• Home
  • How it works?

    • Cloud Financial Management

      Cloud Security

      Well-Architected Framework Review

      AWS Security Assessment

      Programs

      Cloud Reliability

      Cloud Inventory

      Platform Integrations

      On-Demand Services

      Compliances

  • Pricing

    • Blogs

      Case studies

      Documentation

      Release Notes

  • Contact us
Try For Free
Become a Partner
Log in
Become a Partner
Try For Free
Log in

Tevico Documentation

Introduction

Tevico is a Cloud Governance and Monitoring tool designed to efficiently manage AWS cloud resources, with a focus on cost, security, reliability, and compliance. As a SaaS platform, Tevico provides organizations with centralized visibility and control over their AWS environments, enabling teams to onboard accounts, track expenditures, assess security posture, and maintain compliance, all from a single interface. In today’s cloud-driven infrastructure landscape, Tevico serves as a unified governance layer that bridges the gap between operational complexity and actionable insights, helping organizations enforce best practices, reduce unnecessary spend, and maintain a secure, well-architected AWS environment at scale.

This manual covers the complete setup and usage of Tevico, beginning with AWS Marketplace subscription and account onboarding, and extending through the configuration of core platform features. Tevico consolidates key cloud management workflows into a single platform by delivering cost visibility and right-sizing recommendations; providing security assessments and compliance reporting aligned with industry standards; offering audit logging for account activity tracking; supporting containerized workload management through the Cluster feature; and enabling Well-Architected Framework reviews to identify and address architectural gaps. Together, these capabilities allow teams to operate their AWS environments with greater efficiency, security, and governance.

User Manual Overview

This user manual for Tevico provides comprehensive guidance for onboarding your AWS account onto the platform. It outlines the prerequisites for onboarding and offers step-by-step instructions for utilizing key features such as Cost Dashboard, Security Assessments, Cluster and Well-Architected Framework Review.

Product Features

This user manual explains how to upgrade subscription plans. Currently, Tevico offers the following plans:

  • Collaborator Plan
  • Basic Plan
  • Premium Plan

Key Features

By the end of this guide, users will be able to:

  • Onboard their AWS account onto Tevico.
  • Upgrade their account to the Premium plan.
  • Monitor and optimize your AWS expenditures with the Cost Dashboard.
  • Identify, analyze, and remediate security findings using Tevico’s Security Assessment.
  • Generate detailed security reports that are compliant with various standards.
  • Take advantage of the Cluster Feature to manage and secure workloads.
  • Create a Well-Architected Framework workload, review it against industry best practices, and address identified gaps.
  • Be aware and take advantage of the multi-account linking process.
  • Utilize the Audit Logs feature to track and review account activities.

Prerequisites

1. To begin using Tevico as a cloud management platform, we utilize a Cross-Account IAM role, and we provision all necessary resources for this access using a CloudFormation Template provided by the platform upon subscription.

You need to create the following access permissions to set up the necessary resources in your AWS account and grant Tevico the required permissions:

 

{
    “Version”: “2012-10-17”,
    “Statement”: [
        {
            “Sid”: “FullAccess”,
            “Effect”: “Allow”,
            “Action”: [

