01 · Report & Measure
CostChatCloud Efficiency Metrics
02 · Alert & Govern
BlueArch CLITag ManagerAWS StewardInfraGPT™Governance HubClaude Governance
03 · Discount & Protect
EDP / PPA Insurance
Explore
CapabilitiesToolkitJournalAbout
Account
Sign inSign up →
FinOps · BPaaS · AWS Control PlaneAWS Advanced Tier Partner

Every AWS
decision,
maximum ROI.

BlueArch measures and maximizes the return on every AWS decision. Executives see infrastructure as a business asset — cost as a share of revenue, forecast to within ±5%, ready for the board. Architects see the cost, latency, and risk of every design before it ships — and the spend one engineer can confidently run grows 2–4×.

For solution architects·Self-hosted in your VPC·SOC 2 · AWS Advanced Tier
Resource graph · prod-account · liveDrift detected
AWS spend / mo
$128.4k
Value per infra $
0.9×
Open findings
14
Companies we've worked with
6.2% of ARR
Avg. AWS spend on BlueArch · industry runs ~13%
2.4 ×
Infra-spend managed per engineer (vs. baseline 1×)
12 min
Architecture due diligence · was 3 weeks
96.4%
Forecast accuracy · 30-day spend, ±5%
Two audiences · One data model · Your VPC

Built for the way cloud teams actually work.

A chat-and-report surface for the people who pay the bill. A first-class CLI and agent for the people who write the infrastructure. Both run in your VPC on one shared data model — pick your side of the bill.

Check out the toolkit
01 · Report & Measure

CostChat Web app

Ask your AWS bill a question in plain English. Open the chart in the explorer, pin it to a dashboard, share the snapshot.

EC2 by team, Aug vs Jul — flag anything up more than 15%.
3 of 7 teams are up more than 15%. EC2 total +$18.4k (+11%) month over month.
Show in the explorerSave to dashboard
Read-only role · Cost Explorer + billing exportExplore CostChat →
01 · Report & Measure

Cloud Efficiency

Spend as a share of revenue and cost per customer — metrics a board reads.

Infra · % of ARR5.8%↓ from 9.4% · 8 quarters
Snowflake · Stripe · SalesforceSee the metrics →
03 · Discount & Protect

EDP / PPA

Burn vs. commit, months ahead. Renegotiate going up; insure the shortfall coming down.

Burned · month 8$2.44Mof $4.20M commit
Projected year-end$3.66Mshortfall $540k
burned projected| commit
Renegotiation window opens in 45 days
Updated nightly from your CURProtect the commit →
One free account · No credit card · Data stays in your AWS
02 · Alert & Govern

BlueArch CLI Self-hosted

Alerts ranked by dollars at risk — revenue tags and customer tiers, not high / medium / low.

$ bluearch alerts --rank dollars-at-risk
NAT 43 gateways · tier-1 checkout$3,120/mo
ASG web-prod · min=10, demand=4$1,640/mo
At risk this week$6,140/mo
brew install · Docker · read-only IAMExplore CLI →
02 · Alert & Govern

Tag Manager CLI + Web

TTL, ownership, and lifecycle policies in code — resources that clean up on their own.

$ bluearch-aws-tags discover all
→ prod-account · read-only session
OK Discovered 12,847 resources
brew install · Docker · GitHub ActionsExplore Tag Manager →
02 · Alert & Govern

InfraGPT™ aws-steward

Your solution-architecture agent. Ask in English; get cost, p95, and a runbook before you ship.

“Consolidate the 43 NAT gateways to one per AZ — what happens to cost and p95?”
Cost −$2,910/mop95 unchangedRunbook ready →
$ pip install bluearch-aws-steward
Free tier · metered afterView on PyPI ↗
InfraGPT™ · For solution architects

Know what an architecture will do before you ship it.

InfraGPT pairs three signals other tools see in isolation — your operational logs, AWS pricing data, and a population of simulated user sessions — into a single forecast model. Ask a question in English; get a quantified answer with cost, latency, blast-radius, and a runbook.

Forecast · infra cost / mo · next 6 months
ActualProposedStatus quo · 3× cohort±5% band
$240k$200k$160k$120kTodaySep '25Mar '26Sep '26Mar '27$236k−$30k/mo$206k ±5%
Prompt · asked in EnglishIf we move analytics to Aurora Serverless v2 and 3× our pilot user cohort, what does next quarter look like — cost, p95, and risk?
▢ 14d CloudTrail◇ 90d CloudWatch◯ Live AWS pricing◳ 50k simulated users
Forecast · next quarter
Infra cost$184k → $206k+0.21% of ARR
vs. status quo−$30k / moat 3× cohort
p95 latency312ms → 144ms−54%
Cold-start risk2.4% sessionsmitigate via warm pool
Confidence94.6%±5% on prior forecasts
Modeled in 11.4s · grounded in your CloudTrail
Eight capabilities · One surface

Everything between your code and your bill.

BlueArch closes the loop on the eight things every cloud team eventually builds in-house and never finishes. We did them so you don't have to.

01 / Forecast

Scenario Modeling

Simulate region adds, schema migrations, and traffic surges against your real workload before you commit code.

±5% on 30-day spend
02 / Architect

Decision Pairing

InfraGPT joins logs with live AWS pricing and a synthetic user population, so each design choice carries a number.

