For SaaS and AI Scaleups¶
Cloud governance for companies growing faster than their cloud discipline.
Who This Is For¶
Companies that have outgrown the phase where nobody had to ask. The cloud bill is no longer small enough to ignore, and nobody knows everything that is running. There is rarely a dedicated FinOps function and never a spare platform team, so anything that depends on someone watching a dashboard stops happening within a month.
Teams usually arrive here after something specific:
| Trigger | What it looks like |
|---|---|
| The AI bill arrived | A model endpoint or GPU fleet cost far more than assumed, and the invoice is the first place it appeared, with no owner |
| A customer asked for the audit | SOC 2, ISO 27001, HIPAA or PCI DSS, wanted this quarter, by a team that has never produced the evidence |
| A second cloud arrived | An acquisition brought another provider: two consoles, two permission models, two cost pictures |
| Consolidation | Several point tools with separate bills and integrations, and a mandate to reduce them |
| Non-production is large | Development and test environments outnumber production, and switching them off has never been anyone's job |
What RosettaHub Does¶
Cost, compliance, accounts, permissions, AI spend and self-service run through the same platform. That is why a budget can act on an account and a permission can act on a budget.
| Capability | What it does | Details |
|---|---|---|
| The budget blocks the account | Cost is evaluated in real time from resource monitoring. When an account reaches its budget, new activity is blocked, AI included | Cost Management |
| AI spend counted live | Bedrock usage is metered and added to the account's live cost, within five minutes. AI access is cut within 15 minutes of the budget being reached. Which models a role may call is a permission | AI Usage Tracking |
| Waste switches itself off | Idle and orphaned resources are detected continuously. On Automate, idle instances can be stopped automatically | Resource Management |
| Compliance runs continuously | Continuous compliance against ten standards, implemented with Cloud Custodian, with findings tied to the standard they belong to | Compliance |
| One model across clouds | The same budgets, quotas, roles and compliance policies across AWS, Azure, Google Cloud and Alibaba Cloud | RosettaOps |
| Cost by account, not by tag | Allocation follows the account, so it holds whether or not anyone tagged anything | Cost Allocation |
Compliance coverage
Coverage is not yet complete for every one of the ten standards. Check the controls a standard covers before relying on it for an audit.
Engineers Have to Want It Too¶
Governance imposed over the heads of the people it lands on gets worked around. What engineers get back is the thing they usually wait for:
- Environments without a ticket. Machines, notebooks, clusters and stacks launched by the person who needs one, through RosettaCloud.
- Their own tools. Single sign-on and direct federated access to the AWS console and CLI through IAM roles.
- Budgets they can see. Spend is visible while the work happens. Running low is a budget transfer a manager can make in a minute.
- Restrict nothing, if you prefer. Narrowing which services and regions a team can reach is a separate setting from enforcing the budget. Leave the catalog open and the spending limit still holds.
Start Read-Only¶
Observe grants RosettaHub no administrative access. It covers live cost estimates, allocation, savings recommendations and compliance scanning. Your cost and usage data is written to your own account and queried there.
Enforcement and remediation are separate grants, chosen per account. An account without the blocking and stopping scopes is monitored and alerted on, never stopped, which suits production. Nobody has to decide everything on the first call.
Getting Started¶
- Read RosettaOps Editions: Observe, Govern, Automate, and Build (Automate plus RosettaCloud).
- Follow Onboarding to connect your management account.
- Set a budget on one development account and watch it hold.
For pricing, see rosettahub.com/site/pricing.
Related¶
- Account Access and Scopes: what each grant allows
- The Landing Zone
- For FinOps Teams
- For Security Teams
- For Platform Engineering