What's New

The Terms of Service now say that a fix you approved on Agentic does not run after you move to another plan, and their list of services that receive data matches the Privacy Policy. Nothing is taken away from you.

Corrections

• Moving off Agentic: The Terms of Service said a fix you approved before a plan change "may still run". CloudWise now checks your plan right before it runs a fix. A fix that has not started when your plan changes does not run: it ends as failed and its credit is returned. A rollback you started before the change may still run.
• Turning remediation off: The Terms said that actions already waiting could still be approved while remediation is turned off in your remediation settings. They cannot be approved, and failed actions cannot be retried, until you turn it back on, and the Terms now say so. Turning remediation off also stops a fix you approved that has not started. They also say what happens when we pause all remediation: a fix you approved that has not started ends as failed, its credit is returned, and you can retry it once remediation resumes.
• Compliance plan: The Terms now say that the Compliance plan connects no AWS account, and that scanning of an account you connected on an earlier plan is paused.
• Who receives data: The list of services in the Terms now names the performance records Sentry receives, says what PostHog receives before and after you accept analytics cookies, and names our business outreach tools. The Privacy Policy has the detail.
• Fix records and settings: The Terms now say that the record of a fix can hold earlier settings of the resource it changed, so the fix can be undone, and that some settings AWS returns in plain text, such as Lambda environment variables, can hold a password if you put one there.
• After account deletion: The Terms now say that our backups, older versions of files, server logs and AWS audit log can hold some of a deleted account's data for a time, and point to the Privacy Policy for the periods. They also say, as the Privacy Policy does, that payment records are kept by Stripe and by us.

The service icons in your reports are now drawn by CloudWise itself, so opening a report sends nothing to an outside icon host.

The Reports table used to load an icon for each AWS service from a third-party website. That meant the site could see your IP address and which services were in your report.

CloudWise now shows a small coloured tile with the service's first letter instead. Nothing is requested from outside CloudWise for these icons.

The Remove AWS Account dialog now says that removing an account deletes its waste findings and daily resource cost history, and that its remediation records are kept.

Improvements

• Clearer remove-account dialog: Before you confirm, the dialog on the AWS accounts page names what is deleted from CloudWise (the account's waste findings and daily resource cost history) and what is kept (its remediation records).

The Privacy Policy now says more about what CloudWise keeps and sends: database backups, what error reports carry, the settings AWS returns in plain text, and the older Copilot interface, now removed. Nothing is taken away from you.

Corrections

• Backups: Something deleted from our database, such as a note you ask the Copilot to forget, can stay in our database backups for up to 35 days, and a deleted file can stay in our file storage as an older version for up to 30 days. Server log lines that name you can stay in our logs for up to 90 days, and our AWS audit log, kept for at least 1 year, can hold records with your user ID, email address or AWS account ID. The Privacy Policy said only for account deletion that database backups can hold data for up to 35 days, did not say how long our server logs or file storage keep it, and said our audit log held no customer data.
• Error reports: The Privacy Policy now says what our error reports (Sentry) carry and what we remove before they are sent: values with credential-like names, and text that looks like a token, a key or an email address. Until November 12, 2026, error reports from our servers could include what your browser sent with a request, such as a password typed to create an account, sign in, reset or change it, and a sample of performance records could include a password typed to reset or change it. They no longer do.
• Copilot: The Copilot in the Workspace still does not save your conversations. The older Copilot interface that could save them has been removed; the table that held what it saved was deleted on November 12, 2026, and AWS's backup of that table can hold it for up to 35 days after that.
• Settings AWS returns: Besides Lambda environment variables, a scan also receives ECS container environment variables, Glue job arguments, EMR configuration properties and Elastic Beanstalk environment properties, and does not store them. The Privacy Policy also says what a fix to a Glue job kept until November 12, 2026, and what an Air-Gapped export includes.
• Page addresses: The page addresses our site sends to Google Analytics 4 (if you accept analytics cookies), PostHog and Sentry keep only campaign tags and a plan or tier name after a "?". Until November 12, 2026, the addresses sent to Google Analytics 4 for the sign-up confirmation and password-reset pages included your email address.

The Privacy Policy and the Terms of Service now say exactly what CloudWise stores for the Copilot, what the contact forms and Report issue send, where two-factor sign-in is available, and what the Compliance plan includes. Nothing is taken away from you.

Corrections

• Copilot conversations: The Copilot in the Workspace does not save your conversations. The Privacy Policy now says so, and says what is kept instead: notes you ask it to remember and a daily question count.
• Contact forms: The Privacy Policy lists every detail the contact forms and the Report issue and Report a bug buttons send, including the page and the last Help question and answer when you write from the Help panel.
• Two-factor sign-in: The Terms of Service ask you to turn on two-factor authentication for your CloudWise account when you sign in with an email address and password, which is where CloudWise offers it.
• Compliance plan: The Terms describe the Compliance plan by what it includes: Air-Gapped Mode with long retention and upload history, PDF audit reports and the Report Builder. Remediation (plans and fixes) is not part of it.
• Lambda environment variables: The Privacy Policy now says that AWS returns a function's environment variables to the read-only role when a scan lists your Lambda functions. A scan does not store, log or send them.

Help no longer replaces a good answer with "the docs don't cover that" because it mentions a plain S3 path or a slash-joined pair such as m5.large/m5.xlarge.

Help withholds an answer that carries a web address off our site. It used to treat some harmless text as an address too, and showed the no-answer sentence instead. These now come through:

• an S3 path with a plain bucket name, such as s3://my-bucket/path/file.csv
• a slash-joined pair whose dotted parts don't end in a web domain ending, such as m5.large/m5.xlarge, node.js/TypeScript or report.pdf/report.csv

Text that can still be read as a web address is still withheld. That covers any part of a slash-joined name that ends in a real domain ending, such as main.tf/x or README.md/notes, and an S3 path whose bucket name looks like a domain.

If you approved a fix on Agentic and moved to another plan before it ran, CloudWise no longer runs it. It is marked failed with the reason, nothing changes in your AWS account, and its action credit is refunded.

Fixed

• Fixes approved before a plan change do not run: CloudWise now checks your plan right before it runs a fix. If you approved a fix on Agentic and moved to Compliance, Shield or Free before it ran, it is marked failed with "remediation is not part of your current plan", CloudWise makes no change in your AWS account, and the action credit is refunded. See Compliance tier.
• A new role set through the API is tested before it is saved: When a request to the CloudWise API changes an account's role ARN, CloudWise now tests the new role first, the same way it tests a new connection. If the role does not work, the account keeps its old role and the request is refused with the reason. Reconnecting from the AWS accounts page already did this.

Changed

• Remediation policy is read-only on Compliance: Remediation is not part of the Compliance plan, so the Remediation policy page shows your stored policy read-only, with the reason, instead of a Save that fails.
• The Workspace says "steps you apply yourself" on Compliance: The remediation card for an Air-Gapped finding now matches the docs. It no longer calls itself "propose-only" or says a proposal is logged to your audit trail.

The sign-up confirmation page now asks for your email address when you open it without one, instead of stopping, and the sign-up and password-reset pages no longer put your email address in the page address.

Improvements

• Confirm your account from anywhere: If you open the confirmation page on another device, in a new tab or after a refresh, it asks for your email address so you can enter your code, instead of stopping at "Email Required".
• Email address out of page addresses: After you sign up or ask to reset your password, the next page no longer shows your email address in its address, so it is not recorded wherever that address goes.

If you move to Compliance with an AWS account still connected, CloudWise now stops making AWS requests for it. Its findings stay readable, and moving back to Shield or Agentic resumes scanning without a reconnect.

Changed

• Scanning paused for a kept account: The Compliance plan gives CloudWise no access to a connected AWS account. An account you connected before moving to Compliance is kept, and its existing findings stay readable, but CloudWise stops scanning it and starts no new request for it, including the Cost Explorer requests AWS bills to your account. The account card on the AWS accounts page says so. Move back to Shield or Agentic and the next scheduled scan picks it up again, with no reconnect. Snapshots taken by earlier fixes are not deleted while you are on Compliance, so they stay, billed by AWS, until you delete them or move back. See Compliance tier.
• Remediation page on Compliance shows steps you apply yourself: Remediation is not part of the Compliance plan. If you moved from Agentic, the Remediation page now shows each finding's recommendation and Action steps, like Free and Shield, with no proposal, Review or Reject controls and no upgrade prompt. Fixes made on your earlier plan stay readable on their findings.
• A reconnect checks the new role first: When you reconnect an account with a new CloudFormation stack, CloudWise now tests the new role, the same way it tests a first connection, before it replaces the old one. If the new role does not work yet, the account keeps its old role and the connect screen tells you why.

The home page, the Academy page and two older release notes now say that the Compliance plan runs no fixes. It shows steps you apply yourself, and it includes no action credits.

Corrections

• Home page for regulated teams: The page for regulated teams now describes the Compliance plan by what it does: Air-Gapped analysis of an upload you choose, with PDF audit reports. It no longer mentions approvals or rollback, which belong to the Agentic plan.
• Older release notes: The February 17 and June 14 release notes each end with a dated correction. Only the Agentic plan has the approve flow and action credits.
• Academy page: The Academy quiz and lessons no longer give a hand-typed price or discount for Valkey, Elastic IPs or EKS extended support. They link the AWS pricing pages.

The connection template no longer grants lambda:GetFunction, which no check used. The Air-Gapped export now redacts Lambda environment variable values in every export.

The read-only role's template drops lambda:GetFunction, which returns a function's configuration and a link to download its code. No CloudWise check called it. Your stack keeps working without an update; updating removes the extra permission.

Listing functions still returns their environment variables as plain text. A scan through the read-only role does not store or log them; IAM best practices says what the role can read, and the two places they are still kept for now.

The Air-Gapped export script now replaces every Lambda environment variable value with REDACTED, with or without --anonymize. Download the script again before your next export.

The partner HTML report now opens with spend, savings, bill risks and what was not checked, so a client's finance manager can decide what to do.

Features

• Spend and savings: when the scan reads monthly spend, page one shows it next to the savings per month and per year. When it does not, the report says so instead of guessing.
• Risks of an unexpected bill: shown apart from savings and never added to them.
• What was not checked: skipped Cost Explorer, denied checks and regions scanned are on page one.
• Do these first: sorted by saving, with one figure per action. Housekeeping is a single line for the engineering team, with the detail later in the report.
• Plainer section names and a short key for the badges.

A masked partner report is now written when a scan warning names a resource that has no finding of its own, such as a new ECS service.

Fixes

• Masked reports: names built from a masked resource, like an ECS service named after its cluster, now get a label too. Before, the leak check refused to write the report.

Open Help from the side rail on any page to search the Help articles, ask the Copilot how CloudWise works, or take a guided Tour. What's New is now one dated list, the same in the app and in the docs.

New

• Help panel on every page: The Help button in the side rail opens a panel with the Help articles for the page you are on and a search across all of them. Help is the same panel as a full page.
• Ask the Copilot how CloudWise works: Type a question in the panel. The answer comes only from the Help articles and links the ones it used. When the articles do not cover your question, it says so and offers the contact form.
• Guided Tours: Start a Tour from the panel to be walked through connecting an account, reading a finding or setting an alert, and fixing a finding on plans that include fixes. A Tour that needs a connected account or a finished scan tells you so.
• One What's New: Changes you can see or use are listed by date, newest first, in the app and on the docs site.

Good to know

• Questions about your own AWS account are for the Copilot in the Workspace, which can read your account's data. The Help panel hands you over with your question filled in.

Help now sends questions about your own CloudWise invoice or subscription to the contact form instead of the Copilot. Tours that need findings tell Air-Gapped users to upload an export.

Improved

• Billing questions in Help: A question about your own CloudWise invoice, receipt or subscription now points you to the contact form, because the Copilot can only read your AWS account. Questions about how plans and upgrades work are still answered from the docs.
• Tours for Air-Gapped accounts: If your account is Air-Gapped, the Tours that need findings now ask you to upload an export first, instead of asking you to run a scan.

The AWS responses kept with a fix or its undo, and its failure messages, no longer include environment variables, the credential fields CloudWise recognizes, or tag values. A failed fix now says which step failed and why.

Improvements

• Fewer secrets in fix records: The AWS responses kept with a fix or its undo, and its failure messages, no longer include environment variables, the credential fields CloudWise recognizes, or tag values. The copy kept to undo a fix is unchanged: a Glue job's settings and an EBS volume's tags are still stored as they were. Fixes recorded before this change keep what they stored.
• Clearer failure messages: When a step of a fix or of its undo fails, the message names that step, the error AWS returned, and the steps that ran before it.

An EBS finding from Compute Optimizer now says exactly what changes, including provisioned IOPS and throughput, instead of repeating the same volume type and size.

Fixed

• EBS findings name the real change: When Compute Optimizer recommends lowering a gp3 volume's provisioned IOPS or throughput, the finding now shows the before and after values and the command to apply them. Before, it could read as if the volume stayed exactly as it was.
• Smaller sizes are explained: EBS cannot shrink a volume in place, so a finding that recommends a smaller size now says a new volume and a data copy are needed, and is marked as needing review.

The Compliance plan no longer accepts a connected AWS account, as it was designed. Connecting one now explains that Compliance works from Air-Gapped uploads and points you there.

Changed

• No connected AWS account on Compliance: Regulated teams grant CloudWise no IAM access, so the Compliance plan works from Air-Gapped uploads. The connect screens and the API now refuse a new connection and point you to the Air-Gapped page, instead of accepting one.

