CloudWise Academy
Everything you need to get productive with CloudWise — an audio orientation, a study guide, flashcards, and a quiz. All generated from the product documentation, so it stays consistent with the reference docs.
Onboarding videos and a team deck are in production. If anything here disagrees with the written docs, the written docs win — please let us know.
🎧 Start here — 5-minute orientation
New to CloudWise? Listen first.
🎬 How to read a finding
Every CloudWise finding answers the same four things — cost, reason, fix, and your approval. Two minutes:
📖 Study guide
This study guide is designed for users and administrators learning to operate CloudWise, an agentic AWS cost-optimization platform. It synthesizes technical specifications, safety protocols, and operational workflows into a structured format for mastery.
I. Core Product Overview
CloudWise is an agentic platform designed to identify and remediate AWS waste using plain English interactions. It utilizes an AI agent (Claude, running on AWS Bedrock) to analyze billing data, explain cost leaks, and—upon explicit human approval—execute fixes.
The "Verb Ladder" Tier System
The product is structured around a ladder of capabilities, increasing in utility and cost:
| Tier | Name | One-Liner | Primary Feature | Daily Limits |
|---|---|---|---|---|
| Ask | Free | Your AI cost analyst. | 1 AWS account; waste scans; plain-English answers. | 5 questions |
| Watch | Shield | Your 24/7 watchdog. | Up to 5 accounts; real-time anomaly alerts; 180-day history. | 50 questions |
| Fix | Agentic AI | Stop finding waste—fix it. | One-click approve and execute; isolated write-access; automatic rollback. | 100 questions |
| Govern | Compliance | Governed remediation. | Air-gapped/pseudonymized mode; 365-day retention; PDF audit reports. | 500 questions |
Safety and Security Model
CloudWise operates on a "Safety First" architecture to ensure cost-saving actions do not compromise system integrity:
- Read-Only by Default: Detection and scanning require no write permissions.
- Human-in-the-Loop: No remediation action executes without explicit human approval.
- Deny-by-Default IAM: The execution role is limited to a specific allow-list of 42 services and 251 mutating API actions.
- Automatic Rollback: Every allowed action is paired with its inverse (e.g., a volume deletion is preceded by a snapshot for restoration).
- Audit Trail: Every proposal, approval, and execution is logged.
II. Waste Detection and Remediation
Detection Logic
CloudWise utilizes 189 active detectors (out of 196 defined types) categorized into 11 modules. These detectors are assigned confidence levels:
- High Confidence: 100% accurate, binary signals (e.g., an unattached EBS volume).
- Medium Confidence: Accurate with caveats; uses CloudWatch metrics and configurable thresholds (e.g., idle EC2 instances).
- Low Confidence: Housekeeping or informational flags (e.g., unused Lambda functions).
Risk Classification
Remediation actions are deterministically classified into three risk tiers:
- LOW (80 types): Cleanup tasks with no service impact (e.g., deleting orphaned snapshots or empty log groups).
- MEDIUM (75 types): Reversible changes to running resources (e.g., GP2 to GP3 migrations or rightsizing instances).
- HIGH (34 types): Destructive actions that are rollback-backed (e.g., terminating idle EC2 instances or databases).
III. Operational Workflows
Flow 1: Connection and First Value
The "wedge" for CloudWise is the time-to-first-value. A user connects a read-only IAM role via CloudFormation. Within minutes, the workspace displays a total waste figure and a ranked list of findings.
Flow 2: Air-Gapped/Pseudonymized Mode
For regulated environments, CloudWise offers an offline path:
- Local Export: A script runs locally in the user's environment.
- Salted-Hashing: Resource identifiers (Account IDs, Resource IDs, Tag Keys) are hashed on the customer’s machine using a secret "salt" that CloudWise never sees.
- Upload: The pseudonymized data is uploaded for analysis without exposing raw identifiers.
Flow 3: Remediation Execution
- Review: User opens a remediable finding and reviews the Bedrock-generated plan.
- Approve: The user grants approval.
- Execute: The system assumes a narrowly scoped write role (separate from the monitoring role).
- Verify: The result and rollback handles are written to the audit trail.
