Skip to content
CloudFixTrust Centercloudfix.com
Menu

RightSpend

Commitment-free EC2 optimization, and exactly what it can touch.

RightSpend raises the Effective Savings Rate of your EC2 compute by managing Convertible Reserved Instances hourly. It reads across your Organization and writes only to Reserved Instances, only in accounts you designate.

See the permissionsArchitecture diagram

How RightSpend works

3-year Savings Plan rates, without the commitment.

RightSpend dynamically optimizes Convertible Reserved Instances (cRIs) to reach discounts equivalent to 3-year all-upfront Compute Savings Plans, without the commitment or the upfront cash.

  • Read-only monitoring

    Continuously monitors EC2 usage, Savings Plans and Reserved Instances across every account in your AWS Organization.

  • Dynamic cRI optimization

    Purchases, modifies and exchanges Convertible Reserved Instances hourly to match actual compute usage. No forecasting required.

  • Zero commitment

    If your usage falls, commitments scale down with it. No overcommitment risk, no unused reservations, no upfront payment.

What RightSpend does not do. It never has write access to EC2 instances or any AWS resource other than Reserved Instances and Convertible Reserved Instances in designated cRI accounts. It does not move accounts between organizations, buy or sell RIs on the marketplace, or require changes to your existing Savings Plans.

IAM permissions

Three roles, each deployed only where it is needed.

Each follows least privilege. For how they fit together, see the RightSpend architecture diagram and the hourly optimisation loop.

  • Role 1 · Every member account in your Organization

    CloudFix-RightSpend-ReadOnly-Role

    • ec2:DescribeInstancespoint-in-time running instance count
    • ec2:DescribeCapacityReservations / ec2:GetCapacityReservationUsage
    • ec2:DescribeHostsdedicated host monitoring
    • ec2:DescribeReservedInstancesexisting RI inventory
    • ec2:DescribeRegions
    • savingsplans:DescribeSavingsPlans

    Describe and List actions only. No write access to any resource.

  • Role 2 · Your AWS management (payer) account only

    CloudFix-RightSpend-ReadOnly-Master-Role

    • organizations:ListAccounts / organizations:ListRootsenumerate the Organization’s accounts
    • ce:GetCostAndUsageaggregate billing data
    • ce:GetReservationCoverage / ce:GetReservationUtilization
    • ce:GetSavingsPlansCoverage / ce:GetSavingsPlansUtilization
    • ce:GetSavingsPlansPurchaseRecommendation
    • cloudformation:CreateStackInstances / cloudformation:ListStackSetOperationsauto-deploy the ReadOnly role to member accounts, limited to CloudFix-RightSpend stacks

  • Role 3 · Only the designated account(s) that hold Convertible Reserved Instances

    CloudFix-RightSpend-Write-Role

    • ec2:DescribeReservedInstances
    • ec2:AcceptReservedInstancesExchangeQuote
    • ec2:GetReservedInstancesExchangeQuote
    • ec2:PurchaseReservedInstancesOffering
    • ec2:ModifyReservedInstances
    • ec2:DescribeReservedInstancesOfferings
    • ec2:DescribeReservedInstancesModifications
    • ec2:DescribeReservedInstancesListings
    • organizations:DescribeOrganization

    Limited to cRI operations. It cannot touch EC2 instances, S3 buckets, VPCs, databases or any other resource: it can only purchase, modify and exchange Convertible Reserved Instances.

CloudFormation templates

Review the templates before deployment.

Every role is deployed by CloudFormation. Ask us for the full template URLs for your onboarding.

TemplateDeploys toLocation
ReadOnly MasterManagement accounts3.amazonaws.com/.../ReadOnly-Master.yaml
ReadOnly MemberAll member accountss3.amazonaws.com/.../ReadOnly.yaml
Write rolecRI accounts onlys3.amazonaws.com/.../Write.yaml
Master (no auto-deploy)Management accounts3.amazonaws.com/.../ReadOnly-Master-NoCreateInstances.yaml

Onboarding

Four steps to live optimization.

  1. Enable hourly granularity

    In your management account, enable hourly Cost Explorer data under Billing and Cost Management, Cost Management Preferences.

  2. Install read permissions

    Deploy the ReadOnly Master stack in your management account. It deploys the ReadOnly role to every member account through StackSets.

  3. Invite the cRI account

    Invite the RightSpend cRI account from your management account. CloudFix accepts the invitation and deploys the Write role.

  4. Dry run (optional)

    Preview the commitment allocation the algorithm produces before you activate live optimization.

Account transfer

When you take over your own cRI accounts.

  1. You send an invitation

    From your management account, to the cRI account being transferred.

  2. CloudFix completes it

    Accepts the invitation, checks tax settings (removing a TRN not inherited from the payer) and deploys the RightSpend Write role.

  3. You update the root email (optional)

    See the AWS guide to changing a member account email.

Billing and impact

You pay from the savings, through AWS.

  • AWS Marketplace

    RightSpend is a SaaS subscription in AWS Marketplace. You subscribe through AWS and charges appear on your AWS bill. EDP-eligible.

  • Share of net new savings

    If RightSpend doesn't save you money, you don't pay. Typical subscription rates are 18–25% of realized savings.

  • Negligible API impact

    RightSpend calls ec2.DescribeInstances about once an hour per account. Against the 10 requests per second limit that is 0.0028% of the rate limit.

Questions about RightSpend security or onboarding?

Ask the team, or read the RightSpend documentation on the support portal.

Contact usSupport docs