Skip to content
Valmora , home

5-day AWS cost optimization audit

Your AWS bill, priced finding by finding. Roadmap in five days.

USD $3,500 fixed · 5 business days · read-only

Valmora is a specialist AWS FinOps practice for Series A to C B2B SaaS and AI companies. With read-only access, we price the material savings opportunities we find in annualized dollars and hand your team a roadmap ranked by impact relative to effort and risk. We never make changes in your account.

Book a 20-minute callSee a sample finding

01Why an outside audit

Built for teams that already own their AWS bill.

Awareness is rarely the gap. Dedicated time to price the commitment, rightsizing and data-transfer decisions that matter against real usage usually is.

  1. 01

    A focused week

    Your platform engineers know the stack better than anyone. What they rarely have is uninterrupted time to model commitment coverage, trace data-transfer paths, and price what they find. The audit does that work, without pulling them off the roadmap.

  2. 02

    Findings in dollars, not dashboards

    Cost tools surface recommendations. The roadmap ranks them by annualized dollar impact relative to effort and risk, so engineering, finance, and the board can weigh priorities in the same units.

  3. 03

    Numbers your team can check

    The fee is fixed and never a percentage of savings. We hold no write or purchasing access, and the total is priced from your billing data where available, with calculation detail for each material finding, so your team can check it.

02The deliverable

What a finding looks like.

For each material finding, where supported by available data, the report states the evidence, estimated annualized impact, recommended action, effort, production risk and material assumptions.

Illustrative example · not from a client engagement · simplified 12-month figures

S3 traffic from private subnets paying NAT gateway processing charges

EvidenceThe billing lines and resource metadata it rests on
20,000 GB a month billed as NatGateway-Bytes in us-east-1. Private-subnet route tables send 0.0.0.0/0 to NAT gateways and have no S3 gateway endpoint.
Dollar impactAnnualized, priced from your billing data where available
12,000 GB × $0.045/GB = $540 a month; × 12 = $6,480 a year (simplified). A gateway endpoint for S3 has no hourly or data-processing charge.
AssumptionsEvery input the number depends on
60% of NAT-processed bytes are same-Region S3 traffic (to be measured). $0.045 per GB processed is the us-east-1 list price. Volume stays flat.
ConfidenceHow sure, and what would change it
Medium. Price and volume come straight from billing data; the S3 share is an estimate until your team confirms it from VPC Flow Logs, which the audit role cannot read. In a live report, a value resting on an unmeasured assumption like this may be stated as a range, and only the lower bound of a range counts toward the guarantee.
EffortWhat it takes to capture
Low. One gateway endpoint per affected VPC plus route-table associations: a few lines of Terraform or CloudFormation.
Production riskWhat could break, and who should review it
Low to moderate. Switching routes drops open TCP connections to S3. Bucket or IAM policies matching aws:SourceIp stop matching (use aws:VpcSourceIp). Same-Region S3 only.
RecommendationThe specific change
Create an S3 gateway endpoint in each affected VPC and associate the private route tables, one VPC first, outside peak hours.
Suggested validation & rollbackGuidance for your team, which implements, validates and rolls back
Your team can validate that NatGateway-Bytes drops by roughly the S3 share in Cost Explorer within a day or two, and that S3 clients reconnect cleanly. To roll back, your team disassociates the route tables or deletes the endpoint, and traffic returns to the NAT gateway.

Figures are computed from the stated assumptions, not measured in any client account. This is a simplified illustration (monthly figure × 12), not the guarantee calculation, which the engagement agreement defines using a baseline period, normally the most recent completed AWS billing month. Price: AWS Price List API, AmazonEC2 us-east-1, NatGateway-Bytes, effective 1 Sep 2026. Gateway-endpoint pricing and routing behavior: AWS PrivateLink documentation, “Gateway endpoints for Amazon S3”.

Sample findings

These are simulated excerpts so you can see how Valmora writes a finding. They are not client work and not a promised result for your account.

03The audit

Scope, deliverables, and who it’s for.

Start with the audit. Keep us on only if the numbers earn it.

5-Day AWS Cost Optimization Audit

Fixed fee. Five business days. Read-only access.

Fixed feeUSD $3,500

What we examine

  • Commitment coverage: Savings Plans and Reserved Instances against real usage
  • Compute rightsizing across your fleet
  • Storage lifecycle and orphaned resources
  • Data transfer patterns across AZs and through NAT

What the report covers

Covered where present in your account and supported by the data.

