Apoc watches your AWS spend and talks to you in Slack. Quiet when all is well, clear when it isn't.
You create the IAM role. You can revoke it at any moment.
Most days, nothing about your bill deserves your attention. Apoc says so, once, and then leaves you alone.
No message when nothing is notable. No alert you've already seen. The silence is the product.
the whole message. that's it.
Setup takes about ten minutes, and the only thing deployed is an IAM role. From day one, your spend is monitored.
One Terraform apply in your own AWS account: a cross-account role with read permissions only. You can delete it whenever you like.
From your account page, in one click. Pick the channel with /apoc channel #aws-costs and the time with /apoc daily 08:00 Europe/Prague.
Apoc posts your numbers (this month, AWS's forecast, last month, by service and by tag) and a starting limit on the whole bill. /apoc limit service ec2 6000 adds a limit on a service. After that: one line a day.
Every capability is a message in a thread. Nothing to open, nothing to learn.
One line a day, at the time you pick. Green means nothing to do. Red names what is over and by how much.
A limit on the whole bill, on any service or on any tag value, as an amount or as +15% over last month. Checked every day against AWS's own forecast, not a projection of ours.
One card per breach. The investigation follows in its thread: what grew, where it lives, whether it looks intended. The card closes itself when the forecast comes back.
NAT gateway hours (5 gateways) $100 NAT data processed (5.2 TB) $270 Interface endpoints (7) $82 Site-to-site VPN (1 connection) $28 VPC total $480
Plain language in, plain language out. A general answer first, then your own numbers.
eu-west-1 9 TB ~$180/mo us-east-1 7 TB ~$140/mo ap-southeast-1 5 TB ~$100/mo sa-east-1 3 TB ~$60/mo
It finds the cost, names the cause and describes the fix with its estimated saving. Your team makes the change.
And more: /apoc spend for the whole picture, coverage rules so untagged spend can't hide, a memory for what you tell it, and a note when the month closes. Ask it anything in a thread.
Apoc reads. That's the entire surface area. The boundary is your own AWS account, drawn by you.
A cross-account IAM role with read permissions only. Cost Explorer and the read-only inventory it needs to explain a number. Nothing else, and no CloudTrail: it describes what changed, never guesses who did it.
There is no code path that mutates your account, so there is nothing to misconfigure and nothing to trust us about.
It describes the change and the estimated savings. Your team makes it. Ask it to act and it declines.
You created the role, so you can delete it. Access ends the instant you do, without asking us.
We are a small team of AI and DevOps engineers based in Prague. We have spent more than a decade running AWS infrastructure, and reading the bills it produces, so we know exactly how spend drifts when nobody is watching.
Apoc is how we'd want that watching done: carefully, quietly, and without ever touching your account. When you write to us, you talk to the people who wrote the code.
Tell us a little about your AWS setup and we'll take it from there. No demo booking, no sales call, just a real reply from the team.
Thanks, we've got it. Expect a reply from a person, not a sequence.