                “aws-marketplace:Subscribe”,

                “aws-marketplace:ViewSubscriptions”,

                “aws-marketplace:Unsubscribe”,

                “config:*”,

                “cloudformation:CreateStack”,

                “cloudformation:UpdateStack”,

                “cloudformation:DeleteStack”,

                “cloudformation:CreateChangeSet”,

                “cloudformation:ContinueUpdateRollback”,

                “cloudformation:DeleteChangeSet”,

                “cloudformation:DescribeChangeSet”,

                “cloudformation:DescribeStacks”,

                “cloudformation:DescribeStackEvents”,

                “cloudformation:ListChangeSets”,

                “cloudformation:DetectStackDrift”,

                “cloudformation:DescribeStackDriftDetectionStatus”,

                “cloudformation:DescribeStackResourceDrifts”,

                “cloudformation:ListStackInstanceResourceDrifts”,

                “cloudformation:GetTemplateSummary”,

                “cloudformation:ListStacks”,

                “cloudformation:ListStackResources”,

                “cloudformation:ListStackSets”,

                “cloudformation:ListTypes”,

                “cloudformation:ListTypeVersions”,

                “cur:DescribeReportDefinitions”,

                “cur:PutReportDefinition”,

                “cur:ModifyReportDefinition”,

                “cur:GetClassicReport”,

                “cur:GetUsageReport”,

                “cur:DeleteReportDefinition”,

                “iam:CreateRole”,

                “iam:CreateInstanceProfile”,

                “iam:CreateServiceLinkedRole”,

                “iam:CreatePolicy”,

                “iam:CreatePolicyVersion”,

                “iam:PutRolePolicy”,

                “iam:UpdateRole”,

                “iam:AttachRolePolicy”,

                “iam:DetachRolePolicy”,

                “iam:GetRole”,

                “iam:ListRoles”,

                “iam:PassRole”,

                “iam:GetPolicy”,

                “iam:ListPolicyVersions”,

                “iam:DeleteRole”,

                “iam:DeleteRolePolicy”,

                “iam:DeletePolicyVersion”,

                “iam:AddRoleToInstanceProfile”,

                “iam:RemoveRoleFromInstanceProfile”,

                “iam:GetInstanceProfile”,

                “iam:DeleteInstanceProfile”,

                “lambda:CreateFunction”,

                “lambda:ListFunctions”,

                “lambda:GetFunction”,

                “lambda:InvokeFunction”,

                “lambda:ListVersionsByFunction”,

                “lambda:PublishVersion”,

                “lambda:UpdateFunctionCode”,

                “lambda:DeleteFunction”,

                “license-manager:ListReceivedLicenses”,

                “sns:ListTopics”,

                “s3:ListBucket”,

                “s3:CreateBucket”,

                “s3:PutBucketPolicy”,

                “s3:GetBucketPolicy”,

                “s3:DeleteBucketPolicy”,

                “s3:GetBucketAcl”,

                “s3:GetBucketLocation”,

                “s3:PutBucketOwnershipControls”,

                “s3:DeleteBucket”,

                “s3:GetObject”,

                “s3:PutObject”
            ],
            “Resource”: [“*”]
        }
    ]
}

 

2. During the onboarding process, before creating a stack with the CloudFormation template, you must enter a valid email address to receive an activation link.

3. To generate security assessment reports, you must enable Security Hub and ensure resource recording in AWS Config on your AWS account.

4. To enable notifications for GuardDuty, Billing etc you need to either have a slack webhook preconfigured and/or a Jira Service Desk in place.

5. To get consolidated findings for cost, security & inventory, you need to onboard your organization account.

Access Management and Security Controls

Overview

The functionality of Tevico is supported through IAM roles and policies that have been defined with strict adherence to the principle of least privilege. Permissions have been scoped narrowly and assigned to AWS services such as EC2 and Lambda. Each permission has been properly tagged to ensure that the tool does not interact with any resource/s that is/are not created by Tevico or the tool does not have access to. Access control mechanisms, S3 bucket & policies, and justification for granted permissions have been implemented to ensure security. Only the permissions required for the intended functionality have been granted, thereby reducing risk while enabling necessary platform features.

All the data that is used for creating dashboard is stored in the user’s AWS account in respective buckets.

Access Management Strategy

Access is governed using least privilege principles, with IAM roles configured to allow only required actions. Permissions are tightly scoped, and sensitive resources are protected through enforced conditions, external ID constraints, and resource-level limitations.

Cross-account access is facilitated using trusted relationships constrained by policy and verified identifiers. Internal service interactions are enabled through controlled roles assigned with minimal privileges. S3 buckets involved in Tevico’s operation are secured through encryption, strict access policies, and version control.

By this approach, a secure, auditable, and compliant environment is maintained according to AWS best practices and enterprise standards.

IAM Roles

1. TevicoSsmRole

Purpose: Manages AWS Systems Manager (SSM) operations for EC2 instances
– Assumed By: EC2 and SSM services
– AWS Managed Policies Attached:

  • AmazonEC2RoleforSSM
  • AmazonSSMManagedInstanceCore

– Custom Policy Permissions:

  • CloudWatch metrics management
  • SNS operations for notifications

Justification: Required for automated instance management and monitoring

2. Custom Policy Permissions

Purpose: Enables cross-account access for Tevico to read metadata from accounts managed by Tevico
– Assumed By: Trusted Account (with External ID requirement)
– AWS Managed Policies Attached:

  • ReadOnlyAccess

– Custom Policy Permissions:

  • CloudWatch alarm management
  • EventBridge rules management
  • Well-Architected Framework access
  • Security Hub enablement
  • Access Analyzer management
  • SSM document management
  • SNS topic management
  • Limited EC2 operations
  • CUR report management

Justification: Required for cost optimization, security assessment, well-architected framework review, and resource management.