Good to know

• Your Air-Gapped limits are unchanged: Compliance still keeps several offline accounts and a year of uploads.
• An AWS account you connected before moving to Compliance stays listed and readable, and you can delete it. CloudWise does not reconnect it or run fixes on it, and its scans are paused while you are on Compliance (see "Scans of a kept AWS account pause on Compliance").

Every Help article was checked against how CloudWise actually behaves, and the wrong or outdated statements were fixed, so the Copilot's answers and links are more reliable.

Improvements

• Corrected Help articles: We checked the claims in the Help articles against the product and fixed the ones that were wrong or out of date, including what Action steps shows on a finding and how credit top-ups work.
• Better Copilot answers: The Copilot answers from these articles, so its answers and the links it gives are more accurate.

The workspace shows each region as it is scanned, a progress header with your monthly waste, and a short animation when a fix completes.

Features

• A live view of the scan: When you start a scan, the workspace shows a card for each region as it finishes, with findings landing as they are found and the time elapsed.
• A progress header: The workspace and the deeper app pages show your monthly waste first, then a cost-health score from the latest scan. The score can be shared as a card.
• A fix landing: When an action completes, the savings figure rises into its card. These animations are off when your device asks for reduced motion.
• A sample workspace that matches the sample scan: Before you sign in, the workspace replays a recorded scan of CloudWise's own test account, and the home page links to it.

Approving a fix that cannot be undone, above a low monthly estimate, now asks you to type the resource ID, and the chat can generate the plan.

Features

• A second confirmation for irreversible fixes: If a plan has no rollback and its monthly estimate is above a low threshold, approving or retrying it needs the exact resource ID typed in. The server checks it too, so a direct API call cannot skip it. Bulk approve skips such actions and tells you which ones need their ID.
• Plans from the chat: The agent can generate the plan for a finding you ask about and show it on the card, where it says whether the fix can be undone. See Remediation.

Each account now has a daily number of on-demand scans that depends on your plan, shown on the Scan now button.

Features

• A count on Scan now: The button shows how many on-demand scans are left today and, when none are left, that it resets at 00:00 UTC. The short wait between scans still applies, and the scheduled daily scan is not counted.

A public page shows a real read-only scan of CloudWise's own test account, with its findings, fix text and dollars.

Features

• /sample-scan: The sample scan is a scan of CloudWise's own test account, with account and resource names masked. It lists the findings the free CLI reports, shows only the kind, count and dollars for the ones that need a signed-in scan, and says plainly that it is a test account.

After your first scan results appear, the workspace may ask one optional question about what almost stopped you from getting there.

Features

• A single optional question: After your first findings render, the workspace asks "What almost stopped you from getting here?" once. You can answer or dismiss it. If an upgrade card is showing, the question waits for a later visit. The answer is deleted with your account.

If you pick Shield or Agentic when you sign up, you start on Free, connect AWS, and are offered the upgrade once your first findings appear.

Features

• Upgrade after the first findings: Signing up with email or with Google now works the same way. Your account starts on Free, no checkout opens, and when your first scan's findings show in the workspace an upgrade card offers the plan you picked. You can dismiss it with Not now.

CloudWise emails now use the site's look and name the sender, and the tips and scheduled report emails have a one-click unsubscribe.

Features

• One look for every email: Every email CloudWise sends uses the site's colours and names the company that sends it in the footer.
• One-click unsubscribe: The tips series and the scheduled cost report carry an unsubscribe link that works without signing in.
• A Tips Emails switch: Notification settings now has a Tips Emails toggle, and saving your other settings no longer turns tips back on.

The public site has a new design, a catalog of every waste check, a cookie choice for analytics, and one setup guide.

Features

• New design for the public site: The pages visitors see before signing in have a new look, with larger touch targets, a minimum text size and a menu that fills the screen on phones.
• A catalog of waste checks: Each waste check has its own page with the criteria it uses, and the catalog keeps its filters in the page address so you can share a filtered view.
• Analytics only after you accept: The public site loads Google Analytics and PostHog only after you accept analytics in the cookie banner. "Cookie settings" in the footer reopens your choice.
• One setup guide: The old setup page on the main site now redirects to the AWS Setup Guide.

The site now has a page for consultancies and managed service providers, with an example client report and how the free client review works.

Features

• /partners: The partners page shows an example client report built from example data, how the free client review works, and how the free CLI differs from the partner licence. The footer links to it as "For consultancies".

The cloudcostwise command-line tool runs a read-only waste scan on your machine with your own AWS credentials, and can also run as an MCP server.

Features

• `cloudcostwise scan`: Runs the free waste checks against your account from your own computer. It only makes read-only AWS calls and does not need a CloudWise account. It can call Cost Explorer, which AWS bills per request; the output says so, and `--no-cost-explorer` skips those calls.
• `cloudcostwise mcp`: Runs the same scan as a local MCP server, so you can ask Claude Code or Codex where you are wasting money on AWS. Its tools only read and explain findings and give fix steps as text; they do not change anything.
• A /cli page: The CLI page explains the tool and how to install it.

Findings from checks that cannot be validated against live waste now say so, and their savings no longer count in your headline total.

Features

• An Advisory label on estimated findings: A finding from a check that cannot be validated against live waste shows an Advisory chip, and its detail says it is estimated from configuration and not validated against live waste.
• Headline savings count validated waste only: The advisory savings are left out of the workspace and dashboard headline and shown on their own line. The Waste Detection Guide lists the advisory checks.

On the Agentic plan you can now ask CloudWise to generate a remediation plan for a single finding, read it, and approve it.

Features

• A plan for the finding you pick: Open an eligible finding on the Remediation page and choose Generate plan. CloudWise writes one plan for that finding, with its pre-checks, its calls and its rollback steps, and you decide whether to approve it. Plans are not generated for every finding after each scan. See Remediation.

Turning off automated remediation now holds queued approvals instead of losing them, action credits are charged and refunded per execution attempt, and the out-of-credits message shows correctly when a bulk approval can't be paid for.

Features

• Pausing automation now holds actions, never drops them: Turning off automated remediation now rejects new approvals until you turn it back on, instead of approving them with nothing left to run them. Already-queued approved actions are held, not lost, while automation is paused.

Bug fixes

• The out-of-credits message now appears when bulk-approving more fixes than you have credits for, instead of a generic error.
• Action credits are now charged and refunded per execution attempt, so a failed retry can no longer create a free credit.
• Fixed a DNS record cleanup that could target the wrong record in a routing policy with multiple record types at the same name.
• Fixed automated cleanup of unused VPC endpoints, which previously always failed to run.
• Anomaly detection now evaluates your most recent complete day of cost data instead of a day that has no data yet.

Correction (2026-11-10): Approved actions are not held while remediation is turned off. An approved action that reaches the run step while remediation is off fails with a policy-blocked reason and is not run, and any credit it used is refunded. Turn remediation back on and retry it if you still want it.

Cost anomaly alerts now respect a cooldown so a single spike doesn't repeat, scheduled anomaly detection runs correctly for every Shield account, and scheduled email reports show your real spend instead of $0.00.

Features

• Fewer repeat anomaly alerts: Cost anomaly alerts now wait at least 7 days before re-alerting on the same AWS account and service, unless the spike has grown substantially, so one cost spike doesn't flood your inbox.

Bug fixes

• Scheduled anomaly detection now correctly evaluates every Shield account, not just some of them.
• Compute Optimizer permission and enrollment issues found during a scan are now visible instead of silently skipped.
• Scheduled email reports now show your real total spend and top cost drivers instead of $0.00.
• Manually syncing cost data no longer produces backend errors.

Connected AWS accounts now show a correct credential-health status, and remediation cards no longer contradict their own risk level. Refresh on the remediation page fetches fresh results, and paid plans can connect more than one AWS account again.

Features

• Academy video: approve a fix, then roll it back: A short Academy walkthrough of approving a remediation and undoing it, so you can see the safety net before you use it.

Bug fixes

• The AWS accounts page no longer shows "Role broken" on connections that are working.
• The explanation on a remediation card no longer states a risk level that contradicts the card risk badge, including in the sample data.
• Refresh on the remediation page now fetches fresh results instead of a cached copy.
• Paid plans can connect more than one AWS account again.
• One-click connect now records the real CloudFormation stack name for your account.
• Automated fixes now always use the ExternalId unique to your account.

CloudWise now checks the credentials of every connected AWS account once a day and shows the result on each account card, with a Check now button. This release also fixes several connect, anomaly-detection and billing issues.

Features

• Credential health on every account card: Each connected AWS account shows whether CloudWise can still reach it and when it was last checked. Use Check now to re-check at any time; checks also run automatically once a day.

Bug fixes

• Disconnecting an AWS account now deletes its findings and cost data. Past remediation actions are kept as history.
• Anomaly detection runs on schedule for every connected account and reads the correct cost history.
• One-click connect gives each stack its own bucket and report names, so reconnecting an account no longer fails, and it stops waiting when a stack fails.
• The template-update banner now updates your existing stack.
• The account limit on the AWS accounts page now matches your plan.
• An unrecognized billing price can no longer change your plan.

Automated fixes now re-check your remediation policy right before they run, bulk approval covers low-risk actions only, and each connected account gets its own ExternalId for the remediation role. Each account also shows the status of its last scan.

Features

• Guardrails checked at execution time: Before an approved fix runs, CloudWise checks it against your remediation policy again. Bulk approval only includes low-risk actions.
• A unique ExternalId for every account: New connections use an ExternalId unique to your account for the remediation role, so no two accounts share one.
• Last scan status on each account: Each connected account shows when it was last scanned and whether the scan succeeded, so a failed scan is visible instead of silent.

Bug fixes

• Sign-in tokens are now signature-checked on every request.
• Stuck remediation actions are cleaned up automatically, and credits are refunded when a fix fails.
• Reserved Instance and Savings Plan findings are no longer dropped during cost reconciliation.
• Scans make fewer Cost Explorer calls billed to your AWS account.

The dashboard got a ground-up “Cockpit” redesign and a big speed-up, the workspace now lets you inspect a cost finding side-by-side with the list instead of in a pop-over, and reports follow the account you pick in the header. Offline/Compliance workspaces also get clearer, upload-first guidance.

Features

• Inspect findings side-by-side: In the workspace Findings view, clicking a finding now opens its full detail — the evidence, the safe-to-fix verdict, and a copyable read-only command — in a panel right beside the list, so you keep your place instead of losing the page behind a pop-over. On narrow screens it gracefully falls back to a focused panel.
• New “Cockpit” dashboard: The dashboard was redesigned from the ground up into a focused cockpit — your spend, savings, anomalies and top findings at a glance — and rebuilt to load noticeably faster, with the headline numbers painting almost instantly on repeat visits.
• Reports follow your account picker: The account you select in the header now scopes the Reports page too, so switching accounts updates your cost reports without a second set of controls. The cost agent can also break spend down by date range, granularity and per-account.
• Clearer guidance for offline accounts: Workspaces analyzing an uploaded Cost & Usage Report (no live AWS connection) now lead with upload-first guidance and connection-agnostic language, so air-gapped and Compliance users get advice that matches how they actually use CloudWise.

Bug fixes

• Made the dashboard load faster by trimming the data it fetches and querying it more efficiently behind the scenes.
• Cut cold-start latency so the first request after an idle period responds noticeably quicker.

The dashboard’s supporting cards — forecasting, anomaly alerts, cost-by-tag, usage and plan badges — now wear the dark design system, with money, savings and trends shown in a consistent on-brand palette across the dashboard and reports.

Features

• Dark-themed dashboard cards: The dashboard’s supporting cards (forecasting chart, anomaly alerts, cost-by-tag, usage and feature badges) and the shared cost display are now on the dark design system — consistent gold for money, green for savings, and red for cost increases, matching the rest of the app.

Air-gapped (offline) cost analysis now lives on its own dedicated page and wears the dark design system, so Compliance-tier workspaces that upload Cost & Usage Reports get a clean, focused home for offline analysis.

Features

• Dedicated air-gapped page: Air-gapped cost analysis is now a dedicated, dark-themed page rather than a mode bolted onto other screens — a cleaner home for uploading Cost & Usage Reports and reviewing offline cost breakdowns, with no live AWS credentials required.

The Reports experience — the filter bar, report tables, charts, export and report-builder — now wears the dark design system, with a clearer filter bar and on-brand colors for spend and savings.

Features

• Dark-themed Reports: The whole Reports surface (filter bar, tables, charts, export and the report builder) is now on the dark design system — clearer filtering, on-brand gold/green/red for spend and savings, and a consistent look with the rest of the app.

The Settings and Setup screens now wear the same dark design system as the rest of the app — your AWS accounts, notification preferences, subscription, API keys, MFA, budget alerts and the permissions/organization setup pages all match, with the page name shown once in the top bar. The “Connect AWS” page also now links straight to AWS Organization discovery (withdrawn on 2026-11-02) and the read-only permissions view.

Features

• Dark-themed Settings & Setup: Every Settings and Setup page (subscription, notifications, budget alerts, API keys, password, MFA, AWS accounts, permissions, organization discovery) is now on the dark design system for a consistent, on-brand look — cleaner forms, clearer toggles, and the page title shown once in the breadcrumb instead of repeated in the body.

Bug fixes

• The AWS Accounts page now links to AWS Organization discovery (withdrawn on 2026-11-02) and the permissions view for connected accounts (previously hard to reach); the organization-discovery flow gained a clear way back.

The Remediation screen — where you review, approve and roll back AI-suggested fixes — now matches the app’s dark design system, with clearer status, risk and savings cues.