Logs × pricing × users
03 / Audit

Due Diligence

Generate the SOC 2, M&A, or board-meeting infrastructure pack from live state — every claim linked to its evidence.

3 weeks → 12 minutes
04 / Govern

Lifecycle Policies

TTL, ownership, and tag rules declared in code, enforced from CLI, audited from the dashboard.

14 policy templates
05 / Detect

Misconfigurations

CIS, AWS Well-Architected, and your house rules — scanned continuously, scored by business impact, not severity.

320+ checks
06 / Map

Resource Graph

Every dependency, every account, every region — queryable, exportable, and diffable across deploys.

Multi-account aware
07 / Observe

Unified Telemetry

CloudTrail, CloudWatch, and CUR joined in one queryable surface, retained on your terms — same data InfraGPT models on.

S3-backed · your retention
08 / Operate

AI Operations

Ask in English. Get the diff, the runbook, the dollar impact — with an audit trail before anything ships.

Claude · BYO key
Capabilities in · Value out

Every challenge in, measurable value out.

Our capabilities — tagging, detection, commitments, governance — feed the control plane running in your account. Toolkit data flows through it and comes out as the KPIs a board understands: spend as a share of revenue down, more value per dollar, more spend confidently managed per engineer, faster architectural due diligence.

Challenge
Untagged spend & sprawl
Challenge
Misconfig & waste detection
Challenge
Commitments · EDP / PPA risk
Challenge
Governance & guardrails
▸ toolkit data · runs in your accountBlueArch
Control Plane
11 toolkit feedsRead-only IAMNo egressYour VPC
KPI
Spend as % of ARR ↓
KPI
Tokens consumed per $ ↑
KPI
$ managed per engineer ↑
KPI
Due-diligence time ↓
Live findings · prod-account · us-east-1streaming
  • 12:04:02highEBS vol-0a4f291c · unattached 17d$1,240/mo
  • 12:04:04medRDS db-prod-7 · over-provisioned (CPU 4%)$840/mo
  • 12:04:06highNAT 43 gateways across 9 VPCs · consolidate$3,120/mo
  • 12:04:08lowλ image-resize · memory 1024→256$140/mo
  • 12:04:10medEIP 18.207.44.91 · unattached 6d$3.65/mo
  • 12:04:12highS3 bucket logs-prod · no lifecycle, 12.4 TB$284/mo
  • 12:04:14lowEC2 i-08e2c1f · t2 → t3 migration$92/mo
  • 12:04:16medRDS snapshot db-staging-2024 · expired$48/mo
  • 12:04:18highIAM 3 access keys older than 180dgovernance
  • 12:04:20lowCW log group / no retention · 8.2 GB/d$210/mo
  • 12:04:22medASG web-prod · min=10, p50 demand=4$1,640/mo
  • 12:04:24highSG sg-09a3 · 0.0.0.0/0 on :22security
Findings join cost + latency + user-impact in one row
Common questions

Things people ask before they install.

We hear these on every demo. Short answers below — full architecture, IAM policies, and threat models live in the public docs.

Does BlueArch see my data?+
No. BlueArch is self-hosted by default — Helm chart, container, or AMI — and runs entirely inside your VPC with read-only IAM. The only egress is the version-check endpoint, and that can be disabled. Your CloudTrail, CUR, and resource graph never leave your account.
How long does it take to install?+
About 18 minutes end-to-end for a single account: Terraform module for the read-only role, Helm install on an existing cluster, and an OIDC bind to your IdP. Multi-account onboarding is the same module in your management account.
Will it work alongside CUR / CloudHealth / our existing tools?+
Yes — BlueArch reads the same CUR exports and Cost Explorer APIs your other tools do. We don't ask you to migrate; teams typically run BlueArch alongside an existing FinOps tool for 30–60 days, then either consolidate or keep both.
What does InfraGPT actually do?+
It pairs three signals other tools see in isolation — your CloudTrail logs, the live AWS pricing catalog, and a synthetic population of user sessions calibrated to your real traffic — and returns a forecast for any architectural question. Cost, p95 latency, blast-radius, and a runbook, grounded in your data and observable in the audit log.
How does "infra spend per engineer" actually go up?+
By removing the parts of infra work that don't compound. Forecasts replace four-hour spreadsheet sessions; due-diligence packs replace three-week consultancy projects; misconfig scoring replaces the weekly cleanup ritual. The engineer ships more architecture per quarter — the spend they responsibly manage scales with it.
Is there a free tier?+
Yes — and more than a tier. The open-source and partner tools in the toolkit are free forever, and BlueArch CLI is free for individual SREs. Everything paid is value-based and listed on its product page: team plans per AWS organization, InfraGPT metered past its free tier, EDP / PPA protection priced on assessed risk or a share of realized savings, and enterprise engagements scoped per project. Nothing is priced per seat.
Who's behind BlueArch?+
A small team of ex-AWS, ex-Datadog, and ex-HashiCorp engineers based in Seattle and Austin. We're an AWS Advanced Tier Partner and SOC 2 Type II audited. The full team is on the About page.

See your AWS as a % of revenue — not a line item.

Book a short review with BlueArch. We will look at how your teams connect AWS cost, reliability, resource lifecycle, and business outcomes.

Self-hosted · AWS Advanced Tier Partner · engineer-native