SEAWALL Engine.
AWS FinOps as Code.
Terraform-managed cost guardrails, a Grafana cost dashboard, anomaly detection wired to your comms channel, and cost-governance evidence aligned to DORA / NIS2 / ISO 27001 objectives, shipped as a product, not a Time-and-Materials gamble.
Thresholds and counts are read from the shipped template. The ~30% waste figure used elsewhere on this page is an industry benchmark (Flexera 2026), not a claim about your estate or our results.
Your AWS bill is bleeding. Quietly.
By independent estimate, around 30% of cloud spend is wasted (Flexera State of the Cloud 2026) - on resources nobody uses, nobody tagged, and nobody owns. Every month it compounds. Every audit makes it worse. Every quarter your CFO asks the same question with sharper edges.
Zombie resources accumulating
Idle EC2, un-attached EBS, orphaned NAT gateways, oversized RDS. Each one bleeds money quietly until quarter-end when finance asks why the bill grew again this quarter.
Anomaly detection is theoretical
AWS Budgets configured once, never tuned. Cost Anomaly Detection enabled in the console with default thresholds. Nobody gets paged when spend spikes 3x at 02:00.
Click-ops, no tagging discipline
Half the stack provisioned in the console, the other half in stale Terraform state. Tags applied inconsistently. Finance has no per-team cost attribution.
The anomaly desk, the ledger, and the kit itself.
Three views of the real kit: the anomaly procedure the SOP documents, an interactive waste ledger built on the five dashboard panels, and the template file tree you can read before you buy. Every fact is from the shipped template, not a mock-up.
What ships inside SEAWALL Engine.
No screenshots of a SaaS UI. No locked dashboards. Five concrete layers of code + configuration + documentation that land in your Git repository on day one.
Three Terraform Modules
- modules/budgets: an AWS monthly budget at 80 / 100 / 115% thresholds, plus Cost Anomaly Detection at $100 absolute impact, both publishing to one KMS-encrypted SNS topic (email + Slack)
- modules/cur: a Cost & Usage Report delivered to S3 in Parquet and queryable through Athena, the data the dashboard runs on
- modules/scps: two Service Control Policies, deny expensive EC2 families (p*, x*, mac*) and deny operations outside your approved EU regions
- A root main.tf that wires the three together from your terraform.tfvars, with versions.tf pinning the provider
Five-Panel Cost Dashboard
- The Black Hole: untagged spend with no Owner or Project tag, the leak that hides from showback
- Zombie instances: average CPU utilization over 30 days, so idle compute is obvious
- Orphaned EBS volumes: unattached storage still billing at full price
- NAT Gateway drain: hourly and per-GB data-processing charges, even on idle gateways
- Top 10 services by 30-day spend: where the money actually goes this month
Cross-Account Bootstrap
- cloudformation/leakproof-bootstrap.yaml: a scoped IAM role deployed via your management account
- An External ID on the role, with no long-lived access keys
- ReadOnly for the read-only work; write access only when you ask us to run it, with a documented blast radius
- Detach anytime: remove the role and nothing on our side is load-bearing
Tagging Framework + SOP
- docs/LEAKPROOF_SOP.md: a written tagging taxonomy (Owner / Project / Environment) and the triage playbook, not an enforced org tag policy - the framework, honestly labelled
- A SEV-1 to SEV-4 escalation matrix, so an anomaly gets the response it deserves and no more
- The recommended CI rule to fail pipelines that provision untagged resources (tflint), yours to wire in
- The Black Hole panel plus the SOP is how untagged spend stops being invisible
Cost-Governance Evidence
- Quarterly evidence snapshot: spend, anomalies, tag coverage and drift, with timestamps
- Versioned in your own S3 bucket + Git repo - you keep the evidence, not us
- Control-objective notes for DORA, NIS2 and ISO 27001 (designed-around, not a certified framework mapping)
- Evidence you can bring to a cyber-insurance renewal conversation
Read the code before you pay.
Two excerpts, the way they land in your repository. If a claim on this page is not in the template, it should not be here.
resource "aws_ce_anomaly_subscription" "finops" {
frequency = "IMMEDIATE"
threshold_expression {
dimension {
key = "ANOMALY_TOTAL_IMPACT_ABSOLUTE"
match_options = ["GREATER_THAN_OR_EQUAL"]
values = ["100"] # absolute USD, not a percent
}
}
subscriber { type = "SNS" address = aws_sns_topic.finops_alerts.arn }
}Why absolute dollars, not a percentage: a percent threshold lets a real leak hide behind a large base spend. $100 pages you whether the account bills $2k or $200k.