Features

• Dark-themed Remediation: The remediation queue, action cards, execution timeline and savings widgets are re-skinned to the dark design system — approve/reject actions, risk and reversibility, and realized-vs-projected savings all read more clearly at a glance.

The app’s cross-cutting banners — stale-data warnings, account status, template-update prompts, the new-features and demo banners — now render through one consistent design-system component, so notices look and behave the same everywhere.

Features

• Unified Notice Banners: Stale-data warnings, account-status and template-update prompts, the new-features banner, profile-completion and demo notices are now all built on a single dark design-system “Notice” component — consistent styling, spacing and dismiss behavior across the app.

The workspace rail is no longer just shortcuts — Overview, Findings, Remediations, Cost and Commitments are now real, selectable views you can open directly and deep-link to. Click any waste finding to open a detail drawer with the evidence, a copy-ready read-only command, and a one-click “ask the agent to fix this”.

Features

• Selectable Workspace Views: Overview, Findings, Remediations, Cost and Commitments are now distinct views with their own URL — open one straight from the rail, refresh or share the link, and the workspace remembers where you are. The conversation is still one click away and every view can hand off to the agent.
• Finding Detail Drawer: Click a waste finding to slide open a detail panel: why it’s flagged, a safe-to-fix / needs-review verdict, a copyable read-only command to verify it yourself, and a button to ask the agent to remediate it.

A shared design-system layer now backs the pages across the app for a consistent, on-brand look, and the app chrome is sticky — the top bar, product rail and notices stay put while only your content scrolls.

Features

• Sticky App Chrome: The top bar, product rail and the notices strip now stay pinned while the page body scrolls underneath — navigation and account context are always in reach, no matter how long the page.

The assistant now scopes its answers to the account(s) you’ve selected and can compare across them — ask about one account, a subset, or all of them, and commitment coverage is reported correctly across every account instead of just the first.

Features

• Multi-Account Aware Assistant: Cost, findings, commitments and alerts questions now honor your account selection and accept per-account scope, so “compare my two accounts” or “show costs for account X” work as expected. Reserved-instance and Savings-Plan coverage is now summed across all your accounts.

Bug fixes

• Commitment (RI/Savings Plan) coverage no longer reports only the first account — all selected accounts are included.

The workspace header now scopes the whole surface to the account(s) you pick — connected or air-gapped, one or several. Select “All accounts”, a single account, or a subset, and the agent answers for exactly that scope; account-status and stale-data notices follow your selection too.

Features

• A Real Account Switcher: The header account picker is now multi-select and scopes the workspace: choose connected and offline (air-gapped) accounts distinctly, within your plan’s limits, and your selection persists as you move around. Stale-data and account-status notices moved up into the app-wide notices strip, scoped to what you’ve selected.

Every signed-in page now lives inside a single, consistent app shell — the same product rail, tabs, account switcher, and user menu wrap the workspace, reports, settings, and setup. No more jarring jumps between differently-chromed pages.

Features

• A Unified App Chrome: The workspace, reports, settings, and account setup are now framed by one shared Rail + Tabs shell, with the account switcher and a single sign-out/settings menu in the header everywhere. The whole signed-in product reads as one continuous surface.

Sign-in, sign-up, and every account screen are rebuilt on the CloudWise design system — the same dark, gold-and-periwinkle look as the workspace. Your first and last touchpoints now match the product in between.

Features

• Auth Pages, On Brand: Login, registration, password reset, email verification, and the MFA challenge are redesigned to match the agentic app — one consistent dark theme, type, and accents from the landing page all the way into the workspace. No flow changed; it just looks like one product now.

The air-gapped analysis flow is now reachable from every entry point and on every tier, so regulated teams can always start an offline analysis from the workspace — no dead ends.

Features

• Start an Offline Analysis from Anywhere: Air-gapped (offline) analysis is now wired into the connect flow and the no-data workspace state, and reachable on every plan — so teams that can’t connect a live AWS account always have a path to upload a cost export and get findings, right inside the conversation.

The agentic cutover completes: the workspace is now where CloudWise begins. Air-gapped analysis runs with full governance inside the conversation, fired cost anomalies surface the moment they land, and the legacy standalone pages are retired in favor of the agent.

Features

• Sign In, Land in the Workspace: The post-login front door is now the agentic workspace — ask about spend, waste, commitments, anomalies, and remediations in one conversational surface. The legacy dashboard and standalone pages are retired; everything you did across them is answered by the agent.
• Air-Gapped Analysis, Full Governance In-Conversation: Regulated teams who can’t connect a live AWS account get the complete offline flow inside the workspace — Standard / SHA-256 / DLP-Strict governance modes, multi-region, the checksum-verified export command, salt and account management, and upload history. Completed analyses render as findings in the conversation, with no data leaving your environment.
• Cost Anomalies, Surfaced the Moment They Fire: When the detector flags a spend spike, the workspace overview now carries a severity-toned badge (“N cost anomalies flagged →”) so you see the unusual without going looking. One click asks the agent for the detail — service, baseline vs. current, percent change, and severity.

Every CloudWise email — budget alerts, anomaly spikes, waste findings, remediation approvals, cost reports, account reminders — is rebuilt on one shared template that matches the agentic app. Cleaner, consistent, and every link now points at the workspace.

Features

• Agentic Email Redesign: All transactional emails now share a single light, deliverable template wearing the new brand — the CloudWise wordmark header, the gold and periwinkle accents, the same type treatment as the app. Budget alerts, cost-spike anomalies, waste-findings digests, remediation approvals and results, scheduled cost reports, and onboarding reminders all look like one product, and every call-to-action links into the workspace.

The agentic workspace gains the Audience-A surfaces: ask the agent about your remediation guardrails, see fired cost anomalies and the spend trend inline, and start an air-gapped analysis without leaving the conversation. A first-run greeting and cross-cutting notices round out the experience.

Features

• Your Remediation Guardrails, Explained: Ask “what are my guardrails?” and the agent shows the rules it obeys before proposing or running a fix — minimum confidence, maximum risk, the dollar threshold that requires MFA, daily caps, and exclusions — with a direct link to edit them in Settings.
• Cost Anomalies, In the Conversation: Recent spend spikes the detector flagged now surface as a card in the workspace — service, baseline vs. current cost, percent change, and severity — so you can spot the unusual without leaving the agent.
• Spend Trend, Inline: Ask where your spend is heading and the agent renders a clean trend line for the window — no separate reporting page.
• Air-Gapped Analysis, Agent-Guided: Regulated teams who can’t connect a live AWS account can start an offline cost-export analysis from the workspace — the agent explains the no-egress flow and hands off to a checksum-verified upload.

The workspace now answers spend, not just waste. Ask “where’s my money going?” and the agent breaks down cost by service and region, shows your Reserved Instance and Savings Plan coverage, and surfaces budget variance — the cost pages are now fully agentic.

Features

• Cost Views, Now Agentic: Spend by service and region, trend, and budget variance are answered conversationally with rendered cards — “where’s my money going?” returns your actual spend, with waste as a layer on top. The standalone cost and reports pages are retired in favor of the workspace.
• Commitments Coverage on Ask: Ask about Reserved Instances and Savings Plans and the agent shows coverage, utilization, and commitment risk as a card — the old savings page, re-expressed in the conversation.

The Copilot now answers your support questions directly — “how do I connect read-only?”, “why can’t I execute a fix?” — grounded in a freshly reviewed FAQ corpus. The Help page stays as a clean, searchable fallback with the feedback form.

Features

• Support Answers in the Copilot: Ask the agent a product or support question and it answers from a reviewed FAQ corpus (tiers, pricing, connecting read-only, remediation, air-gapped mode) right in the conversation — no context-switch to a docs page. Help survives as a thin re-skinned fallback with search and the feedback form. Learn more

The entire settings cluster — password, two-factor, API keys, notifications, budget alerts, subscription, remediation policy — moves onto the new CloudWise design system through one shared shell, so settings and the agentic workspace feel like a single product.

Features

• Settings Cluster Re-skin: Every account/settings page is rebuilt on the design system via a shared settings shell with consistent navigation: change password, two-factor auth, API keys, notification preferences, budget alerts, subscription, and remediation policy. Conventional, fast forms — no chat surface where it doesn’t belong.

The in-app cost Copilot now runs on Claude via Amazon Bedrock — the same as the rest of the platform. Your cost data stays inside AWS under IAM auth, with no third-party AI subprocessor on the path.

Features

• Copilot on Amazon Bedrock: The dashboard Copilot migrated from OpenAI to Claude on Amazon Bedrock (Haiku 4.5 for everyday questions, Sonnet 4.6 for deep analysis). Your cost data never leaves AWS — IAM auth, no external AI key. Answers are grounded strictly in your own cost data.

A two-currency usage model arrives: everyday Copilot questions plus monthly action credits for executing remediations. The waste overview now renders a live trend from your own scan history, and AI-generated action steps moved onto Claude on Amazon Bedrock — your cost data stays inside AWS.

Features

• Usage Metering & Action Credits: Two clear meters: Copilot questions (a generous daily allowance that upsells rather than hard-stops) and monthly action credits that are spent only when you execute a remediation. Agentic includes 20 credits/month, Compliance 100. A new credits view shows exactly where you stand.
• Live Waste Trend: The waste overview now plots a real trend line from your own scan-history baselines, so you can see your estimated waste move over time instead of a single snapshot.
• AI Action Steps on Amazon Bedrock: Generated remediation action steps now run on Claude (Haiku 4.5) via Amazon Bedrock with IAM auth — your cost data stays inside AWS, with no third-party AI subprocessor on this path.

Correction (2026-11-12): This note said Compliance includes 100 action credits a month. It includes none, because Compliance runs no fixes. Only Agentic includes action credits.

The workspace agent now carries durable, cross-session memory: tell it a preference once and it remembers across new threads and restarts. Memory is stored per-user, recalled automatically, and you stay in control — ask it to forget and it forgets.

Features

• Cross-Session Memory: Share a preference or a fact about your environment and the agent retains it across conversations — recalled deterministically on every turn, with explicit save/forget so you remain in control of what it keeps. Learn more

The workspace agent moves to a true tool-calling conversation core: one loop powers both the anonymous sample experience and your live connected account, so the agent reasons, calls the right tools, and responds in a single coherent flow.

Features

• Tool-Calling Conversation Core: A unified conversation loop on Claude via Amazon Bedrock drives the agent across both the sample demo and your live account — picking and calling the right tools (overview, findings, remediation) to answer naturally instead of following a fixed script. Learn more

The biggest release of the redesign: /workspace is now a conversational agentic surface. The agent opens with where your money is going, renders findings and remediations as cards in the conversation, and — on Agentic — executes approved fixes with automatic rollback. Anonymous visitors get the full workspace on a sample account: the demo is the app.

Features

• The Agentic Workspace: Talk to your AWS bill: waste overview with a selectable trend window and per-service markers, findings ranked by impact with confidence and risk, region breakdowns, propose-vs-execute remediation cards with a full status journey (approve, roll back within 24h, retry, report an issue), and a remediation activity view — all rendered inline in the conversation. Learn more

The documentation site now wears the same dark CloudWise brand as the product — same palette, same type system, same feel from the homepage through the guides.

Features

• Docs Site Re-theme: docs.cloudcostwise.io re-themed onto the CloudWise design system: dark brand, new navigation chrome, and consistent typography across every guide.

Every public page — about, contact, privacy, security, terms — now lives in the redesigned dark shell, and the blog is server-rendered: posts load fast, read cleanly, and ship proper article markup for search engines.

Features

• Marketing Pages Redesign: The full marketing shell re-skinned on the CloudWise design system, with a server-rendered blog (faster loads, syntax-highlighted code, SEO-ready article metadata).

Pricing rebuilt on the new design system: Free, Shield, Agentic AI, and Compliance side by side, with a monthly/annual toggle (annual saves up to 35%) and clearer feature lists per tier.

Features

• Pricing Page Redesign: Four tiers with their verbs — Ask (Free), Watch (Shield), Fix (Agentic AI), Govern (Compliance) — a monthly/annual billing toggle, and badges marking the recommended and most popular plans.

Housekeeping release: the sign-up conversion event fires reliably again, and marketing links follow one consistent UTM convention so campaign attribution stays clean.

Bug fixes

• Fixed the sign_up analytics event not firing on some registration paths
• Standardized UTM parameters across marketing links for accurate campaign attribution

A new register-and-connect spine: sign in with Google or a magic code, add a read-only CloudFormation role, and land in the workspace — one continuous flow, no long forms, demo never gated.

Features

• Register + Read-Only Connect Flow: Minimal registration (SSO or emailed code) straight into the read-only AWS connect step, inside the same workspace shell you keep after connecting. Your first scan kicks off automatically.

The landing-page demo now answers free-typed questions through a guardrailed CloudWise agent running on AWS Bedrock — rate-limited, scoped to the sample account, and safe to open to everyone. (Includes 1.65.1: dependency security updates.)

Features

• Public Demo Copilot: Ask the agent anything about the sample AWS bill before signing up. Answers come from Claude on AWS Bedrock behind server-side guardrails: fixed context, per-session rate limits, and a token cap.

Bug fixes

• Bumped backend dependencies past published security advisories (1.65.1)

CloudWise repositions as an agent for your AWS bill. The new homepage opens with a live mini-agent demo on a sample account, the Ask→Watch→Fix→Govern ladder, and a refreshed brand kit.

