Simulation Mode
Run any policy as a dry-run: Cumulus computes the whole decision and records what would happen, without executing. For a whole account or a single resource.
AWS cost governance
PortuguêsAWS cost governance with enforcement in minutes, not hours
Cumulus reads usage metrics from your AWS accounts every ~1 minute via CloudWatch, estimates the cost and climbs a graduated enforcement ladder — from alert to stop — with simulation, an explanation for every decision and an audit trail. Tools that depend on the billing report (CUR) take hours to notice the same spend.
Born governing real AWS accounts in production — student accounts at a college and team accounts in the cloud — with real money at stake. Not a prototype.
- Data stays in your AWS account
- Multilingual, with native PT-BR
- Audit trail for every decision
Account sandbox-dev-07
Policy dev-sandboxMonth-to-date estimateof USD 50.00
USD 39.2078%
Enforcement ladderT3 Throttle active
- T0
- T1
- T2
- T3
- T4
Decision timeline
- Usage detected: 3 t3.large instances started
- Estimate updated: +USD 0.25/h, 78% of budget
- T3 Throttle applied: creation of new expensive resources blocked
- Record sealed in the audit trail (actor: policy dev-sandbox)
Simulation Mode: off for this policypt-BR · en
How it works
Three steps, starting read-only
You don't hand over the power to act on day one. First you watch what Cumulus would do; then you enable the ladder one rung at a time.
01. Connect
A cross-account role in your account gives Cumulus read access to CloudWatch metrics. In Edu, student accounts are created through AWS Organizations in a dedicated OU with protective SCPs.
02. Watch in Simulation Mode
Cumulus computes every full decision — tier, action, targets — and records what would happen, without executing. You see the explanation for each one before giving it the power to act.
03. Enable the ladder per account, tag or environment
Choose how high each environment may climb: prod stays at observe/alert, dev may reach throttle, sandbox may reach stop. Actions never skip rungs.
Enforcement
A graduated ladder, not a kill switch
Five rungs, from no-action to stop. Each account's ceiling is configurable, and the effective action is always the lesser of what the tier asks for and what the mode allows.
- T0
Observe
Visibility and cost estimate. Zero action.
default in prod
- T1
Alert
Notifies the owner when the threshold is crossed.
default in prod
- T2
Require-approval
New spend above the limit needs approval before it proceeds.
suggested in staging
- T3
Throttle
Selectively blocks the creation of expensive resources.
suggested in dev
- T4
Stop
Stops non-prod resources and applies DenyAll.
sandbox, explicit opt-in
effective action = min(requested tier, mode ceiling)
Never-stop-prod
An account or resource tagged prod never receives an automatic throttle or stop: the action is downgraded to require-approval.
Break-glass
A global operator switch that suspends all enforcement. No per-resource override can turn it back on.
Opt-in per tier
Every rung above Alert is enabled explicitly by you, per account, tag or environment.
Signal latency
Hours versus ~1 minute — and why it changes what you can do
Governance that reacts to the bill arrives after the spend. Cumulus reacts to usage.
Bill-based tools
hours- The AWS Cost and Usage Report (CUR) is updated up to three times a day.
- The first report can take up to 24 hours to appear.
- By the time the spend shows up, the resources have been running for hours.
Cumulus
~1 min- Collects usage metrics from CloudWatch (instances, invocations, GB) every ~1 minute.
- Multiplies usage by the price catalog and estimates the cost on the spot.
- The enforcement ladder can act minutes after usage starts.
Trust
For a tool that can stop resources, trust is the product
Every decision can be simulated, explained and audited — and raw data never leaves your account.
An explanation for every decision
Every action ships with its why: which metric crossed which threshold, which tier resulted and which guardrail applied. Rendered in 12 languages.
Audit trail with identity
Each record keeps who configured, who or what triggered and what was decided, hash-chained. Removing or editing a record mid-chain becomes evident — not even the actor can erase their own trace.
Data stays in your account
In the FinOps edition, collection and enforcement run inside your AWS account. Only aggregated metrics reach Outrun's control plane.
Two editions, one core
Built for those who govern student accounts and for those who govern production accounts
Same detection, estimation and enforcement engine. Different stakeholders and defaults.
Cumulus Edu
Universities and bootcamps
For course coordinators, faculty and institutional IT
Each student gets their own AWS account, with a budget set by the institution and hard enforcement in the sandbox. Students learn cloud with the cost trail visible; the college is never surprised by the bill.
- One account per student via AWS Organizations, in a dedicated OU with SCPs
- Budget per student and per class, with faculty and coordinator views
- Hard enforcement in the sandbox: a student cannot take the institution down
- Multilingual, aligned with the AWS Console, with native PT-BR — not machine-translated
- Proven in real production, governing student accounts across a full semester
Cumulus FinOps · early access
Companies with existing AWS accounts
For platform, FinOps and security teams
Governance over the accounts you already have, with enforcement tiers per account, tag or environment, production guardrails and an audit trail. The data plane runs in your account.
- T0–T4 tiers configurable per account, tag or environment
- Never-stop-prod, break-glass and explicit opt-in per tier
- Simulation Mode as the recommended onboarding default
- Collection and enforcement in your account; only aggregates leave
- Simulation Mode: rehearse the policy before any block
FAQ
The objections we hear first
What IAM permissions does Cumulus need in my account?
To observe, a cross-account role with read access to CloudWatch metrics. You start in Observe or Simulation Mode with no action permissions at all. Enforcement permissions come in only for the tiers you explicitly enable, per account, tag or environment.
Why not just use AWS Budgets with a Lambda?
Because AWS Budgets triggers on billed cost, which AWS closes hours later — by the time the alert arrives, the spend already happened. Cumulus reads CloudWatch usage metrics every ~1 minute and acts on usage, not on the bill. Building this with Budgets and a Lambda is possible, and it is exactly what we did before it became a product: the time sink is not the trigger, it is the graduated ladder, the rollback, Simulation Mode, the audit trail, and the care not to take down an institution over a false positive.
What if Cumulus stops production?
It doesn't. An account or resource tagged prod never receives an automatic throttle or stop: the action is downgraded to require-approval. There is a global break-glass that suspends all enforcement and that no per-resource override can turn back on. And the effective action is always the lesser of what the tier asks for and the ceiling configured for that environment.
How does Cumulus connect to my accounts?
In Edu, student accounts are created through AWS Organizations in a dedicated OU with protective SCPs, and Cumulus governs them from the institution's account. In FinOps, the data plane (collection and enforcement) is deployed into your account and only aggregated metrics reach the control plane. Onboarding details are agreed with you during early access.
How do I get started?
Access is direct with Outrun. Start with a demo on a scenario close to yours; deployment happens in your own AWS account.
Which languages?
Cumulus is multilingual: the message engine is aligned with the AWS Console's twelve locales, and coverage includes the explanation for each enforcement decision, not just the interface. Brazilian Portuguese and English are available today, with native PT-BR — not machine-translated. The remaining languages ship through that same path, as demand calls for them.
How much does it cost?
On request, as early access. Edu and FinOps are priced separately. Talk to us and get a proposal for your scenario.
Watch Cumulus decide, with the explanation right beside it
A 30-minute demo with the real panel, in Simulation Mode, on a scenario close to yours.
Cumulus is an Outrun Data Solutions product. AWS and CloudWatch are trademarks of Amazon Web Services, Inc.