CloudTrim — Cut AWS spend 30% in one week, zero downtime

The money section

The proof, measured — not claimed.

The demo seeds a realistic 18-month-old startup account — 26 EC2 instances, 31 volumes, 22 snapshots, 2 ALBs, 4 S3 buckets, NAT gateways, all provisioned by real terraform apply — then runs the complete engagement. Savings are verified CUR-to-CUR: the billing report is regenerated from post-remediation state and a full re-audit runs against it.

Before · monthly run-rate (CUR)$8,703.59

baseline

After · re-audit (CUR)$5,890.53

trimmed

−$2,813.06 per month · 32.32% verified reduction
($33,756.72 per year)

+ $3,632/mo of Tier 2/3 roadmap savings (rightsizing, NAT consolidation, Graviton, Spot, Savings Plans) identified, costed and scheduled — never blindly executed.

Connect Terraform provisions the wasteful account. 14 days of CloudWatch telemetry + a 60-day CUR billing export generated from live API state. 110 resources
$8,703.59/mo

Audit Read-only boto3 inventory scan (paginated describe calls), CUR parsing, 22-rule catalog, bottom-up cost model cross-check. 99 findings
variance −0.2%

Remediate Tier 0/1 actions applied via real AWS API calls, each verified by read-back. Terraform remediation modules (1.5+ import blocks) generated as client artifacts. 65/65 verified
0 pending

Verify CUR regenerated from post-remediation state, full re-audit runs against it. The dashboard shows the before/after proof. 32.32% cut
$33,757/yr

How the week runs

Five steps. One seam. No surprises.

The engine compresses a 35-hour manual audit into roughly 4 hours of billable engagement — the consultant spends their time on judgment, not describe-instances pagination.

Connect

Read-only IAM role in the client account. Scanner pulls the full inventory via paginated describe calls — no agents, no write access.

Audit

22-rule catalog evaluated over inventory + 14 days of CloudWatch telemetry, cross-checked against the CUR billing file.

Report

Client-ready PDF: headline savings, tiered findings with evidence, remediation plan. The fixed-fee deliverable.

Remediate

Tier 0/1 only — pure waste and in-place operations. Every action verified by API read-back. Zero customer-facing downtime.

Verify

Re-audit against regenerated CUR billing. The reduction you report to the client is the one billing shows.

The account is real infrastructure

Created by terraform apply, not JSON fixtures. Telemetry (CloudWatch) and billing (CUR CSV in the real AWS Cost & Usage Report schema) are generated from live API state — what an emulator can't natively provide.

The code path is production code

The engine talks to AWS through one seam — cloudtrim/aws.py. With AWS_ENDPOINT_URL set it points at the AWS-compatible emulator; unset, the identical code scans a real AWS account through the standard credential chain.

The money math reconciles

Savings come from real us-west-2 list pricing times live inventory, cross-checked against CUR billing every audit — variance −0.2% in this run. In live audits, reconciliation catches CUR lag and pricing drift before the client does.

The catalog

22 rules. 4 risk tiers. Zero guesswork.

Every finding is tiered by blast radius, not just dollars. Tier 0 and Tier 1 execute safely inside the engagement; Tier 2/3 are costed, specified and scheduled with your team — never blindly executed.

T0 · PURE WASTE

Safe to remove, now

Resources billing money and delivering nothing. Deleting them changes no customer-visible behavior.

unattached EBS volumesstale snapshots ≥45dunused AMIsorphaned EIPsidle ALBs · 0 targetsS3 multipart-upload leaks

T1 · ZERO DOWNTIME

In-place, non-disruptive

Live AWS API operations that change what you pay, not what you serve. Applied during the engagement.

idle EC2 stop · CPU<5%/14dgp2 → gp3 in-placeS3 lifecycle coldeningCloudWatch log retention

T2 · MAINTENANCE WINDOW

Needs a change window

Changes that touch running workloads — scheduled with the client, never executed blind.

rightsizing · 5–20% CPUoversized volumesNAT consolidationlong-stopped instance cleanup

T3 · PLANNED ROADMAP

Architecture-level savings

The big structural wins — identified, costed and scheduled as a follow-on plan.

Graviton migrationSpot for stateless fleetsSavings Plans coverageRDS idleRDS gp3ElastiCacheLambda concurrencyclassic ELB

* live-only rules — evaluate quietly on accounts where the APIs are present; the demo emulator doesn't cover them. Full specification with detection logic and savings formulas: the PRD (PDF).

What's in the box

One compose file. Three containers.

