What every plan ships with
CONNECT
One IAM role. Read-only by default.
Deploy a CloudFormation StackSet or paste a one-liner. SpendLens never asks for keys, never assumes ownership, never moves money.
# CloudFormation, one-liner
aws cloudformation create-stack \
--stack-name probackend-readonly \
--template-url https://cf.probackend.io/v3.yaml \
--parameters ExternalId=3eaf…b21d
aws cloudformation create-stack \
--stack-name probackend-readonly \
--template-url https://cf.probackend.io/v3.yaml \
--parameters ExternalId=3eaf…b21d
SCAN
Scheduled + on-demand
Hourly delta, nightly full, or trigger a scan from CI. Findings stream live to the UI.
FIX
CLI · Terraform · UI
Generate the exact command, the Terraform diff, or apply through a confirmation modal. Always reversible.
aws cliterraformcdkmanual
EVIDENCE
Audit trail for every fix
Who applied what, when, and the dollar impact. Export to CSV or pipe to your SIEM.
ROLES
Granular RBAC
Finops can see and approve. Engineers can apply. Execs see the bottom line. No new SSO needed.
COMPLIANCE
SOC 2 Type II · ISO 27001
Region-pinned data, BYO-KMS, and a signed BAA available on Enterprise. Audited annually by Schellman.
Plug it in. See the bill.
Fix what's loud.
Five minutes from sign-up to your first finding. Free up to 3 accounts and $5,000/mo of monitored spend — no card.