  • Cost analysis across your in-scope accounts and services, to line-item detail where your billing export allows
  • Savings roadmap ranked by dollar impact relative to effort and risk
  • Commitment and purchasing recommendations, priced against your actual usage
  • Architecture-level cost findings, quantified where the data supports it
  • One written Audit Report, plus a 30-minute walkthrough call if you request one within 14 days of delivery

Who it’s for

  • Series A, B or C B2B SaaS, AI/ML, developer-tools, security, data, or infrastructure-software company
  • Roughly $15K or more a month in AWS spend
  • An engineering team that will own implementation

Not a fit

  • Under about $15K a month in AWS spend. We’ll say so on the first call.
  • You need someone to make changes in production. We don’t.
  • Model architecture or application code review. Out of scope.
Book a 20-minute call

One fixed fee, paid upfront, plus applicable taxes. No hourly billing, no scope creep.

04How it works

Access confirmed. Report five business days later.

  1. 01Before day 1

    20-minute call

    We walk through your AWS setup and confirm scope. If we don’t expect the audit to clear the 5× threshold, we say so.

  2. 02Before day 1

    Read-only access

    Signed engagement agreement and full payment first. Then your team creates the least-privilege, read-only IAM roles, and we confirm in writing that they work.

  3. 03Days 1–5

    Analysis

    Spend to line-item detail where your billing export allows, commitment coverage, rightsizing, storage, and data transfer. Each material finding priced in dollars where the data supports it, and ranked by impact relative to effort and risk.

  4. 04Day 5

    Report delivered

    The written Audit Report, stating the total identified annualized value. A 30-minute walkthrough call is included if you request one within 14 days of delivery. Access ends on delivery.

The five business days start on the later of two events: we receive the full fee, and we confirm in writing that the read-only AWS and Billing/Cost Management access you provisioned is working. The clock starts once both are in place. We test your access within one business day of your written notice that it is in place. If a dependency on your side, an access interruption or a force majeure event delays the work, the period extends by that delay. If we miss the date for any other reason and have not yet delivered the report, you can cancel by written notice within three business days after the missed date and receive a full refund.

05Access & security

Read-only by design. Every change stays yours.

Valmora analyzes and recommends. Your team decides, purchases and implements. We hold no write or purchasing access in your AWS accounts.

What the roles can see

  • Billing and cost data, including Cost Explorer and the billing export files you approve
  • Usage data across your in-scope accounts and services
  • Resource configuration metadata
  • Utilization metrics and tags
  • Savings Plan and Reserved Instance coverage

What they can’t see or do

  • The contents of your applications and data stores, apart from the billing export files you approve
  • Create, modify, or delete any resource
  • Purchase Savings Plans or Reserved Instances
  • Change anything in production, on the audit or any later scoped work
Agreement before access
Access is granted only under the signed engagement agreement, never under the NDA.
You review the policies
Your team sees the exact IAM policies before the roles are granted.
Time-limited
Access ends on delivery. We stop using the roles and tell you, and your team removes them.
Your change control
Your team reviews and applies every change it approves.

We do not install agents. The exact policy JSON is reviewed with you before any role is created.

06The Valmora guarantee

We guarantee your audit will identify at least 5× its fee (USD $17,500) in annualized savings, or we refund the fee automatically.

You keep the report. Subject to the terms of the engagement agreement.

The threshold
Qualifying opportunities totaling at least USD $17,500 (5× the fee) in annualized value. Below that, the full USD $3,500 fee is refunded within five business days after delivery, with no claim or notice needed.
How savings are counted
Only recurring savings count; one-time savings are stated separately and excluded. Each finding is valued at its cost in the baseline period (normally the most recent completed AWS billing month), less the estimated cost after the recommended change, scaled to a full year. AWS credits, refunds and tax are left out of the cost, so credits and refunds don’t shrink the baseline. Where a finding is estimated as a range, only the lower bound counts. No cost is counted more than once.
Identified vs. realized
Identified savings are opportunities, calculated as if the recommendation is implemented and your workload and AWS pricing stay broadly the same for twelve months. Some opportunities take engineering work or a commitment purchase to capture. They count too, and the report states the effort, risk and dependencies of each. What you realize depends on which recommendations you implement, and when.

We send the full agreement (MSA, SOW and access schedule) before you commit. Ask for it any time.

