AWS spend and resource monitoring

Investigate the cloud change behind the cost change.

Sentinely Guard is AWS cost monitoring that reads your spend and resource inventory with read-only credentials and flags unusual activity, such as a spend spike or a new region, before the monthly bill does.

It connects AWS cost history to resource inventory and change events, so you can see which change caused the cost change.

Start 14-day trial Compare plan limits

AWS support at launch · Guard is available on Agency and Scale

What does Guard watch in AWS?

AWS cost snapshots

Read Cost Explorer totals by service and region and project the current month from recent spend.

Resource inventory

Scan enabled AWS services and regions and retain the resources found during each synchronization.

Resource changes

Record added, removed, modified, and suspicious resources instead of showing only the latest state.

Baseline anomalies

Surface spend spikes, new-region activity, resource bursts, and known mining-oriented instance types.

Operational incidents

Open a Sentinely incident for high-severity or security-related anomalies so the team can investigate.

Encrypted credentials

Encrypt AWS credentials at rest with an installation-specific key and never return them to the browser.

What Guard detects today

Evidence for an investigation, not invented savings.

Guard shows the observed cost, recent baseline, affected services and regions, relevant resources, and a confidence score. Your team decides whether and how to remediate in AWS.

Spend increased beyond the selected sensitivity

A previously unseen region generated cost

Many resources appeared during one scan

A suspicious instance family was discovered

Guard questions

Which clouds does Guard support?

AWS only. Guard does not connect to Google Cloud or Azure.

What access does Guard need?

Read-only access to AWS Cost Explorer and resource inventory. Setup shows the minimum read permissions to grant.

Can Guard change or delete my AWS resources?

No. Guard only reads cost and inventory data. Your team decides whether and how to remediate in AWS.

What does Guard detect?

Spend above your chosen sensitivity, cost from a previously unseen region, many resources appearing in one scan, and known mining-oriented instance types.

How are AWS credentials stored?

Encrypted at rest with an installation-specific key. They are never returned to the browser.

Which plans include Guard?

Agency includes 3 connected AWS accounts and Scale includes 10. Indie does not include Guard.

Every product is included in one plan. Compare Indie, Agency and Scale

Connect one AWS account and establish a baseline.

Start with the minimum read permissions shown during setup. Review the first resource inventory and cost snapshot before enabling broader regional coverage.

Start 14-day trial