Features

• Agentic Landing Page: Talk to the agent about a sample bill right on the homepage — overview, findings, and remediation cards rendered in the conversation — with positioning for both startup and regulated audiences.

The CloudWise redesign begins: a dark, focused design system — tokens, typography, and accessible primitives — that every surface (landing, workspace, pricing, docs) now builds on.

Features

• Design System Foundations: Shared color tokens, Space Grotesk / Inter / JetBrains Mono type, and accessible UI primitives (buttons, cards, chips, segmented controls) — the visual language of the new CloudWise.

New engineering deep-dive on the blog: the Commitment Risk Score — a four-signal composite (instance-family churn, spend volatility, resource lifecycle, and existing commitment utilization) that tells you whether your architecture is stable enough to safely buy Reserved Instances or Savings Plans.

Features

• RI Commitment-Risk Guide: A technical explainer of how to score commitment risk before you lock in RIs or Savings Plans, with a worked example of the family-churn signal and copy-pasteable AWS CLI commands. Learn more

The in-app release notes got a full overhaul: the complete history is backfilled (v1.45–v1.59), entries are organized by year so the hub scales, and a drift gate now fails the build if notes fall behind the shipped version.

Features

• Release Notes Hub: Browse the complete CloudWise release history in-app — backfilled through v1.45, organized by year, with highlighted features surfaced in the "New Features" banner. Learn more

This release added AWS Organizations auto-discovery. It was withdrawn on 2026-11-02. Connect each AWS account on its own with one-click setup.

Features

• AWS Organizations Auto-Discovery (withdrawn): Listed the member accounts of an AWS Organization for bulk onboarding. Withdrawn on 2026-11-02. Connect each AWS account on its own with one-click setup. Learn more

Track budget-vs-actual spend at a glance with the new Budget Variance Dashboard, and have any report delivered to your inbox automatically on a daily, weekly, or monthly schedule. Variance is available to all tiers; scheduled email delivery rides on the existing report pipeline.

Features

• Budget Variance Dashboard: See planned vs. actual spend per budget with over/under variance, trend direction, and drill-down. Surfaces overruns before the month closes so you can act early. Learn more
• Scheduled Email Reports: Schedule any CloudWise report for automatic email delivery on a daily, weekly, or monthly cadence. Your scheduling preference now persists across sessions. Learn more

Bug fixes

• Scheduled-reports preference now persists correctly end-to-end (frontend → endpoint → repository → read-back)

Strict data-loss-prevention controls (DLP-Strict / SHA-256) are now gated behind a clear feature flag for air-gapped deployments. Behind the scenes, five notification and data-lifecycle services were completed — alerting, Slack/webhook delivery, cost trending, archival, and reprocessing — and error reporting was tuned to cut noise.

Features

• Air-Gapped DLP-Strict Control: DLP-Strict mode with SHA-256 anonymization is now an explicit, gated control for air-gapped uploads — clearer about exactly what hardening is active.
• Alerting, Slack & Webhook Delivery: Completed alerting, Slack/webhook notification delivery, cost-trending, data archival, and reprocessing services so alerts and integrations fire reliably. Learn more

Bug fixes

• Reduced Sentry error noise and added graceful degradation when auth dependencies are briefly unavailable
• More resilient login and MFA verification under cold-start conditions

Free accounts now have a clear single-AWS-account limit with a contextual upgrade prompt when you connect a second, and new users receive a short, helpful onboarding email series after signup.

Features

• Free-Tier Account Limit + Upgrade Prompt: Free tier supports one connected AWS account. Adding a second returns a clear in-product upgrade prompt instead of a generic error.
• Post-Signup Onboarding Emails: A three-email nurture series helps new users connect an account, run a first scan, and find quick wins in their first days.

Several first-run improvements make it faster to see CloudWise in action: a clearer demo call-to-action, a more discoverable air-gapped path, and direct links into the AI Copilot from key pages.

Features

• Clearer Demo & Copilot Entry Points: Prominent "Explore with sample data" CTA, a more visible air-gapped upload path, and inline AI Copilot links so you reach insights in fewer clicks.

Tier prices are now driven from a single source of truth, so pricing shown across the app, marketing pages, and upgrade prompts always matches.

Features

• Single Source of Truth for Pricing: All tier prices ($19 / $49 / custom) now come from one definition, eliminating mismatches between the pricing page, upgrade prompts, and checkout.

A dedicated dashboard surfaces your Reserved Instance and Savings Plan commitments — utilization, upcoming expiries, coverage gaps, and risk — bringing the commitment-intelligence backend (from v1.38) into a single management view.

Features

• RI / SP Management Dashboard: Review all Reserved Instances and Savings Plans in one place: utilization, expiry timelines, coverage gaps, and purchase-risk scoring — so commitment decisions are informed and timely. Learn more

Bug fixes

• Reproducible Docker builds via npm ci with lock file

Completed the remaining payment-flow handling in the Stripe webhook processor so subscription lifecycle events are processed reliably end-to-end.

Features

• Reliable Subscription Lifecycle Handling: Stripe webhook processing now fully handles the payment lifecycle (activation, updates, and failures), making tier changes and billing state more dependable.

The CloudWise blog now publishes a standards-compliant RSS 2.0 feed so you can follow updates in any reader, alongside fixes to blog rendering, social previews, and pagination.

Features

• Blog RSS Feed: Subscribe to CloudWise blog posts via a valid RSS 2.0 feed at /blog/feed.xml — follow product and cost-optimization content in your reader of choice.

Bug fixes

• Fixed blog hydration mismatch and improved Twitter/social preview cards and pagination links

A focused security pass across the platform: in-memory rate limiting on auth, AI, and scan endpoints; hardened auth cookies; removal of legacy auth bypasses and backdoors; safer secret handling; and HTML-escaped email templates. Most of this is invisible day-to-day — by design — but it materially strengthens account protection.

Features

• Endpoint Rate Limiting: Auth, AI, and scan endpoints now enforce in-memory rate limiting to blunt abuse and brute-force attempts.
• Hardened Auth Cookies & Token Handling: Authentication cookies now set httpOnly, Secure, and SameSite flags, and legacy JWT signature-skip and dev-mode access bypasses were removed.

Bug fixes

• Removed a hardcoded test-token backdoor from authentication
• Parameter Store webhook secret loading now fails closed when unavailable
• Parameter Store cache entries now expire (TTL) to avoid serving stale secrets
• User-supplied values are HTML-escaped in email templates
• Added a gitleaks pre-commit hook and redacted historically committed credentials

Sentry error tracking is now integrated for faster issue detection and resolution. Remediation got a reliability pass — approve buttons unblocked across many waste types, deterministic load-balancer plans, and rollback safety for skipped actions. Scans now route detectors by customer tier, and a public IAM permissions page makes onboarding more transparent.

Features

• Error Monitoring (Sentry): Integrated application error tracking so regressions are caught and resolved faster — improving overall reliability for everyone.
• Tier-Based Detector Routing: Scans now route detectors end-to-end by customer tier, with a focused free-tier detector set for faster, more relevant results.
• Public IAM Permissions Page: A public page documents exactly which IAM permissions CloudWise requests, so you can review access before connecting.

Bug fixes

• Unblocked remediation approve buttons across many waste types
• Deterministic remediation plan for idle load balancers with dashboard price alignment
• Rollback is now correctly rejected for skipped actions, with UI overflow fixes
• Fixed NAT Gateway and Lambda provisioned-concurrency remediation planning
• Enabled Shield PDF generation and granted the API access needed for it

Four new ElastiCache waste detectors: replication waste (non-production replicas), Valkey engine migration (20% savings), Serverless optimization (spiky workloads), and data tiering opportunity (R6gd, up to 52% savings). Expanded ElastiCache pricing map with R6gd, R7g, M7g, T4g families. Total detector count rises to 189.

Features

• ElastiCache Replication Waste (Non-Production): Detects non-production clusters with unnecessary replicas. Each replica doubles/triples the cluster cost for no HA benefit in dev/staging. Learn more
• ElastiCache Valkey Migration Savings: Identifies Redis OSS and Memcached clusters eligible for 20% cheaper Valkey engine with API compatibility. Learn more
• ElastiCache Serverless Optimization: Flags node-based clusters with spiky traffic patterns (high CV, low avg CPU, high peak CPU) better suited for Serverless. Learn more
• ElastiCache Data Tiering Opportunity: Recommends R6gd data tiering for large memory-only R5/R6g/R7g clusters — up to 52% cost reduction through fewer nodes. Learn more

Five new Elastic Beanstalk waste detectors plus a refactored existing one, all using the DataProvider abstraction for full online/offline parity. Covers traffic-based idle detection, unnecessary ALBs on single-instance environments, previous-generation instances, over-provisioned sizing, and orphaned RDS databases. Total detector count rises to 185.

Features

• Beanstalk Idle Traffic Detector: Detects environments with zero CloudWatch RequestCount for 14 consecutive days. Estimates full environment cost from EC2 + ALB + EBS. Learn more
• Unnecessary ALB on Single-Instance Beanstalk: Flags load-balanced environments with min=max=1 instance. The ALB adds ~$22/month with no scaling benefit. Learn more
• Beanstalk Previous-Generation Instance Detector: Detects environments using t2/m4/c4/r4 instances. Switching to current-gen (t3/m5/c5/r5) improves performance at the same or lower price. Learn more
• Over-Provisioned Beanstalk Environment: Detects multi-instance environments with <25% average CPU over 14 days. Recommends reducing instance count with 50% CPU headroom. Learn more
• Orphaned RDS from Beanstalk Environment: Detects RDS instances tagged with Elastic Beanstalk metadata that have zero connections for 14 days. Online-only detection. Learn more
• Unhealthy Beanstalk Environment (Refactored): Now uses DataProvider abstraction with config-based savings estimation. Confidence upgraded from LOW to HIGH. Full offline support added. Learn more

Three new WorkSpaces waste detectors plus a fully activated existing one (oversized_workspace), bringing total waste coverage to 180 detectors. Covers AutoStop billing mode opportunities, bundle rightsizing via CloudWatch metrics, pool capacity overprovisioning, and Windows BYOL licensing optimization. All online-only and recommendation-only in Phase 1.

Features

• WorkSpaces AutoStop Opportunity Detector: Identifies AlwaysOn WorkSpaces disconnected for 7+ days. Calculates break-even hours and recommends switching to AutoStop billing with estimated savings. Learn more
• Oversized WorkSpace Detector (Activated): Real bundle rightsizing using CloudWatch UserSessionsCount over 14 days. Conservative single-step downgrade mapping (PowerPro→Power, Power→Performance, etc.). Learn more
• WorkSpaces Pool Overprovisioned Capacity Detector: Detects WorkSpaces Pools with utilization below 75% and 2+ excess slots. Estimates $35/slot/month wasted capacity. Learn more
• WorkSpaces Windows License Optimization Detector: Groups Windows license-included desktops and recommends BYOL evaluation when 5+ eligible desktops detected. Estimates ~$4/desktop/month savings. Learn more

Four new EMR waste detectors plus two refactored existing ones, all using the DataProvider abstraction for full online/offline parity. Covers over-provisioned clusters, missing auto-termination policies, previous-generation instances, and Spot opportunity for task nodes. Total detector count rises to 177.

Features

• Over-Provisioned EMR Cluster Detector: Detects EMR clusters with >60% YARN memory available and low concurrent apps. Recommends instance group resizing with 30% headroom. Learn more
• EMR Missing Auto-Termination Detector: Flags clusters without auto-termination policies. The #1 cause of EMR budget overruns — a forgotten cluster costs thousands per month. Learn more
• EMR Previous-Generation Instance Detector: Detects clusters using m3/m4/c3/c4/r3/r4 instances. Migrating to current-gen (m5/c5/r5) improves performance and saves 5-20%. Learn more
• EMR Spot Opportunity Detector: Identifies task nodes running On-Demand that could use Spot instances for 60-90% EC2 savings. Task nodes are stateless and Spot-friendly. Learn more
• Idle EMR Cluster (Refactored): Now uses DataProvider abstraction with proper pricing (EC2 + EMR surcharge). Full offline/air-gapped support added. Learn more
• Long-Running EMR Cluster (Refactored): Improved detection: flags clusters running >30 days with no steps completed in 7+ days. Uses step history for accurate idle detection. Learn more

Four new Kinesis waste detectors plus two refactored existing ones, all using the DataProvider abstraction for full online/offline parity. Covers on-demand mode waste, extended retention with no consumers, enhanced fan-out consumer waste, and idle Firehose delivery streams. Complete Firehose support added. Total detector count rises to 173.

Features

• Kinesis On-Demand Downgrade Detector: Detects On-Demand Kinesis streams with stable throughput (CV < 0.3) where switching to Provisioned mode saves 2–3×. Learn more
• Kinesis Extended Retention Waste Detector: Detects streams with extended retention (>24h) but zero consumer reads for 14+ days. Paying retention surcharge for data nobody reads. Learn more
• Kinesis Enhanced Fan-Out Waste Detector: Detects registered enhanced fan-out consumers with zero reads for 14+ days. Per-shard-hour charges with no data consumption. Learn more
• Idle Firehose Delivery Stream Detector: Detects Firehose delivery streams with zero IncomingBytes for 14+ days. Identifies orphaned delivery streams after pipeline migrations. Learn more
• Idle Kinesis Stream (Refactored): Now uses DataProvider abstraction with full offline/air-gapped support. 14-day detection window for zero-record streams. Learn more
• Over-Provisioned Kinesis (Refactored): Now uses IncomingBytes for capacity analysis (1 MB/s per shard) with 20% utilisation threshold. Full DataProvider support. Learn more

Eight new commitment lifecycle detectors provide full Reserved Instance and Savings Plan intelligence — from utilization monitoring to expiry alerts, convertible RI exchange opportunities, and composite risk scoring for purchase decisions. Total detector count rises to 169.

