Skip to content

For Managed Service Providers

One platform for every customer you manage, each one isolated from the others.

Who This Is For

Managed service providers rarely lose money on cloud. They lose it in the gap between a customer signing and a customer being governed. The same jobs repeat on every customer, and done by hand they scale with the customer count rather than with the value of the work:

Job Done by hand
Onboarding a customer Landing zone, accounts, roles, budgets and billing export, rebuilt for each customer
Answering "what did this cost" A monthly reconciliation across accounts and tag schemes that do not agree
Guardrails per customer Permissions, service and region limits and spending caps, written once per customer
Chasing idle resources Someone reads a report, someone else chases the owner
Assessment preparation Evidence gathered when somebody asks, for controls that were supposed to be continuous

Many Customers, One Platform

In RosettaHub each customer is its own organization, with nested sub-organizations, its own budgets, roles and compliance baseline. Administration is delegated: a role held on an organization applies to all its sub-organizations, so a customer's own administrators can manage their part without seeing anyone else's.

A user can belong to several unrelated organizations at once, each with its own role. One engineer signs in once and works across every customer they are assigned to, and no customer can see another.

Capability What it gives an MSP Details
No login per customer Single sign-on, then federated, time-limited sessions into each customer's AWS console and CLI through IAM roles. No long-lived keys to store or rotate Account Access and Scopes
Share without an IAM ticket Templates, images, policy sets and storage shared across accounts. The platform issues credentials on share and revokes them on unshare Sharing, Native Resource Sharing
Build the catalog once A portfolio of environments becomes a private service catalog you publish to each customer Portfolios

A Customer Is Governed From the First Day

Onboarding a customer is one deployment on their management account. It creates the organization structure, the functional accounts and the billing data export. Accounts the customer already runs are brought in with one more. After that, new accounts come off a vending machine with the landing zone, roles, budgets, quotas and federated console access already attached.

Cost Per Customer, Without Tagging

Attribution follows the account rather than a tag someone has to maintain, and each run reconciles back to the bill. Cost data is written in the FOCUS format to the customer's own account. See Cost Allocation and Chargeback.

  • The budget blocks the account. Cost is evaluated in real time. When an account reaches its budget, new activity is blocked, AI included. On Automate, running services are also stopped, with instance volumes kept and storage untouched.
  • Headroom is a transfer. Budgets are delegated down the hierarchy, so giving a customer more room is a budget transfer rather than a policy change.
  • Production is never stopped by accident. An account without the blocking and stopping scopes is monitored and alerted on, never stopped.

Compliance Already Running

Continuous compliance against ten standards, implemented with Cloud Custodian, including SOC 2, HIPAA, ISO 27001, PCI DSS, NIST SP 800-53 and GDPR. Coverage is not yet complete for every standard. Every account you provision carries the policy set from its first minute. See Compliance.

For the AWS MSP Program validation checklist, ask us for the mapping of the controls a platform can evidence.

Your Customer's Security Review

  • Observe needs no administrative access. It still covers cost, allocation and compliance scanning.
  • Their data stays theirs. Cost and usage data is written to and queried in their own account.
  • Nothing installed. No agent on a host and nothing in the network path.
  • Granted per account. Enforcement and remediation are separate grants, and removing the stack withdraws them.
  • External IDs on cross-account access. The outer role assumption is protected by an external ID unique to each organization.

RosettaHub is a multi-tenant SaaS platform run by RosettaHub, governing accounts in any Region. A dedicated platform is available. The same policies apply across AWS, Azure, Google Cloud and Alibaba Cloud, so a customer on a second cloud is not a second practice.

Getting Started

  1. Read RosettaOps Editions: Observe, Govern, Automate, and Build.
  2. Follow Onboarding for your first customer organization.
  3. Talk to us about partnering. For pricing, see rosettahub.com/site/pricing.