitor alerts). If Azure is your primary cloud, register your interest and we will bring you into the early-access group.
Register for Azure early accessWe are an EU FinTech regulated under DORA. How does this help?
SEAWALL's guardrails are built around the control objectives behind DORA (ICT risk management), NIS2 (risk-management measures) and ISO 27001 (change management, segregation of duties). The deliverable includes a cost-governance evidence export - spend, anomalies, tag coverage and drift, with timestamps - that you can bring to your next internal audit or supervisory review. It is designed-around those objectives, not a certified framework mapping. Managed refreshes it quarterly.
Who actually does the work on the Managed tier?
One senior engineer - the same one you meet on the discovery call. No account managers, no offshore hand-off, no junior rotation. You get a direct line by email to the person holding the Terraform plan. The DIY tier is self-serve, with the same direct line for deployment questions.
Can we start on DIY and move up later?
Yes. DIY buyers get a credit toward Managed if they move up within 12 months. We do not punish moving up the stack.
Stop the bleed. Today.
DIY lands in your GitHub automatically right after checkout. Managed starts with a short onboarding call. Pick the depth that fits this quarter.
Need a one-off audit first? FinOps service + free cost audit
SEAWALL is the AWS code kit. These are the neighbours.
FinOps & Cost Management
The human-led practice across AWS, Azure, GCP and Microsoft 365, with a free cost audit to start.
OpenSaaS Auditor
The same waste-hunting instinct pointed at your SaaS stack instead of your cloud bill.
OpenCloud Licensing & Procurement
The licensing side of the same bill: CSP routing and wholesale procurement.
OpenDecide where the cloud bill is going before the next invoice sets it.
The workshop reads your billing exports with you, names the commitments you are carrying and writes down which ones you would sign again.
Every module, dashboard panel and SOP in the kit listed by file, with a separate block for the three that are still in development.