Features

• Commitment Risk Intelligence: Full RI and Savings Plan lifecycle management: detect unused commitments, expiring contracts, convertible RI exchange opportunities, coverage gaps, and CUR-level waste patterns. Learn more
• Unused Reserved Instance Detector: Detects EC2 Reserved Instances with less than 20% utilization over 30 days. Calculates wasted commitment spend from unused capacity. Learn more
• Unused Savings Plan Detector: Detects Savings Plans with less than 20% utilization over 30 days. Surfaces underused commitment spend. Learn more
• Expiring Reserved Instance Detector: Alerts on active EC2 RIs expiring within 90 days with urgency tiers: URGENT (≤30 days), WARNING (≤60 days), UPCOMING (≤90 days). Learn more
• Expiring Savings Plan Detector: Alerts on active Savings Plans expiring within 90 days with the same urgency tiers as RI expiry. Learn more
• Convertible RI Exchange Opportunity: Identifies Convertible RIs on previous-generation instance families eligible for free exchange to current-gen equivalents. Learn more
• Savings Plan Coverage Gap Detector: Identifies compute usage not covered by any Savings Plan. Estimates potential savings from new commitment purchases. Learn more
• Commitment Risk Score: Composite 0-100 risk score on purchase recommendations weighing instance family churn (35%), spend volatility (25%), resource lifecycle (25%), and existing waste (15%). HIGH and CRITICAL risks get visual title prefixes. Learn more

See CloudWise in action in under 60 seconds — no AWS credentials needed. Realistic demo data showcases waste findings with guided exploration. New permission transparency page shows exactly what CloudWise accesses, parsed from actual CloudFormation templates. Live permission verifier checks your IAM role before you connect. Full onboarding funnel tracking for signup-to-value visibility.

Features

• Explore with Sample Data: Try CloudWise instantly with realistic synthetic cost data — no AWS connection required. See real waste findings across EC2, EBS, snapshots, and more. Data persists across refreshes and reuses the existing air-gapped results page.
• Permission Transparency Page: See exactly what CloudWise accesses in your AWS account. Permissions are parsed directly from the CloudFormation templates — categorized by service with explicit read-only and no-write callouts. Links to the raw YAML templates for full auditability.
• Live Permission Verifier: Verify your IAM role permissions before connecting. Real-time pass/fail checks for AssumeRole, Cost Explorer, CUR bucket, EC2 Describe, CloudWatch Metrics, and S3 access — with specific remediation guidance on failure.
• Demo Guided Checklist: Interactive checklist guides you through key features during demo exploration: review findings, filter by service, view remediation previews, and export a sample report.
• Onboarding Funnel Analytics: Full GA4 funnel tracking from signup to first value seen. Five-step instrumentation (account created, email verified, AWS connected, first value seen, onboarding completed) with time-to-complete measurement.
• Instant Revoke & Delete Controls: One-click disconnect, one-click data delete, and full account deletion — always visible on the setup page. Clear assurance that you are always in control of your data.

Five new Lightsail detectors expand coverage from stopped instances to unattached static IPs, orphaned disks, stale snapshots, idle load balancers, and idle managed databases. Existing idle_lightsail detector refactored with DataProvider abstraction for full air-gapped support. Total detector count rises to 166.

Features

• Unattached Lightsail Static IP Detector: Detects static IPs not attached to any Lightsail instance. Unattached IPs cost $0.005/hr (~$3.65/month) — free when attached. Learn more
• Unattached Lightsail Disk Detector: Flags additional block storage disks not attached to any instance. Charged at $0.10/GB/month regardless of attachment status. Learn more
• Old Lightsail Snapshot Detector: Identifies manual instance snapshots older than 90 days that accumulate storage costs at $0.05/GB/month. Learn more
• Idle Lightsail Load Balancer Detector: Detects load balancers with zero healthy registered instances. Flat-rate $18/month even with no traffic. Learn more
• Idle Lightsail Database Detector: Flags stopped or idle managed databases. Lightsail databases are billed at full rate even when stopped ($15–$115/month). Learn more

Bug fixes

• Refactored idle_lightsail detector with DataProvider abstraction and air-gapped support
• Added CPU-based idle detection for running Lightsail instances (was stopped-only)

Five new extended-support detectors surface hidden lifecycle surcharges across RDS, ElastiCache, EKS, OpenSearch, and DocumentDB. Findings distinguish warning windows from active surcharges, prefer billing-backed estimates when available, and recommend upgrade targets before fees compound.

Features

• RDS Extended Support Cost Detector: Detects non-Aurora RDS MySQL and PostgreSQL instances in or nearing Extended Support windows. Estimates surcharge from vCPU-hours and uses billing-backed totals when available. Learn more
• ElastiCache Extended Support Cost Detector: Flags Redis OSS and Memcached clusters approaching or incurring legacy-version support surcharges, with upgrade recommendations to supported engine versions. Learn more
• EKS Extended Support Cost Detector: Identifies Kubernetes control planes approaching or already in paid Extended Support windows, with per-cluster surcharge estimates and target upgrade versions. Learn more
• OpenSearch Extended Support Cost Detector: Flags OpenSearch and legacy Elasticsearch domains subject to extended support or legacy-version surcharge tiers, with cost estimates and upgrade guidance. Learn more
• DocumentDB Extended Support Cost Detector: Detects DocumentDB clusters on legacy engine versions that are approaching or incurring extended support surcharges and recommends target versions. Learn more

Bug fixes

• Added shared extended-support policy resolution across database and compute detectors
• Billing-backed surcharge parsing now works in both online and air-gapped provider flows

New aurora_to_rds_downgrade_opportunity detector identifies Aurora clusters with high I/O costs but low compute utilization where migrating to standard RDS with gp3 storage (3,000 free baseline IOPS) would be cheaper. Built from community feedback by CloudWise community member. Total detector count rises to 150.

Features

• Aurora to RDS Downgrade Detector: Detects Aurora clusters where I/O cost ≥25% of total spend, but compute utilization is low (CPU avg <20%, connections avg <100, ≤1 reader). Recommends migrating to standard RDS with gp3 storage where 3,000 free baseline IOPS eliminate I/O charges. Filters out Global Database, Serverless, and >64TB clusters. Advisory-only. Learn more

Full-featured PDF Report Builder across all four data sources (Cost Insights, Cost Reports, Remediation, Air-Gapped Waste). Field selection, sorting, grouping with aggregations, branded cover pages, and ReportLab-powered PDF generation. Save custom templates, preview before generating, and custom branding. Available from Shield tier with progressive feature unlocks.

Features

• PDF Report Builder: Build custom PDF reports from any CloudWise data source with field selection, sort/group configuration, aggregations (sum, count, average, min, max), cover pages, table of contents, and executive summaries. Four-tab modal integrated into Reports, Dashboard, Remediation, and Air-Gapped pages. Learn more
• Server-Side PDF Generation: ReportLab Platypus-powered PDF rendering with branded CloudWise styling, data tables, chart embedding via html2canvas, and configurable page layouts (A4/Letter/Legal, portrait/landscape). Async generation with polling and S3 presigned download URLs. Learn more
• Custom Report Templates: Save, clone, and manage reusable report configurations. Three built-in presets per data source (Executive Summary, Detailed Technical, Account Comparison). Agentic tier: up to 5 custom templates. Compliance tier: unlimited. Learn more
• Scheduled Report Delivery: Schedule recurring PDF reports delivered via SES email on daily, weekly, or monthly cadence. Compliance tier exclusive. Up to 10 delivery recipients per template. Learn more

New oversized_mq_broker detector for brokers with avg CPU <15%, plus idle_mq_broker refactored with DataProvider abstraction and correct per-instance-type pricing. Includes ALLOWED_ACTIONS bug fix for MQ remediation. Total detector count rises to 149.

Features

• Oversized MQ Broker Detector: Detects Amazon MQ brokers with avg CPU <15%. Recommends stepping down to a smaller instance type using the MQ downsize map, accounting for deployment mode multipliers. Advisory-only. Learn more
• Idle MQ Broker Refactor: Refactored idle_mq_broker to use DataProvider abstraction with correct per-instance-type pricing (was hardcoded $0.10/hr) and 14-day idle window (was 7 days). Full air-gapped support. Learn more

Bug fixes

• Fixed ALLOWED_ACTIONS["mq"] desync — was completely missing from remediation.py and executor, blocking MQ remediation plans
• Refactored idle_mq_broker to use DataProvider abstraction with correct per-instance-type pricing (was hardcoded $0.10/hr)
• Deduplicated mq:DeleteBroker and mq:DescribeBroker in IAM remediation role

Three new Neptune waste detectors plus idle Neptune refactored with DataProvider abstraction: Serverless migration opportunities for low-utilization provisioned clusters, oversized instance detection with step-down recommendations, and old manual snapshot cleanup. Includes ALLOWED_ACTIONS bug fix for Neptune remediation. Total detector count rises to 148.

Features

• Neptune Serverless Opportunity Detector: Detects provisioned Neptune clusters with avg CPU <20% and max CPU <50%, where Serverless at 2 NCU baseline would reduce cost. Compares instance-class pricing vs NCU-hour estimates. Advisory-only. Learn more
• Oversized Neptune Instance Detector: Detects Neptune instances with avg CPU <20% and max CPU <40%. Recommends stepping down to a smaller instance type using the Neptune downsize map. Advisory-only. Learn more
• Neptune Old Snapshot Detector: Detects manual Neptune snapshots older than 90 days. Estimates monthly storage retention cost. Supports automated deletion with rollback. Learn more

Bug fixes

• Fixed ALLOWED_ACTIONS["neptune"] desync — was completely missing from remediation.py and executor, blocking Neptune remediation plans
• Refactored idle_neptune to use DataProvider abstraction with correct per-instance-class pricing (was hardcoded $0.10/hr)

Three new Aurora waste detectors: I/O-Optimized storage switching (remediable), Extended Support cost alerts for EOL engine versions, and Serverless v2 migration opportunities for low-utilization clusters. Includes automated remediation for I/O optimization with rollback support. Total detector count rises to 145.

Features

• Aurora I/O Optimization Detector: Detects Aurora Standard clusters where I/O charges exceed 25% of total spend. Calculates savings from switching to I/O-Optimized storage. Supports automated ModifyDBCluster with rollback. Learn more
• Aurora Extended Support Cost Detector: Detects Aurora clusters running EOL engine versions (PostgreSQL 12, MySQL 5.7) under Extended Support. Calculates per-vCPU surcharges ($0.100/hr year 1-2, $0.200/hr year 3+). Advisory-only. Learn more
• Aurora Serverless v2 Opportunity Detector: Detects low-utilization provisioned Aurora clusters (CPU avg <15%, max <40%) suitable for Serverless v2 migration. Estimates savings from 2-ACU baseline. Advisory-only. Learn more

Two new AppSync waste detectors for idle cache instances and unused real-time subscriptions, plus a bug fix for the existing unused_appsync detector (4XXError → Latency metric). Adds DataProvider abstraction for full air-gapped support. Total detector count rises to 142.

Features

• Idle AppSync Cache Detector: Detects provisioned AppSync cache instances with fewer than 100 requests in 14 days. Calculates savings from hourly cache rates ($0.044–$6.78/hr). Supports automated deletion with rollback. Learn more
• Idle AppSync Subscriptions Detector: Detects AppSync APIs with active WebSocket connections but fewer than 100 GraphQL requests in 14 days. Estimates connection-minute costs. Advisory-only. Learn more

Bug fixes

• Fixed unused_appsync detector: replaced incorrect 4XXError metric with Latency SampleCount
• Migrated AppSync detection from raw boto3 to DataProvider abstraction for offline support

Ten new security posture waste detectors covering encryption-at-rest gaps (EBS, RDS, EFS, S3, DynamoDB, OpenSearch, DocumentDB), access control issues (RDS public access, deletion protection), and backup coverage validation. All advisory-only with HIGH confidence. Total detector count rises to 140.

Features

• Unencrypted EBS Volume Detector: Detects EBS volumes without encryption at rest. High confidence, medium risk. Advisory-only — recommends enabling default EBS encryption or creating encrypted snapshot copy. Learn more
• Unencrypted RDS Instance Detector: Detects RDS instances without storage encryption enabled. High confidence, medium risk. Advisory-only — recommends creating encrypted read replica and promoting. Learn more
• RDS No Deletion Protection Detector: Detects RDS instances without deletion protection enabled. High confidence, medium risk. Advisory-only — recommends enabling DeletionProtection. Learn more
• RDS Publicly Accessible Detector: Detects RDS instances with PubliclyAccessible flag set to true. High confidence, high risk. Advisory-only — recommends disabling public access. Learn more
• Unencrypted EFS Filesystem Detector: Detects EFS filesystems without encryption at rest. High confidence, medium risk. Advisory-only — EFS encryption cannot be changed after creation. Learn more
• S3 No Default Encryption Detector: Detects S3 buckets relying on default SSE-S3 without customer-managed KMS encryption. High confidence, low risk. Advisory-only. Learn more
• DynamoDB No Deletion Protection Detector: Detects DynamoDB tables without deletion protection enabled. High confidence, medium risk. Advisory-only — recommends enabling via UpdateTable. Learn more
• OpenSearch No Encryption at Rest Detector: Detects OpenSearch domains without encryption at rest enabled. High confidence, medium risk. Advisory-only — recommends enabling via UpdateDomainConfig. Learn more
• Unencrypted DocumentDB Cluster Detector: Detects DocumentDB clusters without storage encryption. High confidence, medium risk. Advisory-only — encryption cannot be changed after creation. Learn more
• Resource Without Backup Coverage Detector: Cross-references AWS Backup selections against EBS, RDS, DynamoDB, and EFS resources to find unprotected assets. High confidence, medium risk. Advisory-only. Learn more

Three new OpenSearch waste detectors for rightsizing, storage optimization, and commitment savings. Oversized detector uses combined CPU and search traffic signals. EBS detector analyzes growth trends from 14-day FreeStorageSpace metrics. RI detector leverages Cost Explorer recommendations. Total detector count rises to 140.

