Skip to content
Valmora , home

5-day AWS cost optimization audit

Your AWS bill, priced finding by finding. Roadmap in five business days.

USD 3,500 fixed · 5 business days · read-only

Valmora does AWS FinOps for Series A to C B2B SaaS and AI companies. With read-only access, we put an annualized dollar figure on each material savings opportunity we find and rank them against the effort and risk. We never make changes in your account.

Book a 20-minute callSee a sample finding

01Why an outside audit

Built for teams that already own their AWS bill.

You probably know the bill is high. What’s missing is the time to price the commitment, rightsizing and data-transfer decisions against real usage.

  1. 01

    A focused week

    Your engineers know your stack better than we will. They just don’t get a clear week to model commitment coverage, trace data transfer and price what they find. We do that, and they stay on the roadmap.

  2. 02

    Findings in dollars

    Cost tools give you a list of recommendations. We rank them by annualized dollars against effort and risk, so engineering, finance and the board are all looking at the same numbers.

  3. 03

    Numbers your team can check

    Every material finding shows its calculation, priced from your billing data where available, so your team can check it. The fee is fixed and never a percentage of savings, and we hold no write or purchasing access.

02The deliverable

What a finding looks like.

For each material finding, where supported by available data, the report states the evidence, estimated annualized impact, recommended action, effort, production risk and material assumptions.

Illustrative example · not from a client engagement · simplified 12-month figures

S3 traffic from private subnets paying NAT gateway processing charges

EvidenceThe billing lines and resource metadata it rests on
20,000 GB a month billed as NatGateway-Bytes in us-east-1. Private-subnet route tables send 0.0.0.0/0 to NAT gateways and have no S3 gateway endpoint.
Dollar impactAnnualized, priced from your billing data where available
12,000 GB × $0.045/GB = $540 a month; × 12 = $6,480 a year (simplified). A gateway endpoint for S3 has no hourly or data-processing charge.
AssumptionsEvery input the number depends on
60% of NAT-processed bytes are same-Region S3 traffic (to be measured). $0.045 per GB processed is the us-east-1 list price. Volume stays flat.
ConfidenceHow sure, and what would change it
Medium. Price and volume come straight from billing data; the S3 share is an estimate until your team confirms it from VPC Flow Logs, which the audit role cannot read. In a live report, a value resting on an unmeasured assumption like this may be stated as a range, and only the lower bound of a range counts toward the guarantee.
EffortWhat it takes to capture
Low. One gateway endpoint per affected VPC plus route-table associations: a few lines of Terraform or CloudFormation.
Production riskWhat could break, and who should review it
Low to moderate. Switching routes drops open TCP connections to S3. Bucket or IAM policies matching aws:SourceIp stop matching (use aws:VpcSourceIp). Same-Region S3 only.
RecommendationThe specific change
Create an S3 gateway endpoint in each affected VPC and associate the private route tables, one VPC first, outside peak hours.
Suggested validation & rollbackGuidance for your team, which implements, validates and rolls back
Your team can validate that NatGateway-Bytes drops by roughly the S3 share in Cost Explorer within a day or two, and that S3 clients reconnect cleanly. To roll back, your team disassociates the route tables or deletes the endpoint, and traffic returns to the NAT gateway.

Figures are computed from the stated assumptions, not measured in any client account. This is a simplified illustration (monthly figure × 12), not the guarantee calculation, which the engagement agreement defines using a baseline period, normally the most recent completed AWS billing month. Price: AWS Price List API, AmazonEC2 us-east-1, NatGateway-Bytes, effective 1 Sep 2026. Gateway-endpoint pricing and routing behavior: AWS PrivateLink documentation, “Gateway endpoints for Amazon S3”.

Sample findings

These are simulated excerpts so you can see how Valmora writes a finding. They are not client work and not a promised result for your account.

03The audit

What you get, and who it’s for.

Start with the audit. Keep us on only if the numbers earn it.

5-Day AWS Cost Optimization Audit

Fixed fee. Five business days. Read-only access.

Fixed feeUSD 3,500

What we examine

  • Commitment coverage: Savings Plans and Reserved Instances against real usage
  • Compute rightsizing across your fleet
  • Storage lifecycle and orphaned resources
  • Data transfer patterns across AZs and through NAT

What the report covers

Covered where present in your account and supported by the data.