3. TevicoNotificationLambdaRole

Purpose: Enables Lambda function to send notifications to Tevico
– Assumed By: AWS Lambda service
– Custom Policy Permissions:

  • CloudWatch Logs management
  • CloudFormation stack description

Justification: Required for operational monitoring and CloudFormation stack management

S3 Bucket & Policies

1. CUR Bucket & Associated Policies

This bucket is created in the user’s account for storing data generated by Cost & Usage Report

Purpose: Attaching required AWS Cost and Usage Report policies to the S3 bucket in user’s AWS account.
– Permissions:

  • Allows bcm-data-exports.amazonaws.com to put objects
  • Allows a trusted account to read objects

– Security Controls:

  • Enforces SSL/TLS
  • Restricts public access
2. Utility Bucket & Policies

This bucket is created in the user’s account for storing metadata used for Security and Inventory dashboards

Purpose: Attaching required policies to the S3 bucket for storing metadata securely in user’s AWS account.
– Permissions:

  • Allows Tevico engine with CFNTevicoAssumeRole to put objects
  • Allows a trusted account to read objects

– Security Controls:

  • Enforces SSL/TLS
  • Blocks public access
  • Enforces bucket owner control

Least Privilege Implementation

Security Controls
  • External ID Requirement: Enforced for cross-account roles to add an extra layer of security
  • Conditional Access: S3 access requires SSL/TLS; Lambda assumes role only from the verified source account
  • Resource-Level Restrictions: Permissions are scoped to specific buckets and resources along with Tag Conditions applied wherever feasible
Write Permissions Justification
  • CloudWatch & EventBridge: Necessary for monitoring setup and cost optimization triggers
  • Security Services: Required to enable/configure security assessments and maintain compliance
  • S3 Operations: Scoped to designated buckets for storing assessment data and reports only
Best Practices Implementation
  • Resource Tagging: All resources are tagged with ‘created By:Tevico’
  • Version Control: Versioning is enabled on all S3 buckets; lifecycle policies manage older versions
  • Access Control: Public access blocked on all S3 buckets; SSL/TLS enforced for secure data transfer; Bucket owner enforced for data integrity

Tevico Onboarding

Subscribe to Tevico from the AWS Marketplace

1.  Login into the AWS management console and navigate to AWS Marketplace

2. In the AWS Marketplace, click on “Discover products” and search “Tevico” in the search bar.

3. Select the product Tevico, and click “View purchase options” to get the price details.

4. In “Available offers”, you can find the “Public” and “Free trial” offers.

5. Click on “Subscribe” to complete the purchase.

6. Click on the “Set up your Account” button on the top right of the page. It will take the user to Tevico’s sign-up process defined in detail in the Sign up on Tevico section given below.

Note: For financial management, onboarding a management or organization account provides centralized management, eliminating the need for separate onboarding for each sub-account or child account. However, if you want to use features like the Well-Architected Framework or workload automation across accounts (whether part of the same organization or not), each account must be onboarded individually.

Sign up on Tevico

Please follow the steps below to complete the onboarding process.

1. After clicking “Set up your account” in the previous step, you will be directed to the “Let’s get you Onboarded” page.

2. On the “Let’s get you Onboarded” page, sign up using Google or enter a valid name, email id and proceed to “I accept the Terms and Conditions” and click on  “Create Account”.

3. Click Launch Stack.

Note: To monitor the resources that will be or have already been created in your AWS account while onboarding through Tevico, Click on “here” to access the CloudTrail page in a new browser tab. This allows you to review logs and activities without disrupting your ongoing workflow.

4. A new tab or window will open, taking you to the AWS CloudFormation Stack creation page. Keep the pre-populated values as they are, and check the boxes related to IAM capabilities to allow the stack to create IAM resources.

5. Wait until the status for both the stacks changes from ‘CREATE_IN_PROGRESS’ to ‘CREATE_COMPLETE’.

6. Tevico will automatically fetch the Role ARN and populate the correct value in the placeholder text box. Once it is fetched, click “Continue” to proceed.

7. After clicking the “Continue” button, you will receive an email. In the email, click on the “Complete” button to finalize the setup.

8. The above link will take you to the “Complete Account Setup”. The email address you previously entered will automatically appear in the Email ID text box, create the password (according to the password requirements mentioned), and click “Setup”.

9. After clicking on “Setup”, you will be redirected to the “Sign into your account” page. Enter your credentials, then click Sign in to proceed.

10. The sign-up created on Tevico is in the Basic Plan. To access advanced features offered by the Premium Plan, you need to upgrade to the Premium subscription plan.

Upgrading to the Premium Plan

Follow the steps given below to upgrade your Tevico account to the Premium plan:

1. Log in to https://console.tevi.co using your valid credentials. Click on the Tevico Account ID on the top right corner after logging in.