IV. Short-Answer Practice Questions
- What is the "wedge" strategy for CloudWise onboarding?
- Answer: Providing immediate value by connecting a read-only role in five minutes to show a real waste total before asking for write permissions.
- How many AWS services is the CloudWise execution role allowed to mutate?
- Answer: 42 services.
- What is the difference between a "High Confidence" finding and a "High Risk" remediation?
- Answer: Confidence refers to the certainty that a resource is actually waste (e.g., 90 days unattached). Risk refers to the potential impact of the fix (e.g., terminating a running instance).
- What happens to data in the Air-Gapped/Compliance tier if the user loses their "salt"?
- Answer: The user will no longer be able to correlate new uploads with previous anonymized data, and CloudWise cannot recover it because the salt never leaves the user's system.
- Which tier is required to access real-time anomaly detection and Slack alerts?
- Answer: The Shield (Watch) tier.
- What is a "Rollback Handle"?
- Answer: A reference or snapshot (e.g., an EBS snapshot created before volume deletion) that allows an automated action to be reversed from the audit trail.
- Why does CloudWise recommend the "unblended cost" metric?
- Answer: It shows the true cost allocation per service and includes specific discounts, whereas blended costs average rates across the account.
V. Essay Prompts for Deeper Exploration
- The Human-in-the-Loop Constraint: Analyze why CloudWise maintains a strict "propose-and-approve" model rather than offering fully autonomous remediation. Discuss the implications for trust in enterprise environments versus the speed of cost optimization.
- Security Architecture in Regulated Industries: Detail how client-side salted-hashing and the "Govern" tier's air-gapped mode address Data Loss Prevention (DLP) concerns. Explain the mathematical significance of the salt remaining on-site.
- The Evolution of FinOps Tools: Compare the "Agentic" approach (plain English queries and one-click fixes) to traditional cloud cost management tools that rely on complex dashboards and query languages. How does this shift affect the "CTO/Engineering Manager" audience defined in the documentation?
- Risk Mitigation Strategy: Explain the tiered logic of the Remediation Engine, focusing on the separation of monitoring and execution roles. Evaluate how "deny-by-default" IAM policies serve as a primary defense against runaway automation.
VI. Glossary of Important Terms
- Agentic AI: A system (in this case, powered by Claude on Bedrock) that can not only analyze data but also formulate and execute plans to achieve a specific goal (cost reduction).
- Air-Gapped Mode: A workflow where no live connection to AWS is required; data is exported, anonymized locally, and uploaded manually.
- Anomaly Detection: A Shield-tier feature using statistical z-score analysis to identify spending that deviates by more than 2 standard deviations from the 30-day baseline.
- CUR (Cost and Usage Report): The raw, detailed AWS billing file used as a primary data source for CloudWise analysis.
- External ID: A unique security string used in the IAM trust policy to prevent "confused deputy" attacks when CloudWise assumes a customer role.
- IAM Hop: The two-stage process where CloudWise first assumes its own service role and then chains into the customer's remediation role for execution.
- Pseudonymization: The process of replacing sensitive identifiers (like Account IDs) with deterministic hashes (
acct_xxxxxxxxxxxx) to maintain data utility while protecting privacy. - Salt: A secret, random string added to data before hashing in Air-Gapped mode to ensure the hashes are unique and non-reversible by third parties.
- Time-to-First-Value: The duration (typically minutes) between a user signing up and seeing actual cost-saving opportunities.
- Z-score: A statistical measurement used in anomaly detection to determine how many standard deviations a data point is from the mean.
🃏 Flashcards — AWS waste concepts
60 cards. Click a question to reveal the answer.
Why does a detached EBS volume still generate a monthly bill?
AWS reserves the storage capacity in the Availability Zone regardless of whether the volume is attached. You must explicitly delete the volume to stop the storage charges.
What defines an 'Orphaned EBS Snapshot' in a waste scan?
It is a snapshot whose original source volume has already been deleted from the account. These continue to incur costs indefinitely even though they cannot provide incremental recovery for the original workload.
Under what condition is an EC2 instance classified as 'Idle' by CloudWise?