Features

• Oversized OpenSearch Domain Detector: Detects domains with avg CPU < 20% and max CPU < 40% with active search traffic. Recommends stepping down instance type. Advisory-only, medium risk. Learn more
• OpenSearch EBS Overprovisioned Detector: Detects EBS-backed domains with > 60% free storage and flat growth (< 0.1 GB/day). Estimates reclaimable GB. Advisory-only, medium risk. Learn more
• OpenSearch RI Opportunity Detector: Detects on-demand domains eligible for Reserved Instance savings via Cost Explorer recommendations. Online-only, low risk. Learn more

Three new Step Functions waste detectors targeting real billing drivers: step_functions_retry_storm catches excessive retries inflating transition costs, step_functions_high_transition_density flags workflows with too many transitions per successful execution, and step_functions_express_duration_waste identifies Express workflows with high p95 duration. All advisory-only in v1. Fixes UNUSED_STATE_MACHINE enum bug.

Features

• Step Functions Retry Storm Detector: Detects state machines with high failure rate and excessive retry transitions. Standard workflows: $0.025 per 1,000 transitions — retries multiply cost without business value. High confidence, medium risk. Advisory-only. Learn more
• High Transition Density Workflow Detector: Detects Standard workflows with excessive state granularity inflating per-execution transition cost. Configurable ceiling for average transitions per success. Medium confidence, medium risk. Advisory-only. Learn more
• Express Workflow Duration Waste Detector: Detects Express workflows with persistently high p95 execution duration. Express billing includes request + duration (GB-seconds). Medium confidence, medium risk. Advisory-only. Learn more

Bug fixes

• Fixed UNUSED_STATE_MACHINE enum reference (now uses canonical IDLE_STATE_MACHINE)
• Step Functions detector now uses DataProvider abstraction for online/offline parity

Three new FSx waste detectors: oversized_fsx flags filesystems with low storage utilization, fsx_throughput_overprovisioned identifies overprovisioned throughput for Windows/ONTAP/OpenZFS, and old_fsx_backup detects manual backups past retention threshold. CUR template updated to v1.8.0 with fsx:DescribeBackups. Remediation role template updated to v1.15.0 with fsx:DeleteFileSystem, fsx:CreateBackup, fsx:DeleteBackup.

Features

• Oversized FSx Filesystem Detector: Detects FSx filesystems where used storage is below the configured threshold (default 40% of provisioned). Type-aware for Windows, ONTAP, OpenZFS, and Lustre. Advisory-only — recommends rightsizing or migration. Medium risk. Learn more
• FSx Throughput Overprovisioned Detector: Detects FSx filesystems (Windows/ONTAP/OpenZFS) where average throughput utilization is below the configured threshold (default 30%). Advisory-only — recommends reducing throughput capacity tier. Medium risk. Learn more
• Old FSx Backup Detector: Detects manual FSx backups older than the configured threshold (default 90 days). Protects retention-tagged backups. Medium risk with executor support via fsx:delete_backup. Learn more

Two new DocumentDB waste detectors: old_documentdb_snapshot flags manual cluster snapshots older than the configured retention threshold, and overprovisioned_documentdb identifies clusters with sustained low CPU, connections, and IOPS. Remediation role template updated to v1.14.0 with rds:CreateDBClusterSnapshot, rds:DeleteDBClusterSnapshot, and rds:DescribeDBClusterSnapshots.

Features

• Old DocumentDB Snapshot Detector: Detects manual DocumentDB cluster snapshots older than the configured threshold (default 90 days). Protects the newest snapshot per cluster and retention-tagged snapshots. Medium risk with full remediation support via delete_db_cluster_snapshot. Learn more
• Overprovisioned DocumentDB Detector: Detects DocumentDB clusters with sustained low utilization across CPU (< 20%), connections (< 5), and IOPS (< 100) over 14 days. Advisory-only — recommends downsizing instance class. Medium risk. Learn more

Five new waste detectors for AWS Backup covering recovery point hygiene, plan assignment validation, lifecycle tiering, and cross-region copy policy analysis. Total detector count rises to 129. All detectors available in Air-Gapped Mode. Remediation role template updated to v1.13.0.

Features

• Old Backup Recovery Points: Detects recovery points past their retention window (> 90 days). Medium risk with full remediation support via delete_recovery_point. Learn more
• Redundant Backup Recovery Points: Detects duplicate recovery points for the same resource in the same vault. Medium risk with full remediation support. Learn more
• Backup Lifecycle Tiering: Detects recovery points not transitioned to cold storage. Low risk with update_recovery_point_lifecycle remediation. Learn more
• Stale Backup Plan Assignments: Detects backup plans with selection rules matching zero resources. Low risk with delete_backup_selection remediation. Learn more
• Backup Copy Policy Overreach: Detects cross-region copy rules duplicating backups unnecessarily. Advisory-only — no automated execution in v1. Learn more

Two major features from the Cost Observability spec. Phase 1: Every waste finding now includes a structured "Why is this waste?" explanation with detection logic, thresholds, pricing math, and risk context — visible to all tiers. Phase 2: Prometheus /metrics endpoint exposes waste findings in text exposition format for Grafana dashboards, with API key authentication (Shield+ tier). Also fixes multi-region export script bug where AWS_REGION env var override caused all regions to collect data from the CloudShell home region.

Features

• Detector Explanations ("Why is this waste?"): Every waste finding now includes a structured explanation with 5 sections: Detection (what metric triggered it), Threshold (what value was measured vs. the cutoff), Pricing (how savings are calculated), Why It's Waste (plain-language reasoning), and Risk (what could go wrong). Available on all tiers. Implemented across all 124 detectors with AST-enforced test coverage. Learn more
• Prometheus Metrics Exporter: New /api/v1/metrics endpoint serves waste detection findings in Prometheus text exposition format. Exposes cloudwise_waste_monthly_savings, cloudwise_waste_items_total, cloudwise_accounts_total, and cloudwise_last_scan_timestamp_seconds. Supports API key and Bearer token authentication. Includes pre-built Grafana dashboard template and integration docs. Learn more
• API Key Management: CRUD API for managing API keys used by Prometheus scrapers and Grafana. Keys are stored hashed in DynamoDB with a GSI for O(1) validation. Up to 5 keys per user. Shield+ tier required. Learn more

Bug fixes

• Fixed multi-region export script: AWS_REGION env var (set by CloudShell) was overriding AWS_DEFAULT_REGION, causing all regions to collect data from the CloudShell home region. Now explicitly sets both AWS_REGION and AWS_DEFAULT_REGION per loop iteration.
• Fixed deterministic waste item ID generation: IDs were computed at __post_init__ with empty region, then region was set later. Same resource across regions produced identical DynamoDB sort keys, causing last-processed region to overwrite. IDs are now regenerated after region/account assignment.
• Export script version bumped to 1.9.2.

Three new ECS/Fargate waste detectors: No Auto Scaling (services paying peak pricing 24/7), Container Insights Waste (unnecessary monitoring on dev/small clusters), and Oversized Memory (memory over-provisioned relative to usage). Three bug fixes: idle_ecs_service detection was defined in 15+ files but never implemented, ALLOWED_ACTIONS["ecs"] was missing from backend and executor (blocking remediation), and Fargate memory pricing corrected from $0.004445 to $0.004446/GB-hour. All ECS detectors refactored to DataProvider pattern for Air-Gapped mode support.

Features

• ECS No Auto Scaling Detector: Flags Fargate services with 2+ running tasks and no Application Auto Scaling configured. These services pay peak pricing 24/7. Auto Scaling is free. Estimates 30% savings from off-peak scaling. MEDIUM risk — recommendation only. Learn more
• Container Insights Waste Detector: Flags ECS clusters with Container Insights enabled on dev/staging/test clusters, clusters with fewer than 3 services, or clusters with zero running tasks. Container Insights costs $0.07-$0.30/metric/month and can generate 100+ metrics per cluster. LOW risk — recommendation only. Learn more
• Over-Provisioned ECS Memory Detector: Flags Fargate services where max memory utilization is below 40% over 7 days. Recommends the smallest valid Fargate memory option with 50% headroom. Complements the existing CPU-only oversized_ecs_task detector. MEDIUM risk — plan-only (no one-click Fix This) until validated live (CLO-546). Learn more

Bug fixes

• Fixed idle_ecs_service detection — was defined in 15+ files (models, remediation, planner, executor, frontend, docs) but detection code never emitted it.
• Fixed missing ALLOWED_ACTIONS["ecs"] in backend remediation.py and executor handler.py — ECS remediation plans were being rejected at execution time.
• Fixed Fargate memory pricing from $0.004445 to $0.004446/GB-hour per AWS published rates.
• Refactored all ECS detectors to use DataProvider abstraction — enables Air-Gapped mode for ECS waste detection.

Five new Glue waste detectors: Oversized Glue Job (JVM heap < 30%), Glue Job Missing Timeout (timeout ≥ 10× avg duration), Failed Glue Job Retry (≥ 50% failure rate with retries), Dev Endpoint Migration (Interactive Sessions advisory), and Data Catalog Bloat (>1M free tier objects). Bug fix: idle_glue_crawler detection was defined but never implemented. All Glue detectors refactored to use DataProvider abstraction for full Air-Gapped mode support.

Features

• Oversized Glue Job Detector: Flags Glue ETL jobs with JVM heap utilization below 30% (via CloudWatch) or short execution with high DPU allocation. Recommends DPU right-sizing to eliminate wasted compute. LOW risk — recommendation only. Learn more
• Glue Job Missing Timeout Detector: Flags Glue jobs where configured timeout exceeds 10× average execution duration. Prevents catastrophic billing from stuck jobs — a 10 DPU job with a 48-hour default timeout can burn $211 before failing. LOW risk — remediable via Fix This. Learn more
• Failed Glue Job Retry Detector: Flags Glue jobs with ≥ 50% failure rate and retries configured. Calculates wasted DPU-hours from repeated failed runs and captures the last error message for root cause analysis. LOW risk — remediable via Fix This. Learn more
• Dev Endpoint Migration Advisory: Flags all active Glue dev endpoints — AWS recommends migrating to Interactive Sessions. Dev endpoints bill 24/7 at $0.44/DPU-hour and cannot be paused. Interactive Sessions auto-stop after idle timeout. LOW risk — recommendation only. Learn more
• Data Catalog Bloat Detector: Flags Data Catalogs exceeding 1M free tier objects. Primary bloat source is table versions from UpdateTable calls. Costs $1.00 per 100,000 excess objects. LOW risk — recommendation only. Learn more

Bug fixes

• Fixed idle_glue_crawler detection — was defined in enums, risk maps, and frontend but detection code was never implemented.
• Fixed idle_glue_crawler missing from WASTE_TYPE_TO_CATEGORY in waste detection processor Lambda.
• Refactored all Glue detectors to use DataProvider abstraction instead of raw _get_client() calls.

Three new S3 waste detectors: S3 Rapid Growth flags buckets growing >20% month-over-month with no lifecycle policy (LOW), S3 Wrong Storage Class flags Standard-only buckets >100 GB that could save 40-68% with Intelligent-Tiering or Glacier (LOW), and S3 Empty Bucket flags zero-object buckets older than 30 days for cleanup (LOW). Includes IAM role template v1.8.0 with S3 and CloudWatch permissions for storage metrics. Works in both Online and Air-Gapped modes.

Features

• S3 Rapid Growth Detector: Flags S3 buckets growing more than 20% month-over-month with no lifecycle policy. Uses CloudWatch BucketSizeBytes metrics to calculate growth rate and recommends lifecycle rules to control storage costs. LOW risk — recommendation only. Learn more
• S3 Wrong Storage Class Detector: Flags S3 buckets over 100 GB stored entirely in Standard class with no Intelligent-Tiering. Calculates potential savings of 40-68% by migrating to S3 Intelligent-Tiering or Glacier based on access patterns. LOW risk — recommendation only. Learn more
• S3 Empty Bucket Detector: Flags S3 buckets with zero objects that have existed for over 30 days. Identifies forgotten or abandoned buckets that can be safely deleted. LOW risk — recommendation only. Learn more
• S3 Storage Optimization Suite: Comprehensive S3 cost optimization with CloudWatch metrics integration for storage breakdown by class, object counts, and month-over-month growth analysis. IAM role template updated to v1.8.0 with new S3 and CloudWatch permissions.

Bug fixes

• Fixed remediation template update banner not showing for users with deployed remediation stacks on non-Agentic tiers.
• Fixed S3 bucket test mocks missing CloudWatch get_metric_statistics responses.
• Reconciled remediation.md waste detector counts with authoritative RISK_MAP (92 types, 41 services).

