AWS Cloud Cost Optimization — Connect Your AWS Account to ZopNight
What does the AWS integration do?
ZopNight evaluates 173 AWS rules across 115 discovered resource types, from EC2 and RDS through SageMaker and Bedrock. 20 of those types can be stopped and restarted on a schedule. Every rule names its own metric, lookback window and abstain conditions, so a silent rule means insufficient evidence rather than a clean estate.
Coverage by category
ZopNight connects to your AWS account in minutes and gives you complete visibility into what you run and what it costs. Using keyless Workload Identity Federation (recommended) or IAM credentials, ZopNight discovers more than 100 AWS resource types (from EC2 and RDS to SageMaker and Bedrock), imports your billing data down to individual resources, and automatically shuts down non-production infrastructure when nobody is using it. Teams typically recover 30-60% of non-production spend in the first month.
OIDC federation, so no long-lived access keys
ZopNight runs on Google Cloud and federates into your AWS account through a Google OIDC identity provider using sts:AssumeRoleWithWebIdentity. No long-lived access keys ever leave your account. A one-click CloudFormation stack (ZopNightRole) creates the OIDC provider and an IAM role with the AWS-managed ReadOnlyAccess policy, plus an optional least-privilege write policy generated from ZopNight’s public permission catalog when you enable scheduling and remediation. ZopNight continuously verifies its own permissions with iam:SimulatePrincipalPolicy and shows you exactly which features are enabled by which grants. Discovery runs every six hours through AWS Resource Explorer plus 70 dedicated service APIs; CloudWatch metrics are collected hourly with a 90-day lookback; costs come from Cost Explorer and, for full resource-level history, your CUR 2.0 Data Export.
The CloudFormation stack and the Role ARN you paste back
- In ZopNight, choose Add Cloud Account and select AWS.
- Pick your access level: Read Only or Read and Write.
- Click the one-click CloudFormation link, which opens quick-create with the ZopNightRole stack pre-filled.
- Create the stack and paste the resulting Role ARN back into ZopNight.
- (Optional) Attach the EKS Cluster Policy access entry so ZopNight can manage EKS node groups.
- (Optional) Point ZopNight at your CUR 2.0 export (bucket, export name) for 365-day resource-level billing history. Alternative auth: IAM user static keys or temporary STS credentials.
What discovery reaches, and where the billing data comes from
Discovery of 100+ resource types across compute, containers, databases, storage, networking, ML/AI (SageMaker, Bedrock), and security. Resource-level billing via Cost Explorer and CUR 2.0 (365-day backfill). Hourly CloudWatch metrics, 90-day lookback. Off-hours scheduling for 20+ resource types with state-preserving stop/start. 173 recommendation rules: rightsizing, Graviton migration, idle detection, orphaned storage, S3 tiering, Reserved Instances and Savings Plans, Spot adoption. Auto-remediation with approval workflows. CloudTrail-based activity attribution. Anomaly detection with 7-day rolling baselines.
Limits worth knowing before you connect
EKS clusters running only Fargate (or hybrid) cannot be scheduled. ElastiCache has no native stop API, so it is discovered and costed but not scheduled. SageMaker endpoints are deliberately excluded from scheduling because stopping one requires deleting it. Resource-level Cost Explorer data is capped at 14 days by AWS — connect a CUR 2.0 export for full history.
AWS integration: common questions
Does ZopNight need write access to my AWS account?
No. The one-click CloudFormation stack creates a role carrying the AWS-managed ReadOnlyAccess policy, and that is enough for discovery, metrics and cost. The least-privilege write policy is generated only when you turn on scheduling and remediation, and declining it is the default rather than an exception.
Why does my resource-level cost history stop at 14 days?
AWS caps resource-level Cost Explorer data at 14 days. Point ZopNight at a CUR 2.0 Data Export (bucket and export name) and it backfills 365 days of resource-level billing instead.
Can ZopNight schedule an EKS cluster running on Fargate?
No. Stopping an EKS cluster works by scaling its node group Auto Scaling groups, so a cluster running only Fargate, or a hybrid of both, cannot be scheduled. Managed node groups are scheduled through eks:UpdateNodegroupConfig.
Recommendations
173 live rule families evaluate AWS spend. Each page documents the metric, threshold, window, and the IAM actions the check needs.
Scheduling
20 AWS resource types can be stopped and started on a schedule.