Cloud Waste Hunter
B2B SaaS platform that scans AWS accounts to identify wasted cloud spend and delivers LLM-powered remediation via Claude on Bedrock.
The scanner finds the waste; the model explains the fix; the customer ships the Terraform that closes the loop.
Tech Stack
Frontend
- React 19
- TypeScript
Backend
- Python
- FastAPI
- AWS Lambda
- API Gateway
Data
- DynamoDB
- AWS Glue
- Amazon Athena
AI
- AWS Bedrock
- Claude 3.5 Haiku
Identity & Billing
- AWS Cognito
- Lemon Squeezy
Infrastructure
- Terraform
Production Metrics
ProjectionTotal Waste Identified
$42,500+
Across all scanned AWS accounts
Active Cross-Account Scanners
14
STS AssumeRole sessions
Total Lambda Invocations
1.2M
Last 30 days
AWS Topology
Drag to rotate · hover for context- Cloud Waste Hunter. FastAPI on Lambda. The product layer that ties every service below into a single FinOps workflow.
- CloudFront. TLS termination + cache for the SaaS frontend.
- API Gateway. Public HTTPS edge in front of the Lambda backend.
- Cognito. User pool + Google IdP, JWT-authorised at API Gateway.
- Lambda. FastAPI container image. Self-invoke pattern bypasses the 30s API GW timeout.
- DynamoDB. Six tables — accounts, scans, findings, billing, sessions, audit.
- Bedrock. Claude Haiku streams CLI + Terraform remediation per finding.
- S3. CUR 2.0 parquet drop zone + Glue catalog backing store.
- Glue. Crawls CUR parquet, maintains the Athena schema.
- Athena. Serverless SQL over CUR — every waste figure is tied to a real line item.
- EventBridge. Cron + event bus for recurring scans and replays.
- SQS. Decouples scan dispatch from the API request.
Try the auditor
Live · BedrockOutput appears here. The same model and prompt power the production CWH remediation feed.
CWH Pro · cloudwastehunter.io
Want the same scanner pointed at your own AWS account?
Same scanner, same Bedrock remediation, same EventBridge schedule. Plus and Pro tiers add multi-account, API access, and SSO; Free starts you on a single account with no card required.
Overview
Why
Engineering teams know waste exists in their AWS bill. Console-clicked dashboards surface line-items but not the why, and remediation requires reading IAM docs, untangling Terraform, and writing CLI snippets. CWH closes the loop — find it, explain it, fix it — in one workflow.
How
Cross-account scans run over STS AssumeRole, inspecting EC2 / EBS / RDS / NAT / Elastic IPs / load balancers / snapshots in parallel via a 32-wide ThreadPoolExecutor. Cost attribution queries CUR 2.0 directly through Glue + Athena, so figures tie to real billing line items. Each finding is enriched with Claude 3.5 Haiku on Bedrock — the model writes the explanation AND the remediation Terraform.
Trade-offs
Bedrock-streamed remediation is slower and pricier than a local heuristic; for the buyer's mental model ("I trust the AI explanation"), it's the right call. CUR 2.0 over Athena costs more than estimation; the difference is paid for by the precision recruiters and finance leads expect. The self-invoke Lambda pattern bypasses API Gateway's 30-s timeout but adds two more cold-start surfaces — accepted for keeping scans single-region serverless.
Gallery
