01 · email and method
02 · grant the read
03 · get the statement

How do you want to scan?

All three paths run the same 31 checks. The difference is how much access you give — and none of them asks for write permission.

Your email

We send nothing now. We confirm the address only when it is time to open the report.

Connect the AWS account most complete · ~2 min A read-only IAM role via CloudFormation, two clicks. We analyze every enabled region, and it is the only path that enables continuous monitoring. List · Read · Describe, no wildcards revoked by deleting the stack Run the CLI on your machine no access given · open source You run it with the credentials you already have and send only the results. Audit the code first if you like. One-off report, no continuous monitor. Upload a Cost Explorer CSV no IAM involved · partial coverage Only what the export contains. Without CloudWatch metrics, the idle and rightsizing rules do not run.