Your AI spend is three bills and nobody's job.
AWS invoices you. OpenAI invoices you. Anthropic invoices you. Nobody owns the number, because you don't have an ML engineer and your platform team is busy. I audit the infrastructure behind your AI features and hand you a priced list of what to change.
A bill, read line by line.
This is one month from the reference environment in the public repo — a deliberately misconfigured AI stack on AWS. The findings are the ones I look for in a real account.
- Bedrock · InvokeModel · claude-sonnet$4,210.88
Same 3.1k-token system prompt resent on every call. No prompt caching, no batch inference.
- Bedrock · InvokeModel · claude-opus$1,930.40
Ticket classification — a two-label task — running on the most expensive model available.
- SageMaker · ml.g5.2xlarge endpoint$1,684.32
Endpoint up 24/7. Invoked roughly 90 minutes a day. No autoscaling to zero.
- OpenAI · org key, billed to a card$2,145.00
Off-account. Invisible in Cost Explorer, outside IAM, attributed to no team or feature.
- Anthropic · second key, billed to a card$880.00
Same problem, second vendor. Nobody can answer "what does this feature cost per user?"
- CloudWatch Logs · ingestion + retention$612.19
Full prompts and completions written to logs, kept 90 days. A cost line and a privacy line.
- Lambda · inference orchestration$248.77
Execution role carries
bedrock:*on*. Any model, any region, no ceiling.
What I go through.
- Model choice against the actual task — where a cheaper model produces the same output
- Prompt caching, batch inference, and context that gets resent on every call
bedrock:*and wildcard IAM on inference roles — the ceiling that isn't there- SageMaker endpoints and provisioned throughput running while idle
- Provider keys billed outside AWS, so the spend never reaches your cost reports
- Cost attribution — tags that let you answer "which feature, which customer, how much"
- CloudWatch ingestion and retention on prompt and completion logs
- Vector store, embedding pipelines, and the re-embedding you're paying for twice
What lands in your inbox.
A written report, 12 to 20 pages, plus a 45-minute call to go through it. For every finding, four things:
- What it costs you now — the monthly figure, pulled from your own billing data
- The exact change — config, model ID, IAM policy, or a Terraform diff you can open as a PR
- What it saves — estimated monthly and annual, with the assumption stated
- What it risks — latency, quality, blast radius, so you can decide what not to do
Findings are ordered by saving-per-hour-of-work, not by size. The first three are usually done in an afternoon.
How access works.
You create a read-only role
I send you the IAM policy as JSON — it's in the public repo, you can read every line before applying it. Billing, configuration, and CloudWatch metrics. No write permissions of any kind.
I audit, five working days
I read cost and usage data, model invocation metrics, IAM, and infrastructure config. I don't read prompt content, customer data, or application databases. Nothing is copied out of your account.
Report, call, and you revoke the role
You get the report, we spend 45 minutes on it, and you delete the role. If you want the fixes implemented rather than documented, that's a separate conversation.
Who you're giving access to
I'm Foad Talsi. I work independently from Paris on AWS infrastructure and Terraform.
I'd rather you judged the work than the CV. The reference environment is public: the same checks, the same report format, and the exact IAM policy I'd ask you to create. Read it before you decide anything — if it doesn't look like it would find something in your account, don't reply.
The role is read-only. Nothing is written to your account, no customer data or prompt content is read, nothing is copied out. You revoke it when the report lands.
€1,200One fixed price. Not a percentage of what you save, so there's no incentive for me to inflate an estimate. Invoiced on delivery of the report.
Read the method before you buy it.
The reference environment above is public: a full AI stack on AWS, built wrong on purpose, with the complete audit report next to it. Same format, same checks, same IAM policy you'd be asked to create. If it doesn't look like it would find anything in your account, don't reply.