2. Go to the Account Settings page from the options given in the sidebar.

3. Click on “Plan” from the sub-sections as shown below.

4. Scroll down and click the on “Upgrade Plan” button under the Premium plan.

5. And click on “Change Plan” to use the premium plan features.

6. Refresh the screen to view the Premium tag under your Tevico Account ID to ensure that premium plan features are activated successfully.

Accessing Audit Logs

Audit logs provide a clear record of who made the changes when those changes occurred, and what actions were taken. This helps you to monitor and verify that only authorized individuals are making changes reducing the risk of unauthorized actions.

1. Login to https://console.tevi.co

2. Click on the Show Audit Log icon, as depicted in the image provided below.

3. This will display the audit logs, allowing you to review the detailed history of actions and activities within your Tevico account.

4. Tevico allows you to view audit logs based on the specific section you’re in. For example, if you’re in the “Dashboard” or “Well-Architected” or “Cluster” section and want to see the logs for actions performed in that particular section you can switch between viewing logs specific to that section or account. This helps you track actions performed in different sections, giving you more flexibility in reviewing activities.

Note:
To ensure comprehensive monitoring and auditability, we maintain a log retention policy where all logs are preserved for 180 days. This retention period allows you to effectively track and analyze historical data, aiding in security analysis, and compliance requirements.

Multi-Account Management

Overview

Tevico simplifies multi-account management on AWS by integrating directly with AWS Organizations. It discovers all member accounts automatically and provides a unified dashboard to monitor security posture and track cloud costs across the entire organization.

With seamless onboarding and account linking, teams can securely manage accounts, enforce governance, and gain visibility into both operational and financial performance.

Account Management Process

1. Organization Account Onboarding
  • Onboarding begins via AWS Marketplace.
  • Once connected, Tevico automatically discovers all member accounts in the AWS Organization.
  • A dedicated organization dashboard is available to manage and track all linked accounts, along with the list of accounts that are not linked or onboarded.
2. Member Account Integration/Linking Your Accounts
a. Member Account Subscription
  • Each member account must be onboarded to Tevico through AWS Marketplace.
  • This ensures compliance with AWS billing and subscription policies.
b. Account Linking
  • Once onboarded, member accounts can be linked to the organization account via the Tevico interface.
  • Once the member account is onboarded, then the account has to be linked.
  • Login to the organization account.
  • At the “Home” page, you’ll see the “View Organization” link.
  • Click on “View Organization” and you’ll be redirected to the Organization dashboard.
  • Search for the onboarded member account.
  • Click on the action button(three dots) and click on “Link”.

Linking enables:

  • Aggregated AWS budget monitoring.
  • Consolidated findings for Security where you can track security posture for all the accounts.
  • Centralized dashboard for inventory to track all the resources present in your accounts.
3. Monitoring Capabilities
Without Account Linking
  • View cost data across the organization using Cost and Usage Reports (CUR).
  • Track costs per account.
  • Basic account discovery and inventory listing.
With Account Linking
  • Monitor rolled-up budget information.
  • Access detailed operational data across accounts through a unified dashboard.
  • Get access to a centralized dashboard for monitoring the security posture of your linked accounts.
  • Track all the resources that are present within your organization with the Inventory dashboard.
Key Features
  • Automated discovery of all member accounts within an AWS Organization.
  • Option to link accounts for unified visibility.
  • Centralized interface for managing organization-wide cloud operations.
  • Secure IAM-based cross-account access.
  • Integrated CUR-based cost tracking and analysis.
  • Improved security posture visibility across all linked accounts.
Security and Compliance
  • Secure cross-account IAM role assumption with enforced policies.
  • Operations adhere to least-privilege access models.
  • Fully aligned with AWS Marketplace and AWS Organizations compliance requirements.
  • Maintains strict security control at both the member and organization levels.

Cost Dashboard

Tevico’s cost dashboard is a central hub designed to help you monitor, analyze, and optimize your AWS costs. It offers a detailed breakdown of your AWS spending across different services and resources, helping you make informed decisions to reduce unnecessary expenditures. The dashboard is structured into multiple sections, enabling you to identify excess spending, allocate budgets effectively, and implement cost-saving strategies.

Alignment to account structures

Aligning cost management with account structures gives you better visibility and control over spending by grouping costs based on departments, projects, or environments (e.g., production vs. development). This simplifies cost allocation, ensuring each team is accountable for its own expenses, which aids in budgeting and financial reporting.