  • Cost analysis across your in-scope accounts and services, to line-item detail where your billing export allows
  • Savings roadmap ranked by dollar impact relative to effort and risk
  • Commitment and purchasing recommendations, priced against your actual usage
  • Architecture-level cost findings, quantified where the data supports it
  • One written Audit Report, plus a 30-minute walkthrough call if you request one within 14 days of delivery

Who it’s for

  • Series A, B or C B2B SaaS, AI/ML, developer-tools, security, data, or infrastructure-software company
  • Roughly $15K or more a month in AWS spend
  • An engineering team that will review and merge every change

Not a fit

  • Under about $15K a month in AWS spend. We’ll say so on the first call.
  • You need someone to make changes in production. We don’t. After the audit, we can prepare pull requests for your team to merge.
  • Model architecture or application code review. Out of scope.
Book a 20-minute call

One fixed fee, paid upfront, plus applicable taxes. No hourly billing.

04How it works

Access confirmed. Report five business days later.

  1. 01Before day 1

    20-minute call

    We walk through your AWS setup and confirm scope. If we don’t expect the audit to clear the 5× threshold, we say so.

  2. 02Before day 1

    Read-only access

    Signed engagement agreement and full payment first. Then your team creates the least-privilege, read-only IAM roles, and we confirm in writing that they work.

  3. 03Days 1–5

    Analysis

    Spend to line-item detail where your billing export allows, commitment coverage, rightsizing, storage, and data transfer. Each material finding priced in dollars where the data supports it, and ranked by impact relative to effort and risk.

  4. 04Day 5

    Report delivered

    The written Audit Report, stating the total identified annualized value. A 30-minute walkthrough call is included if you request one within 14 days of delivery. Access ends on delivery.

The five business days start on the later of two events: we receive the full fee, and we confirm in writing that the read-only AWS and Billing/Cost Management access you provisioned is working. The clock starts once both are in place. We test your access within one business day of your written notice that it is in place. If a dependency on your side, an access interruption or a force majeure event delays the work, the period extends by that delay. If we miss the date for any other reason and have not yet delivered the report, you can cancel by written notice within three business days after the missed date and receive a full refund.

05Access & security

Read-only by design. Every change stays yours.

Valmora analyzes and recommends. Your team makes every decision and purchase, and approves and merges every change. We hold no write or purchasing access in your AWS accounts.

What the roles can see

  • Billing and cost data, including Cost Explorer and the billing export files you approve
  • Usage data across your in-scope accounts and services
  • Resource configuration metadata
  • Utilization metrics and tags
  • Savings Plan and Reserved Instance coverage

What they can’t see or do

  • The contents of your applications and data stores, apart from the billing export files you approve
  • Create, modify, or delete any resource
  • Purchase Savings Plans or Reserved Instances
  • Change anything in production, on the audit or any later scoped work
Agreement before access
Access is granted only under the signed engagement agreement, never under the NDA.
You review the policies
Your team sees the exact IAM policies before the roles are granted.
Time-limited
Access ends on delivery. We stop using the roles and tell you, and your team removes them.
Your change control
Your team reviews and applies every change it approves.

We do not install agents. The exact policy JSON is reviewed with you before any role is created.

06The Valmora guarantee

We guarantee your audit will identify at least 5× its fee (USD $17,500) in annualized savings, or we refund the fee automatically.

You keep the report. Subject to the terms of the engagement agreement.

The threshold
Qualifying opportunities totaling at least USD $17,500 (5× the fee) in annualized value. Below that, the full USD $3,500 fee is refunded within five business days after delivery, with no claim or notice needed.
How savings are counted
Only recurring savings count; one-time savings are stated separately and excluded. Each finding is valued at its cost in the baseline period (normally the most recent completed AWS billing month), less the estimated cost after the recommended change, scaled to a full year. AWS credits, refunds and tax are left out of the cost, so credits and refunds don’t shrink the baseline. Where a finding is estimated as a range, only the lower bound counts. No cost is counted more than once.
Identified vs. realized
Identified savings are opportunities, calculated as if the recommendation is implemented and your workload and AWS pricing stay broadly the same for twelve months. Some opportunities take engineering work or a commitment purchase to capture. They count too, and the report states the effort, risk and dependencies of each. What you realize depends on which recommendations you implement, and when.

07Who does the work

Xavier Perera

Xavier Perera, founder of Valmora Consulting

Founder, Valmora Consulting

AWS Solutions Architect · FinOps Certified

We do the analysis and write every report ourselves.

How we operate

Under $15K a month, we tell you on the first call that the audit isn’t the right fit. We optimize before recommending commitments, and we price the biggest findings first. The audit covers billing and infrastructure. It doesn’t cover model architecture or code.

Why it’s built this way

Fixed fee, fixed scope, one AWS cost specialist from start to finish. You deal with the person doing the work.

We work remotely with US and Canadian teams. Email: xavier@valmoraconsulting.com

08FAQ

What engineering leaders ask before granting access

Something not covered? Email the question or raise it on the call.