{
"Sid": "DenyAllOutsideApprovedRegions",
"Effect": "Deny",
"NotAction": ["iam:*", "sts:*", "cloudfront:*"],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": var.allowed_regions
}
}
}Why the EU lock: region enforcement is the cheapest GDPR / ISO 27001 data-residency control there is, and it blocks a whole class of accidental spend in regions you never meant to use.
Want to read the SOP and a runbook before paying €199? Ask, and we send LEAKPROOF_SOP.md and RUNBOOK-04-anomaly-response.md as-is. Ask for the files.
Buy the code. Or have us run it.
2 tiers, the same Terraform kit under both. The only difference is who runs it - you, or the engineer who built it.
DIY
Self-deploy. Buy once, own forever.
Best for
In-house team comfortable with Terraform that wants the SEAWALL blueprint without an engagement.
- Private GitHub repo: every Terraform module + Grafana dashboard JSON
- AWS Budgets, CUR pipeline, SCP modules ready to terraform apply
- Cost dashboard JSON (self-host Grafana, or use Grafana Cloud free tier)
- The written SOP: tagging taxonomy, triage runbook, SEV-1 to SEV-4 escalation matrix
- A direct line to the engineer who built it (email)
- Lifetime updates to the template (Git pull keeps you current)
Outcome
You ship the controls yourself. Zero lock-in. Your code from day one.
Managed
We operate the guardrails. You ship product.
Best for
FinTech, Maritime, Legal and other regulated estates that want the engine run for them, with audit-ready cost records.
- We deploy every SEAWALL module across your AWS organization to start
- Hosted Grafana cost dashboard (single-tenant, your account, EU)
- Monthly savings report (PDF, board-ready)
- 10 named engineering hours a month: anomaly triage with root-cause + remediation PR, SCP changes, IaC maintenance and drift resolution
- Quarterly review of scope with the same engineer - unused hours do not roll over
- Response in writing within one business day (business hours, not a 24/7 SOC)
- Quarterly cost-governance evidence export (spend, anomalies, tag coverage, drift)
- A direct line to the engineer who runs it (email)
Outcome
Predictable cloud economics: 10 named hours a month, reviewed quarterly, with a written response inside one business day.
Looking for a one-off diagnostic before committing to deploy? FinOps cost audit · free diagnostic
Every system it talks to, out of the box.
No middleware, no iPaaS, no premium connector add-ons. Native API + IaC integration with the surfaces your team already runs.
Built for EU-regulated estates.
SEAWALL is built for EU regulated entities. Every guardrail is designed around the control objectives your auditor cares about, and the cost-governance evidence export is part of the deliverable, not a paid add-on. It is designed-around those objectives, not a certified framework mapping.
ICT risk-management objectives (Article 6). Budgets, anomaly detection and SCP guardrails are designed around them, with timestamped evidence and remediation history.
Risk-management measures (Article 21). Tagging SOP, IAM baseline and logging evidence ship in the handover pack.
Annex A change-management and segregation-of-duties objectives, addressed for regulated EU operators.
Code-first. Git-native. Reviewable.
Your platform team sees the Terraform plan before any change lands. Every module is documented, versioned, and exits cleanly if you decide to leave.
Every Terraform module + Grafana dashboard JSON + SOP markdown sits in a private GitHub repository you are invited to at checkout. Tag-based release channel.
GitHub Actions workflow runs terraform plan on every PR and posts the diff as a review comment. Your engineers approve infrastructure changes the same way they approve code.
One CLI command revokes the SEAWALL IAM role across your AWS Organization. Terraform state stays in your bucket. Dashboards stay in your Grafana. Nothing on our side is load-bearing.
Stated limits
Microsoft AI Cloud Partner (PLA 7113951), Pax8 reseller. The AWS half is the Terraform kit below and is frozen but supported. There is no Azure kit and no Azure subscription on this page: Microsoft gives away for free everything the AWS kit sells - budgets, anomaly detection, scheduled reports, exports and the Landing Zone modules. GCP is not planned. We do not resell AWS and hold no AWS spend incentive: that advice has no margin behind it.
Read-only cost review
Open your own Cost Management export and read it in your browser, or grant a read-only role and let the engine read the subscription. It answers now, without a call.
- Your export is parsed on your machine and never uploaded.