07Who does the work

Xavier Perera

Xavier Perera, founder of Valmora Consulting

Founder, Valmora Consulting

AWS Solutions Architect · FinOps Certified

Valmora is built around one constraint: the founder does the analysis and writes the report that the 5× guarantee (terms apply) is measured on.

How we operate

Decision rules are explicit: under $15K/mo, we say on the first call that the audit is not the right fit. Optimization comes before commitment purchasing, and the highest-dollar findings get quantified first. The work is billing and infrastructure, not model architecture or code.

Why it’s built this way

Fixed fee, fixed scope, one AWS cost specialist from start to finish. The mandate stays narrow so the same judgment runs the whole engagement.

Working remotely. Available to US and Canadian teams. Email directly: xavier@valmoraconsulting.com

08FAQ

What engineering leaders ask before granting access

Something not covered? Email the question or raise it on the call.

We already use Cost Explorer, Compute Optimizer, or a FinOps tool. What does this add?

Those tools are useful, and we use their recommendations as inputs. The audit is the layer on top. Each signal is validated against your workload context, constraints and production risk before it counts as a finding, then priced in annualized dollars and sequenced by effort and risk. You get one report. You are buying the diagnosis and prioritization, not another dashboard.

How is our data handled?

Under the confidentiality and data-handling terms of the signed engagement agreement. The NDA covers early scoping conversations only and never includes AWS access. We see billing and cost data, including the billing export files you approve, plus resource configuration and utilization metrics. The roles cannot read the contents of your applications or other data stores. Configuration metadata can include values your team has placed in fields such as environment variables and tags, so the access checklist asks you to confirm no secrets sit in environment variables before the roles are created. Raw billing exports are deleted from our active systems within 30 days of delivery and working files within 90, unless a dispute or legal hold requires longer. We may keep the final report as a confidential business record for up to seven years. We use generative-AI tools on your data only if you authorize it in the SOW. Access ends on delivery.

How is the 5× guarantee measured?

We guarantee your audit will identify at least 5× its fee (USD $17,500) in annualized savings, or we refund the fee automatically. You keep the report. Subject to the terms of the engagement agreement. How savings are counted: only recurring savings count; one-time savings are stated separately and excluded. Each finding is valued at its cost in the baseline period (normally the most recent completed AWS billing month), less the estimated cost after the recommended change, scaled to a full year. AWS credits, refunds and tax are left out of the cost, so credits and refunds don’t shrink the baseline. Where a finding is estimated as a range, only the lower bound counts. No cost is counted more than once. The refund is paid within five business days after delivery, with no claim or notice needed. Identified savings are not realized savings: what you realize depends on which recommendations you implement, and when.

Who checks the savings number?

Your team can. Each material finding is priced from your own billing data where available (otherwise AWS public pricing, which the report discloses), with enough calculation detail for a competent third party to reproduce it. Where a value is a range, only the lower bound counts, and you have 15 days after delivery to dispute any calculation in writing; after that, the calculations stand for the purposes of the guarantee.

How much of our team’s time does it take?

The 20-minute call, creating the read-only roles and telling us when they are in place, a technical contact who can answer questions within a business day, and, if you want one, the 30-minute walkthrough. The five days of analysis are designed so your engineers stay heads-down. AWS bills its usual Cost Explorer API charges to your account for the queries we run.

How fast will we see results?

The report arrives within the five business days with findings ranked by impact relative to effort and risk. Any savings depend on what your team implements, and when. The roadmap puts the best return for effort and risk first.

Do you take a percentage of the savings?

No. The audit is a fixed fee, agreed before we start, never a percentage of what we find. Ongoing work is scoped after the audit, only if the findings justify it. There is no monthly package required to start. The fee is the same whatever the audit finds. Its only link to the result is the 5× guarantee (terms apply).

09Next steps

After the audit

The audit stands on its own. If the findings point to work that would benefit from continued support, such as commitment planning, ongoing cost review, or follow-through after major infrastructure changes, Valmora can scope it separately after the audit. No ongoing engagement is required.

10Get started

Twenty minutes to find out. Five days to a priced roadmap.

No prep required. We talk through your AWS setup, confirm fit and scope, and tell you plainly whether we expect the audit to clear the 5× threshold. You’ll confirm your monthly AWS spend while booking. Booking commits you to twenty minutes, nothing more.

AWS Cost Strategy Call · 20 min

Prefer email? xavier@valmoraconsulting.com

Book a 20-minute call