Setting up CostWarden

This is the only step with any real work in it. You create a read-only IAM role in your own AWS account and paste its ARN. CostWarden never asks for an access key.

Go to Settings → Cloud connection and press Start connecting. That generates an external ID unique to your organization and reveals the walkthrough. Then, in AWS:

1. Open IAM → Roles → Create role and choose Custom trust policy as the trusted entity type.
2. Paste the trust policy shown in Settings. It names our AWS account and requires your external ID. Copy it with the button rather than retyping — the external ID must match exactly.
3. Add permissions. Choose Create inline policy (not Use existing policy), open the JSON tab, and paste the permissions policy from Settings. Name it CostWardenReadOnlyAccess — that name is cosmetic. AWS should summarise it as three services: Cost Explorer (Read), Compute Optimizer (List) and EC2 (List).
4. Name the role CostWardenReadOnly — this one is not cosmetic. Our permission to assume it is scoped to that exact name, so a misspelling fails later with an opaque AccessDenied.
5. Copy the role's ARN from its summary page, paste it back into Settings, and press Verify & connect.

Here are both documents, so you can read them now. Settings renders these same two filled in — this account id and this external ID are placeholders, because you do not have an organization yet. Copy from Settings when you get there rather than from here.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<COSTWARDEN_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "compute-optimizer:GetEC2InstanceRecommendations",
        "compute-optimizer:GetEBSVolumeRecommendations",
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes"
      ],
      "Resource": "*"
    }
  ]
}

What you should see: the save performs a real assume-role against your trust policy before storing anything, so a green “Connected” means it genuinely works — not that we wrote down a string. If it fails, the error tells you which of the two likely causes it is.

Until you connect one, alerts have nowhere to go — the product still detects, but you'd have to open the dashboard to find out, which is the thing it exists to avoid. Go to Alerts and pick a type; the instructions change to match.

Slack

Create an app from scratch, turn on Incoming Webhooks, add one to the channel alerts should land in, and paste the URL.

Microsoft Teams

In the channel, ⋯ → Workflows → the template “Post to a channel when a webhook request is received”. Teams retired the old Office 365 connectors, so Workflows is the current way in; a legacy connector URL still works if you already have one.

Google Chat

Open the space, click its name → Apps & integrations → Webhooks → Add webhooks. Only works in spaces, not direct messages.

PagerDuty

On the service that should be paged: Integrations → Add integration → Events API V2, then copy the Integration Key.

We deliver a test message before saving for the three webhook types, so a wrong URL fails there rather than silently swallowing your first real alert. PagerDuty is the exception: its only message is a triggered incident, and testing a form field shouldn't page whoever is on call. Its key is checked by shape instead.

Connect as many as you like — every enabled channel receives every alert. Pausing a channel keeps it connected and sends nothing.

Your 14-day trial starts when your AWS connection first works — not when you sign up. Waiting on someone to approve an IAM role shouldn't eat your evaluation, and no card is needed to start. Owners see the days remaining in Settings → Billing.

When it ends without a subscription, we stop collecting new data — and that is all. The daily scan skips your organization and no new alerts go out, but everything already synced stays exactly where it is and stays readable, with a banner saying why it stopped moving. Nothing is deleted. Subscribing picks it back up on the next run.

A failed payment keeps working for seven days while the card is retried, so an expired card doesn't cost you a week of alerts. If you cancel, access runs to the end of the period you already paid for. Checkout and invoicing are handled by Lemon Squeezy as Merchant of Record — card details never reach CostWarden.