Skip to main content
MilkStraw AI connects using a secure least-privilege cross-account IAM role that you deploy in your AWS management account or across your organization via CloudFormation. The role includes a unique external ID for verification.
The role has least-privilege permissions to monitor usage and savings coverage across various AWS services. It can’t change your workloads, such as instances, databases, or networks. A few write permissions let MilkStraw AI add MilkBoxes to your AWS Organization, create an AWS Organization if your account isn’t in one, and set up S3 Storage Lens and AWS Compute Optimizer. See Permissions for the full list.
No, you continue to pay AWS directly for your cloud usage as normal. The MilkStraw AI service fee is separate and based on the savings achieved.
After you activate savings on the Overview page, our team adds to your organization. When MilkBoxes are underutilized, our team removes them.
No. MilkStraw AI never reads the contents of your files, databases, or logs, and MilkBoxes have no access to your workloads or VPCs. The connection is for billing, usage monitoring, and MilkBox management.
It leaves your AWS Organization and no longer shares billing with your organization. MilkBoxes only hold commitment-based discounts and never run your workloads.
MilkStraw AI scans your resources and usage metrics every hour, and refreshes your cost and savings data every day. AWS can take up to 2 days to report costs.
You can check the covered services page for the full list.
For a single account, the role is deployed directly via a CloudFormation stack. For an AWS Organization, you first deploy the same stack in the management account. Then you turn on StackSets trusted access and deploy a CloudFormation StackSet wrapper, which deploys the same role to all member accounts in the organization.
Our fee is calculated only from the incremental savings delivered by the we provide, separate from your existing commitments. AWS applies a Database Savings Plan and a Reserved Instance to different workloads, never to the same one.
Yes! You can connect multiple AWS Organizations to a single MilkStraw account. To do so:
  1. Click your organization name in the bar at the bottom of the app.
  2. Click Create Organization.
  3. Follow the standard organization onboarding flow as described in the Quickstart guide — the process is the same as connecting your first organization.
Once connected, you can switch between your organizations at any time by clicking your organization name in the bottom bar.