Glossary

Billing & savings

AWS direct price What you would pay AWS on your own, at list price — computed from your real usage, excluding credits and refunds. The baseline every savings figure is measured against.

Wring price What you actually pay: your usage with your negotiated conditions, volume discounts, and credits applied.

Billing transfer AWS's native mechanism for moving the payment responsibility of an AWS Organization to Wring. Your organization and accounts stay yours; only the payer changes, always at a month boundary.

Volume discount A discount tier based on your monthly spend, applied automatically to your invoice. Grows with your usage — no renegotiation needed.

Credits Balances on your Wring account (promotional, refunds, prepaid) that reduce your invoice automatically, oldest first. Distinct from AWS-issued credits, which appear in your cost insights separated from usage.

Flexible commitment An insured AWS commitment (Reserved Instance or Savings Plan) booked directly in Wring with a 30-day or 1-year guarantee instead of AWS's one-to-three-year lock-in. The insurance carries the long-term utilization risk.

Interim invoice An invoice issued mid-month for a partial period — for example at the end of a budget year. Available on request.

Connection & access

Base stack The CloudFormation stack you launch when connecting an account. It creates the read-only role Wring uses — four IAM actions in total, plus a permanent deny policy.

Level Wring's unit of opt-in access. The Base level (cost & usage reading) is all you need to start; optional capabilities like security checks or Wring Bedrock ship as separate stacks with their own narrowly scoped roles. The full list is in the access model.

External ID A per-customer secret that AWS requires alongside Wring's identity on every role assumption — the standard protection against confused-deputy attacks.

Management account The account that owns an AWS Organization. Billing-transfer invitations are sent to it, and connecting it lets Wring discover your member accounts during onboarding.

CUR (Cost & Usage Report) AWS's detailed billing report, delivered to an S3 bucket. The Wring role may read CUR files — and is explicitly denied access to every other S3 object.

Data

Daily sync The automatic daily read of your cost data from the AWS Cost Explorer API. Re-fetches recent days so AWS's late-arriving usage corrections are picked up.

Security & reviews

Posture score The headline score of a security scan for one AWS account — how much of what Wring can check is currently passing. Its value is the trend, not the absolute number.

Compliance framework score Your scan result mapped onto a framework (CIS, SOC 2, ISO 27001, HIPAA, GDPR, C5, NIS2, or a Well-Architected pillar). Only requirements that map to an implemented check are scored; the rest are reported as not covered rather than graded as passes.

Suppression A finding you deliberately set aside — as accepted risk, a false positive, or snoozed for 30 days — always with a note. Suppressed findings leave your scores and stay on record for auditors.

Group deals

Pool A group deal for one AWS service: several Wring customers' usage combined toward a target volume, so the group reaches terms none of them would reach alone. You see aggregate progress only — never who else is in it.

Soft commitment Joining a pool. It expresses interest and contributes your usage to the pool's progress; it charges nothing and binds nothing. Wring follows up before anything becomes real.