We already use Cost Explorer, Compute Optimizer, or a FinOps tool. What does this add?

Those tools are useful, and we use their recommendations as inputs. We check each one against your workload, constraints and production risk. The ones that hold up get priced in annualized dollars and ranked by effort and risk. You get one report and no new dashboard.

How is our data handled?

Under the confidentiality and data-handling terms of the signed engagement agreement. The NDA covers early scoping conversations only and never includes AWS access. We see billing and cost data, including the billing export files you approve, plus resource configuration and utilization metrics. The roles cannot read the contents of your applications or other data stores. Configuration metadata can include values your team has placed in fields such as environment variables and tags, so the access checklist asks you to confirm no secrets sit in environment variables before the roles are created. Raw billing exports are deleted from our active systems within 30 days of delivery and working files within 90, unless a dispute or legal hold requires longer. We may keep the final report as a confidential business record for up to seven years. We use generative-AI tools on your data only if you authorize it in the SOW. Access ends on delivery.

How is the 5× guarantee measured?

We guarantee your audit will identify at least 5× its fee (USD $17,500) in annualized savings, or we refund the fee automatically. You keep the report. Subject to the terms of the engagement agreement. How savings are counted: only recurring savings count; one-time savings are stated separately and excluded. Each finding is valued at its cost in the baseline period (normally the most recent completed AWS billing month), less the estimated cost after the recommended change, scaled to a full year. AWS credits, refunds and tax are left out of the cost, so credits and refunds don’t shrink the baseline. Where a finding is estimated as a range, only the lower bound counts. No cost is counted more than once. The refund is paid within five business days after delivery, with no claim or notice needed. Identified savings are not realized savings: what you realize depends on which recommendations you implement, and when.

Who checks the savings number?

Your team can. Each material finding is priced from your own billing data where available (otherwise AWS public pricing, which the report discloses), with enough calculation detail for a competent third party to reproduce it. Where a value is a range, only the lower bound counts, and you have 15 days after delivery to dispute any calculation in writing; after that, the calculations stand for the purposes of the guarantee.

How much of our team’s time does it take?

The 20-minute call, creating the read-only roles and telling us when they are in place, a technical contact who can answer questions within a business day, and, if you want one, the 30-minute walkthrough. Your engineers stay on their own work during the five business days of analysis. AWS bills its usual Cost Explorer API charges to your account for the queries we run.

How fast will we see results?

The report arrives within the five business days with findings ranked by impact relative to effort and risk. Any savings depend on what your team implements, and when. The roadmap puts the best return for effort and risk first.

Do you take a percentage of the savings?

No. The audit is a fixed fee, agreed before we start, never a percentage of what we find. Sprint and retainer fees are also set before work starts, never as a percentage of savings. There is no monthly package required to start. The fee is the same whatever the audit finds. Its only link to the result is the 5× guarantee (terms apply).

09After the audit

Implementation Support & Code Delivery

Optional. After the audit, you can add a sprint, a retainer or neither. Your team reviews, approves and merges every change. We hold no write or purchasing access in your AWS accounts.

  1. 01First

    5-Day Audit

    USD 3,500 fixed

    The priced, ranked roadmap described above.

  2. 02Optional

    Implementation Sprint

    From USD 7,500 fixed

    We write the code for the top findings as pull requests. Your engineers review, approve and merge them.

  3. 03Optional

    Retainer

    Priced by your monthly AWS bill.

    • Managed

      USD 4,500/month

      AWS bill $75K to $150K a month

      Pull request work from a prioritized queue.

    • Embedded

      USD 7,000/month

      AWS bill $150K to $300K a month

      Everything in Managed, with more capacity and faster response.

    • Fractional

      From USD 10,000/month

      AWS bill above $300K a month

      Part-time FinOps lead, scoped per client.

    • Every retainer includes a monthly report of what shipped and the savings identified.
    • Monthly capacity is set in your agreement and does not roll over.
    • Larger work, such as a migration, is quoted separately as a sprint.
    • You can leave from month three on 30 days’ notice.

If your AWS bill is under $75K a month, we offer the audit and a sprint only.

Sprints and retainers carry no savings guarantee. Prices in USD, plus applicable taxes.

10Get started

Start with a 20-minute call.

You don’t need to prepare anything. We go through your AWS setup and scope, and we tell you plainly whether we expect the audit to clear the 5× threshold. Calendly asks for your monthly AWS spend when you book. The call is all you’re committing to.

AWS Cost Call · 20 min

Prefer email? xavier@valmoraconsulting.com

Book a 20-minute call