Burnwatch: cloud and AI cost

Burnwatch shows what you spend on AWS, Google Cloud, Azure and AI APIs, whether you will stay inside budget, and what insecure or idle resources cost you. Included in Complete; an add-on for Cloud & AI and Governance.

#Read your cloud costs

Cost read is its own job, separate from posture scans, using the account's existing identity.

1. Grant one extra read permission:
   • AWS: ce:GetCostAndUsage on the role (role-based or keyless accounts; access keys are refused).
   • Google Cloud: turn on Cloud Billing export to BigQuery, then grant roles/bigquery.dataViewer on the export dataset and roles/bigquery.jobUser in the connected project.
   • Azure: Cost Management Reader on the subscription.
2. An Admin turns on Cost read for the account (Burnwatch → Cloud spends; Google Cloud also asks for the export table). The first sync reads 90 days, later ones 35.
3. Syncs run on the account's schedule (12, 18, 24, 168, 336 or 720 hours) and on Sync now (at most every 15 minutes). Cloud spends shows each account's last sync and whether it is stale.

Turning cost read off deletes that account's stored costs.

#What you see

• Executive overview: what you spent this month, the month-end forecast (with a p10-p90 range once 14 days are reported) and whether that is inside budget. Costs in a currency other than the budget's are listed separately, never converted.
• Cost basis: before credits (billed) or after credits (effective); the toggle hides when they are equal.
• Cost explorer: filter by account, service, region, project and up to five cost tags per account; export CSV.
• Trend, breakdown and "Why did my bill change?" by service, region, account and project.
• Projects: rules that assign an account and/or service (or a Kubernetes namespace for cluster cost) to a project; the most specific rule wins; the rest is "Unallocated".
• Budgets and alerts at 50 %, 80 % and 100 % (forecast and actual), with the expected breach date.
• Anomalies: the last 7 days well above the usual level; notified once.
• Weekly digest every Monday. Custom dashboards from 16 widgets, private or shared with the organization.
• Display currency (off by default): shows converted figures with "≈" and the ECB rate date; stored costs, budgets and exports are never converted.

#Cost of insecure and idle resources

Burnwatch joins your latest Cloud scan with your spend: which services carry open findings and what that service costs in the account (cost rows have no resource id, so it is never "this one resource"), idle resources (stopped VMs and databases, load balancers without targets, unattached public IPs) with a labelled list-price estimate, and rightsizing to a newer instance generation. With CPU read turned on per account, it also suggests halving instances whose 95th-percentile CPU stayed at or under 40 % over 14 days (never burstable types; check memory first).

#AI spend

Option A, the usage helper. Your code reports the token counts each AI call returns; DVSentry never sees a prompt, a reply, audio or your provider key.

1. On Burnwatch → AI usage, an Admin creates the ingest token (dvs_aiu_..., shown once, MFA step-up). It can only send usage, and can be limited to CIDR ranges.
2. Download /downloads/dvsentry_ai_usage.py (one file, standard library only):

   import os
   from dvsentry_ai_usage import UsageReporter
   
   reporter = UsageReporter("https://app.dvsentry.com", os.environ["DVSENTRY_AI_USAGE_TOKEN"],
                            customer_salt=os.environ.get("DVSENTRY_CUSTOMER_SALT"))
   response = client.chat.completions.create(model="gpt-4o-mini", messages=messages)   # your call
   reporter.record_openai(response, feature="support-reply", customer_id=account.id)
   reporter.close()   # at shutdown

   It batches, retries and never raises into your code. Customer and conversation ids are hashed with your salt before they leave your process. Speech-to-text and text-to-speech are reported as audio milliseconds and characters.
3. The AI usage tab shows estimated spend by model, feature, customer and day, cost per conversation, and usage that could not be priced (never shown as zero).

Option B, provider keys. An Admin can store an OpenAI or Anthropic admin key so Burnwatch can read the provider's own usage report and compare billed against metered. The key is used only by an isolated service that reads usage and nothing else.

#Estimate and preview

The calculator prices compute, storage, databases, egress and AI tokens from list prices ("list price, verify"). Paste terraform show -json output to preview a deployment's monthly cost before you apply it:

terraform plan -out plan.tfplan && terraform show -json plan.tfplan > plan.json
# Burnwatch → Estimate → Preview a Terraform plan → upload plan.json (2 MB max)

Types it cannot price are listed as "not priced", never zero.

#Kubernetes cost

With an agent advertising kubernetes_cost_read, Burnwatch prices node capacity and pod requests per namespace from the pricing catalog.

Something missing or unclear? Tell us with Feedback in the app.