Tevico supports the onboarding of organizational accounts and allows for the integration of multiple child accounts i.e. within the main organizational account, you can integrate multiple child accounts. A dropdown menu is available for both the accounts and regions to select and switch between different AWS accounts or regions.

Cost Summary

Cost Summary section provides you with high-level insights into the account consumption, services used, and regions or accounts that contribute to the highest costs. You can monitor the regions, services, or accounts driving their costs and track trends over time.

1. Account Consumption

Account Consumption feature helps you compare costs with the previous month, anticipate your total monthly consumption, and identify potential cost fluctuations early, enhancing overall financial management.

  • Month-To-Date Balance: This shows the current amortized “month-to-date” balance. Amortized means reflecting the effective cost of the upfront and monthly fees spread across the billing period.
  • Last Month: The amount spent last month.
  • Forecast: This shows the account consumption for the current month and estimates that the account consumption for this month is anticipated to be less/more than what was consumed last month.
2. Services Used

Services used feature helps you to track the number of AWS services used over time, making it easier for you to identify services that were either added or discontinued, enabling better resource management and optimization. Highlighting the top spending service, helping you manage expenses more effectively.

  • Last Month: This shows the number of services used in the last month.
  • This Month: This shows the number of services used in the current month.
  • Top Spending Service: This shows the top spent AWS service in the current month.
  • Click on “View All” to view all the “Total Services Used”.This will provide detailed information about the services utilized last month but not in the current month.
  • This Month: This shows the number of services used in the current month.
  • Last Month: This shows the number of services used in the previous month.
  • Services Used: This shows the name of the AWS Service/tool.
  • Accounts Count: This shows the number of accounts used by AWS Service/tool.
  • Last Month: This shows whether the AWS Service/tool was used () or not () in the previous month.
  • Current Month: This shows whether the AWS Service/tool was used () or not () in the current month.
3. Accounts Used

Accounts used feature helps you to track the number of AWS accounts used over time making it easier for you to identify accounts that were either added or discontinued. Highlighting the top spending account, helping you manage expenses more effectively.

  • Last Month: This shows the number of accounts used in the last month.
  • This Month: This shows the number of accounts used in the current month.
  • Top Spending Service: This shows the top spent account including the amount spent in the current month.
4. By Region – Top five cost-incurring regions

By Region feature allows you to monitor cloud spending across various AWS regions. You can quickly identify which region is being consumed most. By highlighting the region with the maximum spending and providing detailed insights into specific regional expenditures, you can optimize costs more effectively.

  • This feature shows a graphical representation of the top 5 regions and the amount each region spent. By selecting one of the options, you can view spending for the previous month and also for the Month-to-date.
  • Region with the maximum spend: This shows the region with the maximum spend and the amount spent.
  • Click on “View All” to view detailed information on spending by each region. By selecting one of the options, you can view spending for the previous month or Month-to-date.
5. By Service – Top five cost-incurring services

By Service feature allows you to monitor cloud spending across various AWS services. You can quickly identify which service is being consumed most. By highlighting the top five services with the maximum spending and providing detailed insights into specific service expenditures, you can optimize costs more effectively.

  • This feature displays an overview of costs incurred by the top 5 AWS services in the workload and by selecting one of the options, you can view spending for the previous month or Month-to-date.
  • Service: This column shows the name of the service.
  • Cost: This column shows the cost incurred for each service.

Click on “View All”, to view a detailed breakdown of all AWS services and their associated cost.

6. By Accounts – Top five cost-incurring accounts

By Accounts feature allows you to monitor spending across various AWS accounts. You can quickly identify which account is being consumed most. By highlighting the top five accounts with the maximum spending and providing detailed insights into specific account expenditures, you can optimize costs more effectively.

  • This feature shows a bar chart that displays an overview of costs incurred by the top 5 AWS accounts in the workload. By selecting one of the options, you can view spending for the previous month or Month-to-date.
  • Click on “View All”, to view a detailed breakdown of all AWS accounts and their associated cost.
7. Invoice Trend – Get the newest insights on invoice trends within a timeframe

Invoice Trend feature helps you with a detailed breakdown of their invoice spending over time. By visualizing trends, you can identify any significant increases or decreases in spending This enables businesses to make informed decisions regarding resource allocation, and budget planning.

  • This feature shows a graphical representation of the “Invoice Trend” over the last three months using both a bar graph and a line graph.
  • Invoice Trend: This highlights the percentage change in invoice amounts between consecutive months.
  • Click on “View All”, to view a detailed breakdown of all AWS accounts and their associated spending.
  • You can view the information for 3 months or 6 months or 1 Year.