The instance must show a CloudWatch CPUUtilization average of less than $5%$ over a 14-day period. This indicates the compute capacity is significantly under-provisioned for the current workload.
Why is an unassociated Elastic IP address charged a fee?
AWS imposes this cost to prevent the hoarding of a finite pool of public IPv4 addresses. The charge applies whenever the IP is allocated but not attached to a running resource.
What characterizes the 'LOW' risk remediation tier?
This tier includes cleanup actions that have no impact on the availability of active services. Examples include deleting orphaned snapshots or cleaning up incomplete S3 multipart uploads.
How does 'deny-by-default IAM' function in the CloudWise safety model?
The remediation role is restricted to a specific allow-list of approved API actions across 42 services. Any action not explicitly included in this allow-list is automatically rejected by the IAM policy.
What is the primary advantage of 'Rollback Pairing' during remediation?
Every destructive or mutating action is linked to an inverse action that can restore the resource. For example, a volume deletion is paired with a pre-execution snapshot to ensure the change is reversible.
Why does an 'Idle NAT Gateway' incur costs even with zero traffic?
NAT Gateways have a mandatory base hourly charge of $$0.045$ regardless of whether they are processing traffic. If the gateway processes zero bytes over a week, you are paying for idle infrastructure that serves no purpose.
What is the mechanism behind CloudWise's 'Air-Gapped Mode' privacy?
Resource identifiers are salted-hashed on the customer's machine before the data is exported for upload. This ensures that sensitive information like Account IDs never reaches CloudWise servers in plain text.
Why is gp3 storage generally preferred over gp2 for cost optimization?
gp3 volumes offer a $20%$ lower price point per GB while maintaining or exceeding the baseline performance of gp2. Transitioning to gp3 allows for immediate savings without requiring the volume to be detached.
What does a 'MEDIUM' risk remediation finding involve?
These findings involve reversible changes to running resources, such as resizing a database or a cache cluster. While the change is reversible, it may cause a brief service interruption or performance shift during the update.
How does 'Provisioned Concurrency' lead to waste in AWS Lambda?
This feature keeps execution environments warm and ready to respond, but you are charged for that readiness $24/7$. Waste occurs when the allocated concurrency significantly exceeds the actual invocation volume.
Define 'Commitment Coverage Gap' in the context of Savings Plans.
It represents the portion of your on-demand compute spend that could be covered by a commitment-based discount but isn't. Closing this gap by purchasing RIs or Savings Plans typically reduces the effective hourly rate.
What makes an S3 bucket an 'Empty Bucket' waste pattern?
The bucket must contain zero objects and have been created at least 30 days ago. While the storage cost is zero, these are flagged as hygiene findings to reduce clutter and configuration overhead.
Why is an 'AMI Orphaned Snapshot' classified as waste?
The snapshot was originally created to back an AMI that has since been deregistered or deleted. These snapshots remain in the account incurring storage fees despite having no parent AMI to reference.
What defines 'HIGH' risk in the CloudWise remediation model?
These are destructive actions, such as terminating an idle EC2 instance or deleting a running database. Although these actions are backed by rollbacks, they represent the highest level of service impact.
How does a NAT Gateway's billing differ from an S3 Gateway Endpoint?
NAT Gateways charge both a base hourly fee and a per-GB processing fee for all traffic. In contrast, Gateway Endpoints for S3 and DynamoDB are provided by AWS at no additional cost.
What is the 'deterministic' nature of the Air-Gapped salt?
Using the same secret salt ensures that the same AWS identifier always produces the same anonymous hash across different uploads. This allows for consistent cost trend analysis over time without revealing raw identifiers.
Why is 'MemoryUtilization' used to find oversized Lambda functions?
Lambda cost is calculated based on the memory allocated, so over-provisioning memory leads to higher costs per invocation. Functions consistently using less than $50%$ of their allocated memory are prime candidates for rightsizing.
What is 'Waste Detector Integration' in the CloudWise Agent?
The agent automatically fetches pre-computed scan findings to answer natural language questions about savings. It combines raw resource metrics with AI analysis to prioritize the most impactful optimizations.
