Does CloudQuell ever modify my AWS resources?

No. The IAM role is read-only and there is no write path in the product. Recommendations are ranked and left to your team to act on.

Can I see the IAM policy before connecting?

Yes — the docs publish the exact trust policy and inline read-only policy the CloudFormation template creates, so your security team can review it before you grant anything.

Does read-only include my billing data?

Yes — that is the point. The role reads your billing exports (CUR / Cost Explorer) plus resource metadata for allocation, and nothing that can create, modify or delete a resource.

What about OpenAI, Anthropic and Snowflake?

Those connect with scoped API credentials / read access from the Integrations page, available on every tier.

Why aren't Finout, Amnic or Economize on the read-only list?

They are widely described as read-only connectors, but do not state the access level plainly on their own public pages — so we do not assert it for them. If you are evaluating one, ask for the IAM policy; any visibility vendor should hand it over immediately.

Access & security

Cloud cost tools that only need read-only access (and what read-only actually means).

If you are evaluating cloud cost tooling, "does it need write access?" is usually a security-review question, not a feature question. The short answer for the category: most visibility-focused cost platforms connect read-only.

The tools that need write access are the ones that act on your infrastructure — rightsizing, scheduling, commitment automation. Neither model is wrong; they do different jobs. Read-only is table stakes for a visibility tool, not a differentiator — so this page’s job is to answer the question honestly, competitors included.

Cloud cost tools that connect with read-only access, in each vendor's own words
Tool	Access model (vendor's own words)	Notes
CloudQuell	Scoped read-only cross-account IAM role	Visibility, allocation, anomalies, budgets; no write path exists. Policy published in the docs.
CloudZero	"All access is read-only" — read-only, cross-account (docs.cloudzero.com)	Cannot modify, delete or change resources, per their docs.
Vantage	"A set of read-only permissions to a variety of AWS services" (vantage.sh)	Public, auditable CloudFormation template; docs emphasize metadata-only collection.

Read-only tools, and the ones that need write access

CloudQuell

Best for Teams whose security review asks "does this need write access?" before granting a role.

Strengths

Connects with a scoped read-only cross-account IAM role and ingests AWS billing data daily; the published policy grants only read and billing permissions — no iam:* write, no ec2:Modify*/Terminate*, no *:*.
It never modifies workloads: savings show up as ranked recommendations for your team to act on, not changes made for you. OpenAI, Anthropic and Snowflake connect with scoped API credentials from the Integrations page.

Limitations

Read-only by design means it will not act on your infrastructure — automated rightsizing or commitment purchases are a write-access tool’s job.
AWS is generally available; Azure and GCP are in private beta (request access), not generally available.

CloudZero

Best for Teams that want read-only cost visibility and unit economics through a cross-account role.

Strengths

Its docs state "all access is read-only" — read-only, cross-account access that cannot modify, delete or change resources (docs.cloudzero.com, AWS Permissions and Security, verified Aug 12, 2026).

Limitations

We verify only the access level here; evaluate coverage and pricing separately with the vendor.

Vantage

Best for Teams that want an auditable, public read-only CloudFormation template before granting access.

Strengths

Uses "a set of read-only permissions to a variety of AWS services" (vantage.sh blog on cross-account IAM roles, verified Aug 12, 2026); the CloudFormation template is public and auditable, and the docs emphasize metadata-only collection.

Limitations

We verify only the access level here; evaluate coverage and pricing separately with the vendor.

Tools that need write access, on purpose (ProsperOps, nOps, CAST AI)

Best for Teams that want automation — commitment management, spot orchestration or Kubernetes optimization — where acting on infrastructure is the product.

Strengths

ProsperOps autonomously manages commitments — it executes purchases and exchanges for you, which read-only permissions cannot do.
nOps runs a separate automation line (Compute Copilot, commitment management) beyond its visibility tier; CAST AI acts on Kubernetes clusters directly.

Limitations

These are not read-only by nature — write access is required because acting on your infrastructure is the point.
A reasonable pattern at mid-size is a read-only visibility platform plus a narrowly-scoped automation tool when a specific saving justifies it.

Where CloudQuell fits

Read-only is not really a security feature — it is the natural consequence of not doing automation, and it is table stakes for visibility tools. What actually differs between read-only tools is everything else: what they ingest (CloudQuell puts AWS, OpenAI, Anthropic and Snowflake spend on one ledger), how allocation works, and what they cost. CloudQuell's pricing is a flat monthly fee — free under $10K/month, $99/mo under $50K, $199/mo to $200K.

A good fit when

Your security review needs a scoped, read-only IAM role and the exact policy published up front.
You want AWS billing plus OpenAI, Anthropic and Snowflake on one ledger, connected read-only.
You want savings as ranked recommendations your team acts on — not changes made for you.

Not the right tool when

You want the tool to act on your infrastructure — rightsizing, scheduling or commitment automation need write access by design.
You need Azure or GCP today — both are in private beta (request access), not generally available.
You are evaluating a vendor that will not show its IAM policy — ask for it before granting any role.

Frequently asked questions

Does CloudQuell ever modify my AWS resources?: No. The IAM role is read-only and there is no write path in the product. Recommendations are ranked and left to your team to act on.
Can I see the IAM policy before connecting?: Yes — the docs publish the exact trust policy and inline read-only policy the CloudFormation template creates, so your security team can review it before you grant anything.
Does read-only include my billing data?: Yes — that is the point. The role reads your billing exports (CUR / Cost Explorer) plus resource metadata for allocation, and nothing that can create, modify or delete a resource.
What about OpenAI, Anthropic and Snowflake?: Those connect with scoped API credentials / read access from the Integrations page, available on every tier.
Why aren't Finout, Amnic or Economize on the read-only list?: They are widely described as read-only connectors, but do not state the access level plainly on their own public pages — so we do not assert it for them. If you are evaluating one, ask for the IAM policy; any visibility vendor should hand it over immediately.

Start free with CloudQuell

Connects with a scoped read-only IAM role — the exact policy is published in the docs. Free under $10K/month of tracked spend.

Comparisons are based on publicly available information as of 2026-08-12 and pricing and features change — verify current details with each vendor before deciding. Product names and logos are trademarks of their respective owners; their use here is nominative and does not imply endorsement.