Cost Analysis

Cost analysis section helps you to gain a comprehensive understanding of your spending patterns, identify opportunities for cost reduction, and make data-driven decisions to optimize your resource usage and minimize expenses.

1. Total Usage Graph

Total Usage Graph feature helps you easily identify trends, compare usage across different time periods, detect anomalies, and make informed decisions. By understanding your account or service consumption patterns you can optimize their resource utilization, reduce costs, and effectively manage their cloud resources.

  • Total Usage Graph: This feature shows a graphical representation of the AWS services spent over a time period. The costs are broken down by top five/ top 10 / top 15 AWS services/accounts.
  • The time periods include 1 week (1W), 2 weeks (2W), 1 month (1M), 3 months (3M), 6 months (6M), 1 year (1Y), month to date (MTD), and year to date (YTD) and also can select “Custom date range”.
  • The graph is set to show spending by service or per account.
2. Daily Cost Trend

Daily Cost Trend graph helps you with a detailed view of their daily spending on cloud resources. This graph allows you to easily identify fluctuations in daily costs and you can optimize your resource utilization, reduce costs, and effectively manage your cloud resources.

  • This feature shows a graphical representation of daily cost trends.
  • The time periods include 1 week (1W), 2 weeks (2W), 1 month (1M), 3 months (3M), 6 months (6M), 1 year (1Y), month to date (MTD), and year to date (YTD) and also can select “Custom date range”.

Resource Right Sizing

Resource right sizing section helps you to optimize cloud resource allocation, reduce costs, improve performance, and avoid performance issues. By analyzing resource usage and providing recommendations for EC2, EBS, RDS, and reserved instances will help you significantly reduce your cloud spending while maintaining and improving application performance.

1. EC2 Compute Optimization

EC2 Compute Optimization feature helps you by identifying over-provisioned and under-provisioned instances, you can optimize costs, improve resource utilization, and make informed decisions about your EC2 instance usage.

  • Total: This shows the total number of Elastic computes present in the account.
  • Over Provisioned: This shows the number of EC2s that are over-provisioned.
  • Under Provisioned: This shows the number of EC2s that are under-provisioned.
  • Optimized: This shows the number of EC2s that are optimized.
  • Additionally, a stacked bar chart is provided to visually represent EC2 Compute Optimization.
  • Click on “View All”, to view all EC2 Right-Sizing Recommendations and you can also export the data in CSV/Excel by clicking on “Export”. 
2. EBS Volumes Optimization

EBS Volumes Optimization helps you with valuable insights into your EBS volume usage. By assessing volume utilization and identifying optimization opportunities, you can make informed decisions about your volume allocation and improve resource utilization.

  • Total Volumes: This shows the total number of EBS Volumes present in the account.
  • Attached:  This shows the number of EBS volumes attached to the EC2s.
  • Unattached:  This shows the number of EBS volumes unattached to the EC2s.
  • Additionally, a stacked bar chart is provided to visually represent the EBS optimization status.
3. EBS Operations Cost

EBS Operations Cost section helps you with valuable insights into your EBS operation costs. By visualizing daily, weekly, monthly, and yearly spending trends, you can identify cost-consuming EBS operations, analyze spending patterns, and make informed decisions to optimize your EBS volume usage.

  • This feature shows a graphical representation (bar graph) to represent the EBS (Elastic Block Store) operations costs over a week, highlighting the most and least cost-consuming operations.
  • Each bar represents the total cost of these operations for each day, with the height of each color segment showing the respective operation’s cost contribution.
  • The time periods include 1 week (1W), 2 weeks (2W), 1 month (1M), 3 months (3M), 6 months (6M), 1 year (1Y), month to date (MTD), and year to date (YTD).
4. Top 5 Cost consuming EBS Volumes

Top 5 Cost consuming EBS Volumes feature allows you to monitor spending across your AWS accounts. You can quickly identify which EBS operation is being consumed most and by focusing on the top 5 cost-consuming EBS volumes you can optimize costs more effectively.

  • This feature shows the top 5 cost-consuming EBS volumes with their Volume ID, Type, Encryption Status, EC2 Instance, Recommendation Status, and Cost.
  • Click on “View All”, to view all the EBS Volumes and their Volume ID, Type, Encryption Status, EC2 Instance, Recommendation Status, and Cost.
5. Recommendation for ECS Services on Fargate

Recommendations for ECS Services on Fargate help you to reduce costs and provide valuable insights into the efficiency of your Amazon Elastic Container Service (ECS) services running on Fargate. The feature highlights ECS services that can be optimized and empowers you to make informed decisions about your ECS service configuration.