Cloze: A _____ remediation involves destructive actions like terminating instances that are backed by a rollback handle.
HIGH risk
Concept: gp2 to gp3 migration.
Definition: A storage optimization that reduces EBS costs by $20%$ by switching to the newer volume type. Example: Converting a 1000GB gp2 volume to gp3 to save approximately $$20$ per month.
Why are 'Idle SageMaker Endpoints' a high-priority waste finding?
These endpoints charge for the underlying compute instances continuously as long as they are in service. If an endpoint has zero invocations over seven days, it is burning budget for unused model capacity.
How does CloudWise handle 'Unused Reserved Instances'?
The system monitors the utilization rate of purchased RIs and flags any that fall below $20%$. This identifies situations where a commitment is being paid for but is not offsetting on-demand costs.
What is the 'Trust band' promise for CloudWise onboarding?
New users can connect their accounts in a read-only state to start the first scan. This allows the tool to find waste without requiring any write permissions or credit card information upfront.
Why does 'Data Catalog Bloat' in AWS Glue incur costs?
AWS charges a fee for every 100,000 objects in the catalog once you exceed the one-million-object free tier. Excessive table versions created by frequent updates are the most common source of this storage cost.
What specific detection logic is used for 'Idle EFS File Systems'?
The scanner looks for file systems that have recorded zero client connections via CloudWatch for at least 14 days. These resources continue to bill for storage even if no data is being read or written.
How does 'S3 Intelligent-Tiering' prevent waste?
It automatically moves objects between frequent and infrequent access tiers based on actual usage patterns. This eliminates the need for manual lifecycle management while ensuring you pay the lowest possible rate for cold data.
Why are 'Incomplete Multipart Uploads' in S3 considered waste?
Abandoned or failed uploads leave behind data fragments that are charged at the standard S3 storage rate. Unless a lifecycle policy is configured to abort them, these fragments accumulate and bill indefinitely.
What distinguishes the 'Compliance' tier from the 'Shield' tier?
Compliance offers 365-day data retention and consistent pseudonymization using a client-held salt. It is designed for regulated teams who require air-gapped analysis without live account connections.
Why is 'RDS Publicly Accessible' flagged in a cost tool?
While primarily a security risk, publicly accessible databases are often misconfigured dev instances that should be terminated. Cleaning up these resources reduces both the attack surface and unnecessary spend.
What happens to a WorkSpace if it is switched from 'AlwaysOn' to 'AutoStop'?
The billing changes from a high fixed monthly fee to a lower base fee plus an hourly usage rate. This is highly effective for saving money on virtual desktops that are used infrequently.
How does the CloudWise Agent handle 'Natural Language Queries'?
It translates plain English questions into structured data views, such as cost charts or finding tables. This allows users to investigate spikes without writing complex SQL or navigating the AWS Console.
Why is 'Provisioned IOPS' on an EBS volume a common target for rightsizing?
You are billed for the amount of IOPS provisioned, regardless of how many operations the volume actually performs. If peak usage is consistently below $50%$ of the provisioned limit, you can reduce the limit to save money.
What is the role of 'CloudFormation' in the CloudWise setup process?
It provides a guided, automated way to deploy the necessary IAM roles for read-only account connection. This ensures that permissions are configured correctly and securely with a single click.
Why are 'Previous-Generation Instances' flagged by the scanner?
Older instance families like m4 or c4 are typically more expensive and less performant than their current-gen counterparts like m5 or c5. Upgrading often results in immediate savings and better workload efficiency.
What does 'Least Privilege Principle' mean for CloudWise IAM roles?
The monitoring role is granted only the absolute minimum permissions needed to read cost and resource metadata. It specifically excludes access to actual data inside your instances or databases.
Why is an 'Idle AppSync Cache' flagged as waste?
AppSync caches are billed based on the instance size and duration they are active, similar to RDS or ElastiCache. A cache with a $0%$ hit rate over 14 days provides no performance benefit while incurring hourly charges.
What is the 'Break-even analysis' for WorkSpaces billing?