New Redshift waste detector: Concurrency Scaling Waste flags clusters exceeding the free 1-hour/day concurrency scaling credit. Calculates billable CS seconds, estimates monthly CS cost by node type, and recommends WLM tuning to reduce concurrency scaling reliance. LOW risk — WLM parameter changes require no downtime. Works in both Online and Air-Gapped modes.

Features

• Redshift Concurrency Scaling Waste Detector: Flags Redshift clusters where concurrency scaling usage exceeds the free 1-hour/day credit. Calculates billable seconds after subtracting the free credit, estimates monthly cost using per-node-type pricing, and recommends 60% savings through WLM queue tuning. LOW confidence — configuration change only, no downtime. Learn more

Full support for AWS CUR 2.0 (Data Exports) format. The parser automatically detects and normalizes CUR 2.0 snake_case headers to CUR 1.0 format at parse time — no user configuration needed. The CloudFormation setup template (v1.4.0) now lets users choose between CUR 1.0 and CUR 2.0 when deploying. The anonymization script has been renamed from .sh to .py with a backward-compatible symlink.

Features

• CUR 2.0 (Data Exports) Support: CloudWise now fully supports AWS CUR 2.0 files exported via the Data Exports service. The parser automatically detects CUR 2.0 snake_case column headers and normalizes them to CUR 1.0 format — all 35 column mappings, tag remapping, and cost category remapping handled transparently.
• Automatic CUR Format Detection & Normalization: New detect_cur_format() and normalize_cur_headers() functions in the CUR parser. Supports CUR 1.0 (PascalCase with slashes), CUR 2.0 (snake_case), and future FOCUS format detection. Normalization happens at the parse boundary so all downstream code sees a single canonical format.
• CloudFormation Template v1.4.0 — CUR Version Choice: The CloudFormation setup template now includes a CURVersion parameter (1.0 or 2.0). CUR 2.0 creates an AWS::BCMDataExports::Export resource with DAILY granularity, INCLUDE_RESOURCES, and CSV output. S3 bucket policy includes both billingreports and bcm-data-exports service principals for seamless upgrades.
• Anonymization Script — .sh → .py Rename: The CUR anonymization script has been renamed from cloudwise-anonymize-cur.sh to cloudwise-anonymize-cur.py to match its Python implementation. A backward-compatible symlink is provided. The script now also detects CUR 2.0 tag prefixes (resource_tags_, cost_category_) for proper anonymization.

Bug fixes

• Fixed CUR parser rejecting CUR 2.0 files with snake_case headers — now auto-normalizes to CUR 1.0 format.
• Fixed anonymization script invocation errors when users ran "bash cloudwise-anonymize-cur.sh" — script is now properly named .py with python3 invocation.
• Fixed CUR 2.0 tag columns (resource_tags_user_*, cost_category_*) not being detected for anonymization.

Five new Redshift waste detectors: Underutilized Redshift flags clusters with CPU below 10% but active connections (MEDIUM), Redshift No Pause flags clusters without scheduled pause actions and >40% zero-connection hours (MEDIUM, auto-remediable), Redshift Spectrum Heavy flags clusters where Spectrum cost exceeds 50% of compute (LOW), Redshift Legacy DC2 flags DC2 node types that should migrate to RA3 (LOW), and WLM Over-Provisioned flags clusters with near-empty WLM queues and <50% concurrency slot utilization (MEDIUM). Works in both Online and Air-Gapped modes.

Features

• Underutilized Redshift Detector: Flags Redshift clusters with average CPU below 10% over 14 days but still receiving connections. MEDIUM confidence — recommends right-sizing or pausing during off-hours. Learn more
• Redshift No Pause Detector: Flags Redshift clusters without scheduled pause actions where >40% of hours have zero connections. MEDIUM confidence — auto-remediable by creating a scheduled pause action. Learn more
• Redshift Spectrum Heavy Detector: Flags Redshift clusters where Spectrum (S3 scan) cost exceeds 50% of compute cost. LOW confidence — recommends migrating heavy Spectrum workloads to Athena or Glue. Learn more
• Redshift Legacy DC2 Detector: Flags Redshift clusters using DC2 node types. LOW confidence — recommends migration to RA3 for managed storage, better price-performance, and Spectrum support. Learn more
• Redshift WLM Over-Provisioned Detector: Flags Redshift clusters with near-empty WLM queues and <50% concurrency slot utilization. MEDIUM confidence — recommends downsizing nodes to reduce costs. Learn more
• Redshift Waste Detection: Five new detectors for Amazon Redshift covering underutilization, pause scheduling, Spectrum cost analysis, DC2→RA3 migration, and WLM over-provisioning. Works in both Online and Air-Gapped modes. Learn more

Bug fixes

• Fixed ElastiCache idle detection using incorrect max_connections attribute — now uses current_connections_avg.
• Fixed OpenSearch idle detection using non-existent total_searches attribute — now uses is_idle boolean from provider.
• Fixed OpenSearch deleted domain check — now uses safe getattr() with fallback to status field.

Two new MSK waste detectors: Idle MSK Cluster flags provisioned clusters with zero messages AND zero bytes over 7 days (HIGH confidence, full monthly savings), Oversized MSK Cluster flags clusters with CPU below 20% but still active (MEDIUM confidence, right-sizing recommendation). Instance-type-aware pricing across 16 MSK instance types. Online-only — MSK detection requires live AWS API access.

Features

• Idle MSK Cluster Detector: Flags provisioned MSK clusters with zero MessagesInPerSec AND zero BytesInPerSec over the configured idle window (default 7 days). HIGH confidence — complete inactivity is a strong signal. Monthly savings = broker_count × hourly_rate × 730. Learn more
• Oversized MSK Cluster Detector: Flags MSK clusters where average CpuUser is below the broker utilisation threshold (default 20%) but the cluster is NOT idle. MEDIUM confidence — recommends right-sizing to a smaller instance type. Learn more
• MSK Waste Detection: Two new detectors for Amazon MSK (Managed Streaming for Apache Kafka). Instance-type-aware pricing across 16 MSK instance types. Serverless clusters are automatically skipped. Online-only — not supported in Air-Gapped mode. Learn more

Bug fixes

• Fixed MSK metrics wiring: OnlineDataProvider now implements get_msk_metrics() so idle detection actually executes at runtime instead of being silently caught by the exception handler.

Four new waste detectors: two CloudWatch Logs detectors (Excessive Retention flags log groups with 365+ day retention and >100 MB stored data, Empty Log Group flags orphaned log groups with 0 bytes) and two EBS Snapshot detectors (Orphaned EBS Snapshot flags snapshots whose source volume was deleted, AMI Orphaned Snapshot flags snapshots backing deregistered AMIs). EBS detectors require ec2:DescribeImages IAM permission and new export_amis in the export script.

Features

• Excessive Retention Log Group Detector: Flags log groups with 365+ day retention and >100 MB stored data. Recommends reducing to 30-day baseline — a 365→30 day reduction saves 92% of storage costs at $0.03/GB/month. Learn more
• Empty Log Group Detector: Flags orphaned log groups with 0 bytes stored that are 30+ days old. Typically left behind by deleted Lambda functions or ECS services. Reclaims quota (10,000 log groups per region limit). Learn more
• CloudWatch Logs Waste Detection: Two new detectors for CloudWatch Logs optimization and hygiene. No export script or IAM role changes required — all data already collected. Learn more
• Orphaned EBS Snapshot Detector: Flags EBS snapshots whose source volume has been deleted. HIGH confidence — the snapshot cannot be used for incremental recovery. Savings: $0.05/GB/month per orphaned snapshot. Learn more
• AMI Orphaned Snapshot Detector: Flags EBS snapshots created by CreateImage for AMIs that have been deregistered. HIGH confidence — the backing AMI no longer exists. Requires ec2:DescribeImages IAM permission. Learn more
• EBS Snapshot Orphan Detection: Two new detectors for EBS snapshot orphan detection: orphaned snapshots (source volume deleted) and AMI orphaned snapshots (backing AMI deregistered). Requires ec2:DescribeImages IAM permission and updated export script. Learn more

Bug fixes

• Fixed old_log_group detector field reference: log_group.last_event_timestamp → log_group.last_event_time. The CloudWatchLogGroupData model uses last_event_time but the detector referenced the non-existent last_event_timestamp, silently skipping all stale log group detection.

Redesigned multi-region export UX with download-then-run workflow, expanded IAM permissions from 14 to 58 with automated CI sync guard, fixed Lambda Excessive Timeout and Idle Provisioned Concurrency detectors in Air-Gapped mode, and improved copy/paste experience throughout the upload wizard.

Features

• Multi-Region Export UX Redesign: Export wizard now uses a two-step download-then-run flow: Step 1 downloads and verifies the script with checksum, Step 2 lets you toggle between single-region and multi-region mode with a comma-separated region input. Copy buttons on both steps for easy paste into CloudShell.
• IAM Permissions Audit — 14 → 58 Permissions: Comprehensive audit of the export script IAM requirements. Expanded the upload wizard's IAM policy from 14 to 58 permissions across 6 categories (Compute, Storage, Database, Analytics, Integration, Management) to cover all 45 AWS services collected by the export script.
• IAM Sync CI Guard: New check-iam-permissions-sync.sh script ensures every AWS service in the export script has matching IAM permissions in the upload wizard. Integrated into both quick-test.sh and local-ci-pipeline.sh as a quality gate.
• Lambda Detectors — Air-Gapped Data Pipeline Fixes: Fixed 4 bugs preventing Lambda Excessive Timeout and Idle Provisioned Concurrency detectors from firing in Air-Gapped mode: added Duration metric export, fixed lambda_pc_util_ file routing, added lambda_invocation_metrics to availability check, and added --no-paginate to prevent JSON truncation. Learn more
• Export Wizard Copy Button Improvements: Added Copy button to the Step 1 download-and-verify terminal block. Fixed Step 2 Copy to only copy the run command — no longer includes the download/verify lines.
• CUR Anonymizer Invocation Fix: Fixed the CUR anonymizer script invocation from bash to python3. The script uses a #!/usr/bin/env python3 shebang but has a .sh extension — running with bash caused import errors.

Bug fixes

• Export script now collects Lambda Duration metrics (Average + Maximum) for Excessive Timeout detection in Air-Gapped mode
• Upload service correctly routes lambda_pc_util_ files as raw resources instead of silently dropping them in metrics consolidation
• Offline data provider _check_metrics_availability now recognizes lambda_invocation_metrics and lambda_duration_metrics keys
• Offline data provider get_lambda_metrics merges duration data from separate lambda_duration_metrics consolidated key
• Added --no-paginate to aws logs describe-log-groups and aws compute-optimizer get-lambda-function-recommendations to prevent JSON truncation
• Fixed CUR anonymizer script invocation from bash to python3 in upload wizard

Four new Lambda waste detectors targeting the biggest Lambda cost traps: idle Provisioned Concurrency ($50–$500+/month savings), excessive timeouts, ARM64 migration opportunities (20% savings), and deprecated runtime flagging. All detectors work in both Online and Air-Gapped modes.

Features

• Idle Provisioned Concurrency Detector: Detects Lambda Provisioned Concurrency configurations with <10% utilization over 14 days. PC is the only Lambda charge that runs 24/7 regardless of usage — a single idle 1GB PC costs $108/month for nothing. Learn more
• Excessive Lambda Timeout Detector: Flags Lambda functions where the configured timeout is ≥10× the average duration (with ≥100 invocations). Recommends max(10s, avg_duration × 3) to prevent runaway billing and improve operational hygiene. Learn more
• ARM64 Migration Opportunity Detector: Identifies x86_64 Lambda functions on ARM64-compatible runtimes (Python, Node.js, Java, .NET, Ruby) with monthly cost ≥$1. Graviton2 offers a 20% price reduction per GB-second. Learn more
• Deprecated Lambda Runtime Detector: Flags Lambda functions running on deprecated or end-of-life runtimes (python3.7/3.8, nodejs14.x/16.x, dotnet6, ruby2.7, java8). Security and compliance housekeeping flag. Learn more

Bug fixes

• Added Provisioned Concurrency pricing to FALLBACK_LAMBDA_PRICING ($0.0000041667/GB-second)
• Added 3 new Lambda PC IAM actions to CloudWiseRemediationRole (delete/put/list provisioned concurrency)
• Updated RISK_MAP across remediation.py, planner, and executor with 4 new Lambda waste types
• Updated waste_detection_processor WASTE_TYPE_TO_CATEGORY with 4 new Lambda entries
• Export script now collects Lambda Provisioned Concurrency configs and CloudWatch utilization metrics

Three new SageMaker waste detectors (previous-gen instances, oversized endpoints, stopped notebook storage), Lambda-to-Lambda scan bypassing the API Gateway 29s timeout, 8 async state waiters in the remediation executor, and critical Air-Gapped mode fixes.

