FAQ
Short answers to the questions we hear most.
Access & security
Can Wring change anything in my AWS account? No. The role you grant is read-only, and a permanent explicit-deny policy additionally blocks entire categories of sensitive data (secrets, databases, logs, source code, identity data). See the access model and the full permission list.
We do not run third-party CloudFormation. Can we still connect? Yes. The stack is one IAM role plus a deny policy; you can create the role in your own infrastructure-as-code from the documents the dashboard shows and register its ARN — see Connect without CloudFormation.
How do I disconnect an account? Delete the Wring CloudFormation stack in that AWS account. Access ends immediately and the account shows up as disconnected in Wring.
Which AWS Region should I create the stack in?
Any Region you like. The launch link opens the console in Frankfurt
(eu-central-1) as a default; switch Regions before you click Create stack
if your policies require it. The stack holds only global IAM resources and one
EventBridge rule, and it notifies Wring from wherever it runs. If your
organization limits Regions with a service control policy, keep the usual
global-service exemptions in place — IAM, STS, Organizations and Cost
Explorer — since that is all the role ever calls.
Can I audit what Wring reads? Yes — every access uses your account's CloudTrail like any other API call, with tagged sessions attributing the activity to Wring.
Do you see what runs inside my workloads? No. Wring reads billing and cost metadata — services, usage types, amounts. It has no access to instance contents, application data, or logs.
Can I keep changing my infrastructure freely while on Wring? Yes, completely. Wring installs no agents and constrains nothing — deploy, migrate, rearchitect, and scale exactly as before. Your cost data follows along automatically with the daily sync.
Billing
Do I have to move my accounts into Wring's organization? No — never. Wring uses AWS's native billing transfer, which moves only the payment responsibility; your organization and accounts stay entirely yours. And you can use cost insights without changing billing at all.
When does billing via Wring start? At a month boundary. Billing transfers always take effect on the first day of a month; your Wring contact schedules it with you.
Is there a lock-in? No — the billing transfer ends at the end of a chosen month through the same standard AWS mechanism, and AWS bills you directly again from the next month.
What happens to my existing AWS credits? Credits and refunds are visible in your cost insights, shown separately from usage. Credits on your Wring account are applied to your invoice automatically, oldest first.
Can I get an invoice mid-month? Yes — [email protected] can issue an interim invoice for a partial period.
Your account & team
Can I give my team access? Yes. Under Settings → Team in your dashboard, account owners invite teammates by email; invited members see the same dashboards and cost data. Owners can also remove members and manage open invitations there.
Can I change who receives invoices? Yes — tell us once at [email protected] and future invoices go to the right people. See Paying Your Invoice.
Costs & data
How current is my cost data? It refreshes automatically every day. AWS itself reports usage with a delay of up to a few days; the daily sync re-fetches recent days so late-arriving usage is corrected automatically.
Why do my Wring numbers differ slightly from the AWS console? Usually timing: AWS finalizes usage data over several days. After the sync catches up, the numbers match — Wring reads the same Cost Explorer data your console shows.
Anything else?
Write to [email protected] — we usually reply within a few hours on business days.