It calculates the specific number of hours at which the AlwaysOn monthly rate becomes more expensive than the AutoStop hourly rate. CloudWise only recommends switching when the usage pattern shows a clear financial benefit.
How does 'Anonymization Salt' management work in Compliance mode?
The customer generates and holds the secret salt, which never leaves their local network or browser. CloudWise cannot reverse the hashed identifiers because it does not have access to this salt.
Why are 'Unused NAT Gateways' particularly expensive waste items?
They carry a fixed cost of over $$30$ per month even if they process no data at all. In a multi-AZ architecture, these costs multiply quickly across different regions and accounts.
What detection criteria is used for 'Idle Redshift Clusters'?
The scanner flags any cluster that has recorded zero query activity in CloudWatch for 14 consecutive days. These compute-heavy resources are among the most expensive idle items in an AWS bill.
Why is 'gp2' storage billed differently than 'gp3'?
gp2 billing is tied to volume size, whereas gp3 decouples storage capacity from provisioned IOPS and throughput. This decoupling allows users to pay only for the performance they actually need.
What is the purpose of 'Audit Trail' in the Agentic plan?
It records every proposal, approval, and execution event to provide a complete history of changes. This documentation is essential for security teams and compliance audits to track who authorized each cost fix.
Why are 'Untagged ECR Images' flagged for cleanup?
These are often intermediate build layers or old versions that have been superseded and no longer have a version tag. They consume registry storage space and contribute to monthly ECR costs without being accessible by name.
How does 'ElastiCache Valkey Migration' impact costs?
Switching from Redis OSS to Valkey provides an instant $20%$ discount on the node-based pricing. Valkey maintains compatibility with Redis 7.x APIs, making the migration low-risk for most applications.
What is the specific waste pattern 'EIP on Stopped Instance'?
This occurs when an Elastic IP remains attached to an instance that is in the 'stopped' state. Since the IP is not "active," AWS charges the standard unassociated rate of $$0.005$ per hour.
How does CloudWise classify findings by 'Confidence'?
Confidence ranges from High, which involves binary facts like unattached volumes, to Low for housekeeping items like unused Lambdas. This helps engineers prioritize fixes that are guaranteed to result in savings.
Why is 'Snapshot Age' a primary factor in identifying waste?
Old snapshots often represent point-in-time backups from resources that no longer exist or have been superseded by newer backups. Snapshots older than 90 days are usually redundant unless held for specific legal or compliance reasons.
What is 'Cross-Region Copy Overreach' in AWS Backup?
This waste pattern occurs when backup plans are configured to copy data to regions where the company has no operational presence. These copies incur both cross-region data transfer fees and additional storage costs.
Why does 'Empty CloudWatch Log Groups' clutter have a technical limit?
AWS imposes a default limit of 10,000 log groups per region. Deleting empty groups left behind by deleted Lambda functions helps stay under this quota and simplifies monitoring.
How does CloudWise's 'Verification Step' work during an upload?
The system inspects the files to detect whether the data is raw, anonymized, or mixed. This protects users by warning them if they are about to upload raw identifiers that violate their DLP policies.
What is the cost impact of 'EKS Extended Support'?
Once a Kubernetes version enters extended support, AWS adds a surcharge of $$0.60$ per cluster-hour. This can result in over $$400$ in additional monthly costs per cluster if the version is not upgraded.
Why is 'Storage Tiering' recommended for AWS Backup?
Moving backups to cold storage can save approximately $$0.01$ per GB per month compared to standard warm storage. This is ideal for long-term retention requirements where immediate retrieval is not necessary.
What defines an 'Idle Lightsail Database'?
The detector looks for managed databases with less than $1%$ CPU utilization and zero active connections for 14 days. These resources are charged a flat monthly rate regardless of their performance or usage.
Why is 'Service Concentration' flagged as an alert?
Having a single service account for a massive percentage of spend creates financial risk if that service's pricing or usage changes. It also identifies where optimization efforts will have the highest ROI.
How does the agent provide 'Proactive Insights'?
It suggests follow-up questions and highlights spending patterns that the user might have missed. This guides the user through a deep-dive analysis of their bill without requiring manual data crunching.
Why is 'Data Transfer Out' a major focus for cost analysis?