The whole stack is portable — GitHub Codespaces, laptops, CI. The only demo-only component is the emulator; everything else is the shipped code.

web :3000

Next.js 16 dashboard — dark-fintech single page: findings, tier filters, remediation log, before/after proof.

engine :3030

Python 3.12 + Terraform 1.9 — the cloudtrim package. FastAPI service + CLI: seed, audit, remediate, report, demo.

emulator :4566

AWS-compatible API (moto 5.2.3, pinned; LocalStack Pro is a drop-in). Full community coverage: EC2, ELBv2, S3, CloudWatch, Logs, STS.

aws.py endpoint-agnostic client factory scanner.py paginated read-only inventory cur.py CUR 2.0 parser + billing generator pricing.py us-west-2 list prices rules.py 22 rules · 4 tiers audit.py pipeline + reconciliation remediate.py read-back verification terraform_gen.py import-block modules report.py client PDF (ReportLab) seeder.py TF apply + telemetry + billing

SQLite (engine/data/cloudtrim.db) is the audit record: scans, findings, every action with before/after state and verification verdict.

Run it yourself

Full engagement in 3–5 minutes.

cloudtrim — full E2E demo

$ make demo # seed → audit → remediate → verify ✔ terraform apply: 110 resources provisioned baseline $8,703.59/mo ✔ audit: 1,299 items · 99 findings applied-tier $2,809.48/mo ✔ reconciliation: CUR $8,703.59 vs model $8,687.80 variance −0.2% ✔ remediate: 65/65 actions verified by read-back 0 pending ✔ re-audit: $5,890.53/mo 32.32% verified reduction $ make report # client-ready PDF + Terraform remediation modules ✔ engine/output/cloudtrim-audit-report.pdf the fixed-fee deliverable ✔ engine/output/terraform/<stamp>-remediation/ import-block modules you keep

GitHub Codespaces recommended

The devcontainer brings up Docker, starts the stack, and forwards ports 3000 / 3030. Then:

$ make demo # 3–5 minutes $ open http://localhost:3000

4-core machine recommended. codespaces.new/adventurewave-labs/cloudtrim →

Any Docker host

Everything is in the compose file — no Codespaces required:

$ docker compose up -d --build $ docker compose exec engine cloudtrim demo

Deliverables land in engine/output/
cloudtrim-audit-report.pdf — client-facing report
terraform/<stamp>-remediation/ — reviewable TF modules

Same code, real AWS

Demo mode off. Production mode on.

There is no "demo version" of the engine — the emulator is just the other end of one seam. Point the same code at a real account and it runs the identical scan, rules, remediation and verification.

live mode — read-only first

$ cd engine && pip install . $ unset AWS_ENDPOINT_URL # no emulator $ export AWS_PROFILE=client-acct # read-only IAM role recommended $ cloudtrim audit # read-only scan + CUR parse + findings $ cloudtrim report # client-ready PDF

Audit phase needs read-only describe/list/get on ec2, elbv2, s3, logs, cloudwatch, ce, cur. Remediation requires scoped write actions — applied through the engine or the generated Terraform modules via your CI.

The product behind the demo

Fixed fee. One week. You keep the artifacts.

CloudTrim is the delivery engine for a productized consulting practice — the demo above is the Standard engagement, end to end. No hourly billing, no report that sits on a shelf.

LITE

$3k fixed

one-week snapshot audit

Full read-only account scan
Tier 0 pure-waste findings
Top-10 quick wins, costed
Client report PDF
Terraform remediation modules

THE DEMO RUNS THIS

STANDARD

$5k fixed

one-week audit + remediation

Everything in Lite
All 22 rules, all 4 tiers
T0 + T1 remediation applied & verified
Zero customer-facing downtime
Terraform remediation modules you keep

DEEP-DIVE

$8k fixed

one week + follow-on plan

Everything in Standard
T2/T3 roadmap: rightsizing, Graviton, Spot, Savings Plans
NAT / architecture consolidation plan
Scheduled with your team

Straight answers

Questions we get

Is this demo real or mocked?

Three layers are real: the infrastructure (created by terraform apply, not JSON fixtures), the code path (production boto3 + Terraform through one seam), and the money math (list pricing × live inventory, reconciled against CUR billing). The only demo-only parts: the AWS API emulator (moto), and the seeded telemetry/billing history an emulator can't generate natively.

How is the 32.3% "verified"?

CUR-to-CUR. After remediation, the billing export is regenerated from post-remediation API state and a full re-audit runs against it. Every individual action is additionally verified by an API read-back (65/65 verified, 0 pending), so the headline number isn't a projection — it's what billing shows after the changes.

Will anything go down during remediation?

No. The engine only auto-applies Tier 0 (pure waste — resources doing nothing) and Tier 1 (in-place AWS operations like gp2→gp3 conversion or log retention). Anything that touches running workloads is Tier 2/3: identified, costed, scheduled with your team — never blindly executed.

Can it run against our AWS account?

Yes — that's the point. cloudtrim audit is read-only and safe to point at production through a standard credential chain. Remediation uses scoped write actions, applied either by the engine or by the generated Terraform modules through your own CI, so approvals and change control stay in your pipeline.

Why AWS-only?

v1 scope: LA startup focus, us-west-2. AWS covers the overwhelming majority of target accounts, and doing one cloud deeply beats doing three clouds shallowly. Multi-cloud is roadmap, not promise.

Cut AWS spend 30% in one week.
Zero downtime. Verified by re-audit.