Features

• Previous-Gen SageMaker Instance Detector: Detects notebooks and endpoints running on ml.m4.* or ml.c4.* instance types that can be upgraded to current-gen (ml.m5/ml.c5) for 18–27% cost savings. Fully remediable via stop → update instance type → start. Learn more
• Oversized SageMaker Endpoint Detector: Detects SageMaker endpoints with <20% CPU and <20% Memory utilization that have meaningful traffic (>100 invocations). Recommends right-sizing to a smaller instance type. Learn more
• Stopped Notebook EBS Storage Detector: Detects Stopped SageMaker notebooks retaining EBS volumes at $0.116/GB-month. 7-day grace period after stopping to avoid false positives. Learn more
• Lambda-to-Lambda Scan — API Gateway Timeout Fix: Waste detection processor now invokes the API Lambda directly via Lambda-to-Lambda calls, bypassing the API Gateway 29-second hard timeout. All 15 regions complete successfully with automatic HTTP fallback. Learn more
• Remediation Executor — 8 Async State Waiters: Executor now waits for async AWS operations to complete: SageMaker stop/update (300s each), EC2 stop (120s), EBS detach (120s), RDS stop (300s) and modify (600s). Prevents failures from resources in transitional states. Learn more
• SageMaker Previous-Gen Remediation — End-to-End: Full remediation flow for previous-gen SageMaker notebooks: stop → wait → update instance type → wait → start. CloudWiseRemediationRole v1.7.0 with sagemaker:UpdateNotebookInstance permission. Learn more
• Air-Gapped Mode — SageMaker Fixes: Fixed epoch timestamp auto-detection (seconds vs milliseconds), previous-gen status filter (blacklist instead of whitelist), and stale DynamoDB item filtering via upload_id. Learn more

Bug fixes

• Fixed RDS database detector: instance_ids → db_instance_ids parameter name mismatch
• Replaced hardcoded $36.50 SageMaker savings with instance-type-based pricing
• Expanded ALLOWED_ACTIONS["sagemaker"] with update_notebook_instance, describe_endpoint, describe_endpoint_config
• Added RISK_MAP entries for all 5 SageMaker waste types
• Expanded FALLBACK_SAGEMAKER_PRICING with previous-gen and GPU instance types
• Updated CloudWiseRemediationRole to v1.7.0 with sagemaker:UpdateNotebookInstance
• Updated export script with describe-endpoint details and CPU/Memory CloudWatch metrics
• Air-gapped: _parse_datetime auto-detects epoch seconds vs milliseconds (SageMaker uses seconds)
• Air-gapped: Previous-gen status filter changed from whitelist to blacklist (catches Pending/Updating)
• Air-gapped: get_waste_items filters by upload_id to exclude stale DynamoDB items from previous uploads

Three new waste detectors for load balancers — Low-Traffic ALB, High LCU Cost ALB, and Classic LB Migration — with full Air-Gapped mode support. Plus critical rollback fixes for EC2 termination remediation.

Features

• Low-Traffic ALB Detector: Detects ALBs and NLBs receiving fewer than 100 requests over 14 days while still having healthy targets. Estimates $16.20/month in savings per idle load balancer. Learn more
• High LCU Cost ALB Detector: Identifies ALBs where estimated monthly LCU costs exceed 2× the base cost ($32.40). Recommends rule consolidation or NLB migration for TCP-only workloads. Learn more
• Classic LB Migration Detector: Flags Classic Load Balancers that should be migrated to ALB or NLB for cost savings and modern features. Detected instantly from metadata — no CloudWatch metrics needed. Learn more
• ALB/ELB Air-Gapped Mode Support: All three new load balancer detectors work in Air-Gapped mode. Export script collects target group health, RequestCount, and ConsumedLCUs metrics automatically. Learn more
• EC2 Rollback — Fully Working: Fixed critical rollback bugs for EC2 termination remediation. Correct AMI and snapshot resolution, instance and volume waiters, proper step sequencing (run → create_volume → attach → stop), and IAM permissions for AttachVolume/DetachVolume. Learn more
• Remediation Dashboard UX: New RemediationActionButtons and RemediationActionDetails components with real-time status polling, risk badges, execution timeline, and humanized error messages. Learn more

Bug fixes

• EC2 rollback: AMI_ID_FROM_SNAPSHOT placeholder now resolves to original instance AMI
• EC2 rollback: AVAILABILITY_ZONE_FROM_ORIGINAL_VOLUME placeholder now resolves correctly
• EC2 rollback: Instance waiter (up to 60s) before attach_volume prevents IncorrectState errors
• EC2 rollback: Volume waiter (up to 60s) before attach_volume prevents volume not available errors
• EC2 rollback: stopped_ec2_with_ebs now stops instance after launch to match original state
• Remediation role template v1.6.0: Added ec2:AttachVolume and ec2:DetachVolume permissions
• Air-gapped: Fixed load_balancers key mismatch (load_balancers vs elb_v2 in exports)
• Air-gapped: Fixed healthy_target_count always 0 — now joins target health with LB ARNs
• Air-gapped: Added lb_requests_ and lb_lcus_ metric prefix recognition
• Remediation executor: ResourceInUse retry with exponential backoff for ELB deletion ordering
• Remediation executor: API call ordering fix — delete_load_balancer before delete_target_group

Introducing the Agentic AI tier ($199/year) with automated waste remediation. AI proposes cost-saving actions, you approve with one click, and CloudWise executes them safely with automatic rollback capability.

Features

• Agentic AI Tier — $199/year: New tier between Shield and Compliance. Automated waste remediation with human-in-the-loop approval, 66 remediable waste types, an audit trail, and rollback capability. Category-defining pricing vs $5K+/year competitors.
• Automated Waste Remediation: AI-powered remediation planner generates safe, executable AWS API call sequences. Pre-checks verify resource state, snapshots are taken before destructive actions, and rollback plans are generated automatically. Learn more
• "Fix This" Button on Every Waste Finding: One-click remediation from any waste finding. Agentic/Compliance users get the full approve flow; Shield users see an upgrade prompt. Available on 66 of 90+ waste types. Learn more
• Remediation Approval Dashboard: Dedicated dashboard for managing remediation actions. View pending approvals, execution history, and savings tracker. Actions expire after 72 hours if not approved. Learn more
• Automatic Rollback: Every remediation action includes a rollback plan. Snapshots are taken before destructive actions, and failed executions trigger automatic rollback. One-click manual rollback from the dashboard. Learn more
• Remediation Audit Trail: DynamoDB audit log of all remediation actions, append-only by design in our code and not yet enforced by AWS permissions. Kept for as long as your account exists and deleted with it. Tracks who approved what, when it executed, and the full API call sequence for compliance and governance. Learn more

Bug fixes

• Remediation role template v1.5.0: Added 19 rollback actions for undo capability
• Removed RunInstances, RestoreSecret, CreateDBInstance, CreateFunction from deny list (needed for rollback)

Correction (2026-11-12): This note said Agentic and Compliance users get the full approve flow. Only the Agentic plan has it. Compliance connects no AWS account, and CloudWise makes no plans and runs no fixes for it. Compliance shows steps you apply yourself.

Introducing the Compliance tier ($299/year) for regulated enterprises. Air-Gapped Mode now supports 365-day data retention, 12 persistent uploads for quarter-over-quarter trend analysis, 500 AI Copilot queries/day, and dedicated sidebar navigation.

Features

• Compliance Tier — $299/year: A new tier designed for FinTech, Healthcare, and Government organizations. Includes Shield's budget alerts and email and Slack digests, but not its connected-account features such as scheduled scans and anomaly alerts (corrected 2026-11-11: Compliance works from Air-Gapped uploads only), plus 365-day data retention, Air-Gapped Mode with persistent uploads, QoQ variance reports, and 500 AI Copilot queries per day.
• Air-Gapped Mode — 365-Day Retention: Air-Gapped Mode now lives in its own dedicated sidebar menu with 365-day data retention and up to 12 persistent uploads. Upload history tracks billing periods for quarter-over-quarter comparison, with full delete capability. Learn more
• Quarter-over-Quarter Variance Reports: Compare costs across billing periods with detailed variance analysis. Track spending trends quarter over quarter with service-level breakdowns, absolute and percentage changes, and audit-ready formatting. Learn more
• AI Copilot — Compliance (500 queries/day): 500 AI Copilot queries per day with 90-day conversation history. Ask detailed questions about your air-gapped cost data and waste detection results. Learn more
• Upload History & Billing Period Tracking: Upload history now tracks display names, billing period start/end dates, and export file status. Duplicate billing period detection prevents accidental re-uploads. Delete any upload and all associated data. Learn more
• Persistent Salt Management: Save and reuse your anonymization salt across uploads for consistent identifier hashing. Essential for quarter-over-quarter trend analysis with anonymized data. Learn more
• PDF Audit Reports: Export waste detection results and variance reports as PDF documents for compliance audits and stakeholder presentations. Learn more

Bug fixes

• Dashboard dark mode: Shield badge and tier badges now visible in dark mode
• Dashboard account filter labels show "Uploads" instead of "AWS Accounts" for Compliance tier
• Feature Overview now includes Air-Gapped Mode and AI Copilot Compliance features
• AI Copilot Shield description corrected from 30-day to 90-day conversation history
• Export script label changed from "Optional" to "Required for Waste Detection"
• Upload wizard spinner fix: error state now shows error icon and "Upload Failed" heading
• Offline page redirect: /offline now redirects to /air-gapped inside the main layout

Analyze AWS costs without connecting your AWS account. Upload CUR exports directly with optional data anonymization for complete data privacy and compliance with strict security policies.

Features

• Air-Gapped Mode: Upload AWS Cost and Usage Reports (CUR) directly to CloudWise without granting AWS access. Perfect for organizations with strict security policies, air-gapped environments, or compliance requirements that prevent third-party AWS integrations. Learn more
• CUR Data Anonymization: Anonymize AWS account IDs and resource identifiers before uploading using SHA-256 one-way hashing. Generate a local mapping file to correlate anonymized IDs with actual resources. Perfect for DLP compliance and security reviews. Learn more

Bug fixes

• Dashboard shows anonymization disclaimers for offline uploads
• Mapping file generation with --output-mapping flag in export script
• Detection of anonymized vs raw data in uploaded files
• Increased hash truncation from 8 to 12 characters for enterprise scale (50k+ resources)
• Tag keys are now anonymized to prevent DLP leaks (e.g., "Project-Manhattan" → "tag_xxxxxxxxxxxx")
• Unified 7-day TTL for all Air-Gapped mode data (sessions, cost records, waste items)
• Export script updated to v1.8.0 with security enhancements

Visual trend indicators in Cost Reports showing cost direction within the selected period, plus AWS service icon fixes.

Features

• Cost Reports Trend Indicators: Trend arrows now appear next to Total Cost and Avg Daily Cost in the Cost Reports table, showing whether each service's costs are increasing or decreasing within the selected time period. Learn more

Bug fixes

• Fixed AWS App Runner icon path (was showing fallback)
• Fixed Amazon Simple Email Service icon mapping
• Fixed AWS Secrets Manager icon mapping
• Fixed AWS Key Management Service icon mapping
• Improved trend indicator alignment in Cost Reports table

Visual enhancement with AWS service icons in Dashboard and Cost Reports for quick service identification.

Features

• AWS Service Icons: AWS service icons now appear next to service names in the Dashboard and Cost Reports. Icons are loaded from CDN with zero bundle impact and include category-colored fallbacks for unmapped services.

Introducing CloudWise Shield with cost anomaly detection, Slack integration, and affordable annual pricing at just $19/month.

Features

• Shield Tier - $19/month: Simple, affordable monthly pricing for AWS cost protection. Just $19/month for anomaly detection and Slack alerts.
• Cost Anomaly Detection: Daily monitoring of your AWS costs using statistical analysis. Get instant alerts when spending spikes unexpectedly. Learn more
• Slack Integration: Connect your Slack workspace to receive real-time cost alerts with rich message formatting and severity levels. Learn more
• Anomaly Alerts Dashboard Widget: See recent cost spikes directly on your dashboard with severity color-coding and one-click acknowledgment. Learn more

Bug fixes

• Added comprehensive unit tests for Shield tier features
• Updated tier comparison logic to include Shield tier

Automatic CloudFormation template version tracking and improved user notifications for maintaining up-to-date AWS integrations.

Features

• CloudFormation Template Version Tracking: CloudWise now automatically detects outdated CloudFormation templates and missing IAM permissions. Get notified when updates are available with one-click access to AWS Console for updates. Learn more
• Permission Error Detection: Waste Detection now tracks AccessDenied errors and notifies you about missing permissions that may affect feature availability. Learn more
• User-Specific Banner Dismissal: Notification banners are now dismissed per-user, ensuring each team member sees relevant updates.

Bug fixes

• AI Copilot performance optimization (PR #109)
• Waste detection delete fix for cleaned resources (PR #108)
• Fixed issue where waste detection could fail silently on permission errors

The first production release of CloudWise brings comprehensive AWS cost monitoring, AI-powered insights, and enterprise-ready features.

Features

• AI Copilot: Ask questions about your AWS costs in plain English. Get instant insights, recommendations, and trend analysis powered by AI. Learn more
• Cost Analytics Dashboard: Real-time visibility into your AWS spending with breakdowns by service, region, and account. Learn more
• Waste Detection: Automatically identify unused and underutilized resources to reduce AWS spending. Expanded with optimizer and savings cache (PR #106). Learn more
• Multi-Account Support: Monitor and aggregate costs across multiple AWS accounts from a single dashboard. Learn more
• Cost Reports & Export: Generate detailed cost reports with CSV and PDF export capabilities. Learn more
• Budget Alerts: Set spending thresholds and receive notifications when costs approach or exceed limits. Learn more
• Free Tier: Comprehensive freemium tier with 5 AI queries/day, cost analytics, and waste detection (PR #85).

Bug fixes

• Lambda SnapStart for faster API response times (PR #97)
• Eventually consistent reads for all DynamoDB operations (PR #99)
• Optimized Cost Reports page endpoints (PR #98)
• Fixed AI Copilot DynamoDB credentials (PR #94)
• Improved S3 waste detection (PR #95)