  • This feature gives recommendations for optimizing ECS (Elastic Container Service) services running on AWS Fargate.
  1. Optimized: This displays the number of ECS services that are optimized.
  2. Under Provisioned: This displays the number of ECS services that are under-provisioned.
  3. Over Provisioned: This displays the number of ECS services that are over-provisioned.
  4. Max. Estimated Savings ($0): This displays the cost savings that could be achieved by optimizing the services, based on the recommendations provided.
  5. Additionally, the feature shows the Top 5 ECS Services based on monthly savings, along with each ECS service’s ARN, maximum estimated savings, current CPU and memory allocation, and recommendations for resizing based on usage. Actions such as resizing or adjusting settings can be taken if recommendations are available.
  6. Click on “View All” to view all the recommendations which include details about Service Arn, Maximum Estimated Savings, Current CPU Size, Current Memory Size.
6. RDS Cost Recommendation

RDS Cost Recommendations feature helps you to highlight the number of optimized, under-provisioned, and over-provisioned instances, as well as the top 5 RDS instances based on the cost savings by following the recommendations, you can significantly reduce the RDS costs while ensuring the databases are running efficiently.

This feature gives recommendations for optimizing RDS (Relational Database Services) and allows filtering the spending by instance or storage.

  • Optimized: This displays the number of RDS services that are optimized.
  • Under Provisioned: This displays the number of RDS services that are under-provisioned.
  • Over Provisioned: This displays the number of RDS services that are over-provisioned.
  • Max. Estimated Savings ($0): This displays the cost savings that could be achieved by optimizing the services, based on the recommendations provided.
  • Additionally, the feature shows the top 5 RDS instances by estimated savings, along with each RDS service’s ARN, maximum estimated savings, current CPU and memory allocation, and recommendations for resizing based on usage. Actions such as resizing or adjusting settings can be taken if recommendations are available.
  • Click on “View All” to view all the RDS recommendations which include details about Resource Arn, Last Updated,  Recommendations Count,  Maximum Estimated Savings, and Action.
7. Reserved Instances Recommendation

Reserved Instances Recommendation feature helps you to optimize AWS Instances costs and gain the flexibility to adapt to changing requirements by exchanging instances for different configurations, ensuring optimal cost-efficiency and flexibility.

This feature provides insights into optimizing your AWS costs by purchasing Reserved Instances (RIs) for your EC2 (Elastic Compute Cloud) resources, Relational Database Service (RDS), and DynamoDB.

  • Service: This dropdown allows you to choose the following options to analyze and optimize your Reserved Instances.
  1. Elastic Compute Cloud (EC2).
  2. Relational Database Service (RDS).
  3. DynamoDB.
  • Term: This dropdown allows you to choose the term length for the Reserved Instances which include 1 year or 3 years.
  • Payment: This dropdown allows you to choose the payment option for your Reserved Instances, selecting between All Upfront, Partial Upfront, or No Upfront payment plans.
  • Offering Class: This dropdown allows you to choose from various types of Reserved Instances, including “Standard” and “Convertible”.
  • Total Recommendations: This shows the total number of recommendations available based on the parameters.
  • Estimated Monthly Savings: This shows the potential savings per month if the recommended Reserved Instances are purchased.
  • Estimated Savings vs On-Demand Rates: This metric illustrates the percentage of savings compared to the on-demand pricing model.

Savings Plan Recommendations

Savings Plan Recommendations feature helps you identify the savings plan that offers the estimated savings based on your AWS usage. By using this feature, you can optimize your costs and improve budget efficiency.

1. Compute Savings Plan
  • Estimated Savings: This shows the amount of money you will save each month and month by using the savings plan.
  • Term: This is the commitment period for the savings plan. In this case, the user commits to using the savings plan for 3 years to benefit from discounted rates.
  • Payment: This indicates the payment method for the savings plan.
  • Based on: The estimated savings are calculated based on data collected from the last 60 days of your compute usage.
  • Click on “View All” to access the purchase savings plan. You can customize your view by selecting between the 1-year or 3-year savings plan, choosing the payment option (Upfront, Partial Upfront, or No Upfront from the dropdown), and filtering by the based on period (7 days, 30 days, or 60 day) from the dropdown).
  • Before Recommended Purchase: The current usage and costs before applying the savings plan.
  • After Recommended Purchase: The projected costs after applying the recommended savings plan.
  • Estimated Savings: The amount of savings you can expect after applying the recommended savings plan.
  • Additionally, under Recommendation Details, you’ll find:
  1. Total Commitment ($/hr): The total cost commitment per hour.
  2. Estimated Savings (%): The percentage of savings you will achieve with the plan.

