---
title: "Guard: AWS cost anomaly and spend monitoring | Sentinely"
description: "Sentinely Guard reads AWS Cost Explorer and resource inventory with read-only credentials and flags spend spikes, new-region activity and resource bursts."
url: https://sentinely.app/guard
---

# Investigate the cloud change behind the cost change.

Sentinely Guard is AWS cost monitoring that reads your spend and resource inventory with read-only credentials and flags unusual activity, such as a spend spike or a new region, before the monthly bill does.

It connects AWS cost history to resource inventory and change events, so you can see which change caused the cost change.

[Start 14-day trial](https://sentinely.app/auth/sign-up) [Compare plan limits](https://sentinely.app/pricing)

AWS support at launch · Guard is available on Agency and Scale

## What does Guard watch in AWS?

### AWS cost snapshots

Read Cost Explorer totals by service and region and project the current month from recent spend.

### Resource inventory

Scan enabled AWS services and regions and retain the resources found during each synchronization.

### Resource changes

Record added, removed, modified, and suspicious resources instead of showing only the latest state.

### Baseline anomalies

Surface spend spikes, new-region activity, resource bursts, and known mining-oriented instance types.

### Operational incidents

Open a Sentinely incident for high-severity or security-related anomalies so the team can investigate.

### Encrypted credentials

Encrypt AWS credentials at rest with an installation-specific key and never return them to the browser.

What Guard detects today

## Evidence for an investigation, not invented savings.

Guard shows the observed cost, recent baseline, affected services and regions, relevant resources, and a confidence score. Your team decides whether and how to remediate in AWS.

Spend increased beyond the selected sensitivity
A previously unseen region generated cost
Many resources appeared during one scan
A suspicious instance family was discovered

## Guard questions

### Which clouds does Guard support?

AWS only. Guard does not connect to Google Cloud or Azure.

### What access does Guard need?

Read-only access to AWS Cost Explorer and resource inventory. Setup shows the minimum read permissions to grant.

### Can Guard change or delete my AWS resources?

No. Guard only reads cost and inventory data. Your team decides whether and how to remediate in AWS.

### What does Guard detect?

Spend above your chosen sensitivity, cost from a previously unseen region, many resources appearing in one scan, and known mining-oriented instance types.

### How are AWS credentials stored?

Encrypted at rest with an installation-specific key. They are never returned to the browser.

### Which plans include Guard?

Agency includes 3 connected AWS accounts and Scale includes 10. Indie does not include Guard.

## Works with the rest of Sentinely

- [Agent PulseHeartbeat monitoring for cron jobs, workers and AI agents.](https://sentinely.app/agent-pulse)
- [PingWebsite, API, TCP and DNS uptime checks every minute.](https://sentinely.app/ping)
- [PulseLinux server metrics, services, ports and stale-agent alerts.](https://sentinely.app/pulse)
- [StatusA public status page for the monitors you choose.](https://sentinely.app/status)

Every product is included in one plan. [Compare Indie, Agency and Scale](https://sentinely.app/pricing)

## Connect one AWS account and establish a baseline.

Start with the minimum read permissions shown during setup. Review the first resource inventory and cost snapshot before enabling broader regional coverage.

[Start 14-day trial](https://sentinely.app/auth/sign-up)