It is often one of the most expensive and least predictable components of an AWS bill. CloudWise analyzes transfer patterns to suggest optimizations like using CloudFront or VPC endpoints to reduce these fees.
What is the 'Minimum Confidence Level' setting in remediation?
This policy control allows users to filter out low-confidence findings from their automated remediation planner. It ensures that only the most certain waste items are presented for approval and execution.
How does 'Step Functions Retry Storm' waste money?
High failure rates leading to excessive retries can dramatically increase state transition costs. CloudWise flags workflows where retries exceed $25%$ of total executions to suggest architectural improvements.
✅ Quiz — check your understanding
10 questions. The correct answer is marked.
1. A user on the Shield plan wants to execute a remediation plan directly from the CloudWise Workspace. Why is the 'Approve & Fix' button unavailable?
- The Shield plan is propose-only and does not include the agentic execution engine. ✅
- The user has not yet deployed the read-only IAM CloudFormation stack.
- The finding is classified as HIGH risk, which prevents one-click execution regardless of the plan.
- The remediation engine requires a 24-hour warm-up period after a plan upgrade before execution is allowed.
Why
Execution of fixes is exclusive to the Agentic (Fix) tier; the Shield (Watch) tier provides guided instructions and anomaly alerts but requires manual implementation.
2. CloudWise detects a series of idle EC2 instances and proposes their deletion. Into which risk tier is this action deterministically mapped, and what is the safety mechanism?
- HIGH risk; the action is destructive but backed by an automatic rollback handle. ✅
- MEDIUM risk; the change is reversible because instance state can be restored from the audit trail.
- LOW risk; the agent has verified zero traffic for 14 days, ensuring no service impact.
- HIGH risk; the action requires a secondary approval from a security administrator to proceed.
Why
Destructive actions like deletion are classified as HIGH risk, and every allowed mutation is paired with its inverse action for recovery.
3. During the execution of an approved remediation, how does the CloudWise agent ensure it does not exceed its authorized scope within your AWS environment?
- It assumes an isolated write role restricted to an allow-list of 42 services and 251 mutating actions. ✅
- It uses the same read-only role deployed during onboarding but with temporary 'sudo' elevation.
- The agent executes commands via a local proxy that filters out any non-cost-related API calls.
- All write actions are performed in a sandboxed 'Shadow Account' before being replicated to production.
Why
The remediation role uses deny-by-default IAM, meaning only specifically allow-listed cost-saving actions can be performed.
4. A regulated team chooses Air-Gapped Mode for their cost analysis. When using the export script with the $--anonymize$ flag, where is the salt used for hashing AWS identifiers managed?
- The salt is held exclusively by the customer and is never transmitted to or stored by CloudWise. ✅
- The salt is automatically rotated and stored in an encrypted CloudWise DynamoDB table for each upload.
- The salt is derived from the customer's AWS Account ID to ensure deterministic hashing across teams.
- The salt is managed by a CloudWise-hosted AWS KMS key that the customer grants access to.
Why
Security is maintained by ensuring the salt never leaves the customer's network, making it impossible for CloudWise to reverse the pseudonyms.
5. An engineer notices a MEDIUM risk finding suggesting a GP2 to GP3 volume migration. Why might they choose to delay this action despite the projected savings?
- MEDIUM risk findings involve changes to running resources that may alter performance characteristics. ✅
- MEDIUM risk actions lack an automatic rollback handle in the current version of the product.
- GP2 volumes are currently exempt from the automated remediation allow-list for safety reasons.
- The agent cannot analyze CloudWatch metrics for GP2 volumes to verify if the migration is safe.
Why
GP2 to GP3 migrations involve changes to IOPS and throughput, requiring engineering review to ensure application performance remains stable.
6. A user on the Compliance tier needs to compare spending between Q1 and Q2. Which feature and data requirement are necessary for this analysis?
- QoQ Variance Reports; requires consistent use of the same client-held salt across multiple uploads. ✅
- Anomaly Detection; requires the deployment of a permanent agent in the master AWS account.
- Real-time Dashboarding; requires the 365-day retention policy to be manually enabled in Settings.
