Introduction

The connection

Wring never asks for credentials and never installs anything in your infrastructure. Each connected AWS account runs a small CloudFormation stack that creates a cross-account IAM role. Wring assumes this role with short-lived credentials (at most one hour) to read billing and cost data — and nothing else. Every access is logged in your own CloudTrail.

Wring's access is organized in levels. The Base level — pure cost & usage reading, four read-only IAM actions in total — is all you need to get started. Additional opt-in levels (security checks, Wring Bedrock, and the observability metrics Ask Werner can read) are delivered as separate stacks with their own narrowly scoped read-only roles, so you always decide per account what Wring may do.

The daily sync

Once an account is active, Wring pulls its cost and usage data from the AWS Cost Explorer API automatically every day and keeps a normalized history. That history powers everything you see:

• Cost insights — spend per service, per account, and over time
• Savings — what you save with Wring compared to paying AWS list price
• Ask Werner — questions about your own spend, answered from that same history
• Invoices — one consolidated monthly invoice instead of raw AWS billing

The billing relationship

Insights work with read-only access alone. To get Wring pricing, volume discounts, and the consolidated invoice, your billing routes through Wring via AWS's native billing transfer — your organization and accounts stay yours, and neither your workloads nor Wring's read-only access change. That step is explained in How Billing Works.