Data Collection

Billing Data

AWS stores billing data through Cost and Usage Reports (CUR) in the Organization's management account. The Cloudsaver application creates an S3 bucket named "cloudsaver-xxxxxxxxxxxx-billing-files" (where x's represent the management account ID) to store this data. Access to this bucket is restricted by permission policies.

The application implements a 90-day lifecycle policy on the S3 bucket to balance data retention needs with cost management. Cloudsaver configures the CUR to deliver billing files twice daily — morning and evening.

Tag Data

The Cloudsaver app retrieves environmental and operational data via AWS standard APIs. The associated permission policies enable the application to read resource tags and create, list, or delete tags when clients take action within the app.

The policies also permit read, list, and describe actions for specific resources like EC2 instances and RDS databases, allowing the application to enhance tag data with commonly needed information such as subnet IDs.

Tag Policy Data

Cloudsaver facilitates more efficient tag policy management across AWS Organizations. These policies standardize tags and enforce key casing or validate values during tag creation across member accounts.

The permission policies allow the application to read existing tag policies and create or modify them when clients initiate such actions through the application interface.

Resource and Log Data

The application uses Amazon EventBridge to capture real-time resource data changes. EventBridge notifies Cloudsaver via API whenever relevant resource data changes occur, enabling real-time synchronization between the client's AWS environment and the application's resource visibility.

As a baseline, the application performs daily resource data intake from AWS, comparing EventBridge events against this data to reflect changes as they happen.

For security inquiries or to request a copy of our SOC 2 Type II report, contact us at security@cloudsaver.com.