● Read-only · your data stays in your account

See what AWS charges to process your own packets

Isolate the per-GB data-processing charges on NAT Gateway, Network Firewall, Transit Gateway plus Site-to-Site VPN connection fees -- the recurring tax Cloud Spectra replaces with a flat EC2 fee -- and see your savings by region and month.

⚠Honest scope: this counts the per-GB -Bytes data-processing on NAT/Firewall/Transit GW plus Site-to-Site VPN connection-hours -- all charges Cloud Spectra's gateway replaces. It does not count data-transfer/egress, which Cloud Spectra does not eliminate -- so the number is defensible on your own bill. We use your actual billed cost (Cost Explorer UnblendedCost), not an estimate, so it stays correct as AWS changes prices.
⚛Works for a single account or a whole AWS Organization. Run it in a standalone account and you see that account. Run the same one role in your Organizations management (payer) account and Cost Explorer returns every member account -- broken out per account below -- because the payer account sees consolidated billing for the org. Credentials scoped to a single member account simply show that one account. Nothing to wire per-account; no StackSets.
Static (CloudShell)
Live connect
Demo
Period sets how much history to pull; granularity buckets the view. Cost Explorer provides ~14 months by default -- longer ranges return what your account retains.
1

Grant read-only access (one role, you revoke anytime)

Deploy a CloudFormation role that lets Cloud Spectra read only your Cost Explorer data via a scoped cross-account role with an ExternalId. We never receive your credentials, and every call shows in your CloudTrail. Copy the template or use the quick-create link, then paste the Role ARN below.

Whole org in one role: deploy this in your AWS Organizations management (payer) account and the scan covers every member account (broken out per account in the results). Deploy in a standalone or single member account and it covers just that account. Same template either way -- no extra permissions, no StackSets.

Deploy role (CloudFormation)
2

Connect

Date range comes from the Time period selector above.
Calls /api/scan (a Cloudflare Worker that assumes your role server-side -- no CORS, no credentials shared). Endpoint not deployed yet? Use the Static tab or Demo.
1

Read-only IAM policy (optional -- CloudShell already runs as you)

If you want a dedicated scoped identity, attach this policy. Otherwise just run the scan in CloudShell under your console login.

2

Run this in AWS CloudShell

Open AWS CloudShell (aws-cli + jq are preinstalled). It runs entirely in your account; nothing is sent to Cloud Spectra. Run it in your Organizations management (payer) account to capture every member account in one pass -- it groups cost by linked account automatically. In a standalone or single member account it just returns that account (assuming the management account has not restricted member access to Cost Explorer).

3

Paste the result

★

See it with sample data

Sample data loads automatically below -- a representative multi-account, multi-region dataset so you can see exactly what the scan produces before connecting anything.

Select allClear
Monthly networking data-processing Cloud Spectra eliminates
$0

Data-processing spend by month

Actual billed cost of the per-GB processing line items, stacked by service.

What Cloud Spectra replaces

Your current data-processing bill vs one flat EC2 gateway fee (latest full month).
AWS data processing
$0
per month, this scope
→
Cloud Spectra
$0
flat EC2 fee, zero per-GB
Net savings $0/mo · 0% · $0/yr

Coverage: shipping now vs coming

v1 eliminates these data-processing charges today. v2+ extends the same flat-fee model to more line items.

Eliminated today (v1)

    Addressable next (v2+)

      Line items counted (full transparency)
      Usage typeServiceAccountRegionMonthGBCostCounted

      That's $0/yr in data-processing tax

      Replace it with one flat-fee gateway. Deploy in 10 minutes from AWS Marketplace.

      View pricing