- Every figure names the API or the column it came from.
- Anything the read could not see is reported as unread, never as zero.
- No credentials or billing exports through the public form.
Under the hood
The same collector that writes the paid monthly evidence pack, with its cost half pointed at your data. Columns are matched against the cost details schemas Microsoft publishes rather than by position.
Run it yourself
Azure Cost Review
Two doors. Read an export you already have, without it leaving your browser. Or grant the built-in Reader role, which permits reads and nothing else, and remove it yourself in one click afterwards.
There is no form in front of it. An email address is asked for only if you want the written report, and only after you have seen the figures.
Open the cost reviewThe questions FinOps leads ask before purchase.
How is SEAWALL different from Vantage, CloudHealth, Apptio Cloudability, or AWS Cost Explorer?
Those are dashboards. They tell you something is wrong, then bill you per user for showing you. SEAWALL ships the controls that stop the bleed: Terraform-managed Budgets, Service Control Policies, anomaly detection wired to your comms channel, and a tagging SOP your engineers actually follow. You keep the IaC. No per-seat SaaS fee, no vendor lock-in, no proprietary metric model that breaks when you switch tools.
Is the SEAWALL Terraform template really mine to keep?
Yes. Every module lives in your Git repository under a permissive internal-use license. We hand over the code, the state, the documentation, and the training. If you ever cancel a managed retainer, nothing breaks and nothing disappears. Your guardrails keep running.
We do not want anyone in our production AWS account. How does this work?
The DIY tier needs zero access from us: you clone, plan, apply. For the Managed tier, we provision a scoped IAM role using a CloudFormation StackSet with an External ID. ReadOnly during discovery; Write access only after a documented blast-radius review. You can revoke the SEAWALL role with a single CLI command at any time. All evidence is stored encrypted in the EU (Hetzner Falkenstein) and destroyed on request.
What counts as a "saving" in your reports?
Net reduction in monthly AWS invoice, measured against a frozen 90-day baseline, with anomalies and one-off spikes excluded. We do not count Reserved Instance purchases, Savings Plans, or promotional credits as savings - those are commitment decisions, not waste removal.
Does this work with multi-account AWS Organizations? Multi-region? Multi-cloud?
Multi-account: yes, that is the default. SEAWALL deploys via StackSets across your entire AWS Organization, including newly-created accounts automatically. Multi-region: yes, the guardrails follow your region allow-list. Multi-cloud: the AWS half is the Terraform kit; the Azure half is a different product on purpose. Microsoft already gives away budgets, anomaly detection, scheduled reports, exports and the Landing Zone modules, so a paid Azure kit would be selling something free. What Azure does not do is keep a record: the portal serves the last thirteen months, the figures exclude taxes, credits and support charges and are estimates until invoiced, and a subscription that changes offer loses its history at the change date. The Azure half writes a dated monthly pack instead. GCP is not planned.
Read a real pack we generatedWe are an EU FinTech regulated under DORA. How does this help?
SEAWALL's guardrails are built around the control objectives behind DORA (ICT risk management), NIS2 (risk-management measures) and ISO 27001 (change management, segregation of duties). The deliverable includes a cost-governance evidence export - spend, anomalies, tag coverage and drift, with timestamps - that you can bring to your next internal audit or supervisory review. It is designed-around those objectives, not a certified framework mapping. On Managed, the engineer regenerates it quarterly by hand - none of it is automated today.
Who actually does the work on the Managed tier?
One senior engineer - the same one you meet on the discovery call. No account managers, no offshore hand-off, no junior rotation. Managed is 10 named hours a month at that engineer's time, scope reviewed quarterly, unused hours do not roll over; it is not an on-call retainer. You get a direct line by email to the person holding the Terraform plan. The DIY tier is self-serve, with the same direct line for deployment questions.
Can we start on DIY and move up later?
Yes. DIY buyers get a credit toward Managed if they move up within 12 months. We do not punish moving up the stack.
Stop the bleed. Today.
DIY lands in your GitHub automatically right after checkout. Managed starts with a short onboarding call. Pick the depth that fits this quarter.
Need a one-off audit first? Free cost audit
SEAWALL is the AWS code kit. These are the neighbours.
Decide where the cloud bill is going before the next invoice sets it.
The workshop reads your billing exports with you, names the commitments you are carrying and writes down which ones you would sign again.
Every module, dashboard panel and SOP in the kit listed by file, with a separate block for the three that are still in development.