- Cost By Tag; requires the user to upload a mapping file that identifies raw resource names.
Why
To correlate resources over time in an anonymized environment, the same salt must be used so that identifiers hash to the same values.
7. The CloudWise agent identifies a waste finding with 'LOW' confidence. According to the product facts, how should a cautious engineer interpret this finding?
- It is an informational or housekeeping flag with minimal cost impact that should be reviewed during maintenance windows. ✅
- The finding is likely a false positive and the agentic engine will automatically block its remediation.
- The finding has a 50% probability of causing a service outage if remediated without manual verification.
- The finding is based on incomplete data because CloudWatch metrics were unavailable for that specific resource.
Why
Low confidence findings, such as unused Lambda functions (which cost $0), are categorized as low priority and intended for hygiene rather than immediate savings.
8. When setting up the connection to CloudWise, what is the significance of the 'External ID' provided during the IAM role creation process?
- It provides a required security layer that prevents the 'confused deputy' problem during cross-account role assumption. ✅
- It acts as the primary decryption key for the Cost and Usage Reports (CUR) uploaded in Air-Gapped Mode.
- It is a unique identifier used to link the customer's Slack workspace to the CloudWise notification engine.
- It is a session-specific token that expires after 15 minutes of inactivity in the Workspace.
Why
AWS best practices for third-party access require an External ID to ensure that only the intended CloudWise instance can assume your role.
9. What is the primary reason the Compliance (Govern) tier is 'Propose-only by design'?
- It operates on anonymized, offline data uploads, meaning the agent has no live path to execute changes in the customer account. ✅
- Regulated industries are legally prohibited from using AI agents to modify production infrastructure.
- The Agentic plan's isolated write role is currently incompatible with the client-side salt mechanism.
- The Compliance tier focuses on historical reporting (QoQ) rather than active waste remediation.
Why
Compliance tier users typically cannot grant third-party IAM access, so the product provides guided instructions for actions they must run themselves.
10. A user executes a remediation and then realizes it was a mistake. According to the 'Canonical User Workflows', how is this corrected?
- The user navigates to the audit trail entry for the completed remediation and triggers the paired rollback action. ✅
- The user must manually run the inverse CLI command provided in the finding's detail view.
- The agent monitors CloudWatch for performance degradation and automatically rolls back if errors increase.
- The user contacts CloudWise support to request a state-restoration from the service-level backups.
Why
CloudWise records a 'rollback handle' for every action, allowing users to reverse changes directly from the audit log.
🗺️ Product map
- CloudWise
- Product Overview
- Agentic AWS Cost Optimization
- Plain English Interface
- AI Agent (Claude on Bedrock)
- Read-only by Default
- Safety and Security
- Deny-by-default IAM
- Human Approval for Changes
- Automatic Rollback
- Audit Trails
- Client-side Anonymization (Air-Gapped)
- Tier Ladder
- Ask (Free)
- 5 Questions/Day
- 1 AWS Account
- Propose-only Fixes
- Watch (Shield)
- 50 Questions/Day
- 5 AWS Accounts
- Anomaly Alerts
- Prometheus Integration
- Fix (Agentic AI)
- 100 Questions/Day
- One-click Execution
- Remediation Queue
- Govern (Compliance)
- 500 Questions/Day
- 365-day Retention
- QoQ Variance Reports
- PDF Audit Reports
- Ask (Free)
- Waste Detection
- 190+ Detectors
- 40+ AWS Services
- Confidence Levels
- High: 100% Accurate
- Medium: Metrics-backed
- Low: Housekeeping
- Risk Tiers
- Low: No Service Impact
- Medium: Reversible Changes
- High: Destructive/Rollback-backed
- Core Workflows
- Connect via CloudFormation
- Automatic Scanning
- Finding Review
- Approve and Execute
- Rollback
- Key Features
- Natural Language Queries
- Cost Anomaly Detection
- Multi-channel Slack Integration
- Budget Alerts
- PDF Report Builder
- Product Overview
Training media is produced with NotebookLM from the CloudWise documentation and reviewed before publishing. Regenerated when the product changes.