To purchase the savings plans, click on “Purchase Savings Plan” as shown in the picture above. It will navigate you to the AWS Billing and Cost Management.

2. EC2 Instance Savings Plan
  • Estimated Savings: This shows the amount of money you will save each month and hour by using the savings plan.
  • Term: This is the commitment period for the savings plan. In this case, the user commits to using the savings plan for 3 years to benefit from discounted rates.
  • Payment: This indicates about the payment method for the savings plan.
  • Based on: The estimated savings are calculated based on data collected from the last 7 days of your compute usage.
  • Click on “View All” to access the purchase savings plan. You can customize your view by selecting between the 1-year or 3-year savings plan, choosing the payment option (Upfront, Partial Upfront, or No Upfront from the dropdown), and filtering by the based on period (7 days, 30 days, or 60 day) from the dropdown).
  • Before Recommended Purchase: The current usage and costs before applying the savings plan.
  • After Recommended Purchase: The projected costs after applying the recommended savings plan.
  • Estimated Savings: The amount of savings you can expect.
  • Additionally, under Recommendation Details, you’ll find:
  1. Total Commitment ($/hr): The total cost commitment per hour.
  2. Estimated Savings (%): The percentage of savings you will achieve with the plan.

To purchase the savings plans, click on “Purchase Savings Plan” as shown in the picture above. It will navigate you to the AWS Billing and Cost Management.

EC2 Coverage

EC2 Instance Cost Distribution section helps you by visualizing the cost distribution across different instance types and pricing models, users can identify areas for optimization and make informed decisions about your EC2 instance usage. The section breaks down the costs into EC2 Compute Cost and EC2 Processors, allowing you to analyze the contributions of different components to your overall spending.

1. Cost Distribution EC2 Compute

EC2 Compute Cost feature shows the total cost of EC2 instances and breaks down costs by pricing model (On-Demand, Spot, Reserved). This will help you identify cost-saving opportunities and reduce costs.

  • Total: This shows the total cost incurred by the EC2s present in the account over the specified time frame.
  • Spot:  This shows the cost incurred by the Spot instances in the account over the specified time frame.
  • On-Demand:  This shows the cost incurred by the On-Demand instances in the account over the specified time frame.
  • Reserved: This shows the cost incurred by the Reserved instances in the account over the specified time frame. The time periods include Last 7 days, Last 14 days, Last 1 month (selected), Last 3 months, Last 6 months, Last 1 year, MTD, and YTD.
  • Additionally, a stacked bar chart is provided to visually represent the cost distribution of EC2 instances, helping to identify which instances are contributing the most to the total cost.
2. Cost Distribution EC2 Processors
  • Total: This shows the total cost incurred by the EC2 processors present in the account over the specified time frame.
  • AMD:  This shows the cost incurred by the AMD processor  in the account over the specified time frame.
  • Graviton:  This shows the cost incurred by the Graviton processor in the account over the specified time frame.
  • Intel:  This shows the cost incurred by the Intel processor in the account over the specified time frame.
  • Additionally, a stacked bar chart is provided to visually represent the cost distribution of EC2 processors, helping to identify which instances are contributing the most to the total cost.

Cost Comparison

Cost Comparison section helps you with valuable insights into AWS spending across services, helping you track spending changes over time and identify services with significant cost increases. By offering a centralized view the feature allows you to monitor spending and detect anomalies by helping you improve cloud cost management and achieve your financial goals.

1. By Service

Cost comparison by service feature helps you track spending across AWS services, identify areas with rising costs, and find opportunities for cost optimization. This enables better financial control and informed decision-making.

  • Services used: This column shows the name of AWS service/tool over the specified time frame.
  • Column 2: This column shows the cost incurred by the AWS service/tool over the specified time frame here it is July(12-18).
  • Column 3: This column shows the cost incurred by the AWS service/tool over the specified time frame here it is July(19-25).
  • Change(%):  This column shows the cost difference for each service between the two time periods. It displays the absolute change in dollars, followed by the percentage change relative to the cost in the first period. The time periods include Weekly, Monthly, MTD and Custom range.

NOTE: Cost comparison will be available when at least 2 months of data is available.

Click on “View All” to see all the AWS services and their associated costs.

2. By Account 

Cost comparison by account feature helps you track spending across accounts, identify areas with rising costs, and find opportunities for cost optimization. This enables you for better financial control and informed decision-making.

  • Accounts: This column shows the account id.
  • Column 2: This column shows the cost incurred by the AWS account over the specified time frame here it is September(01-23).
  • Column 3: This column shows the cost incurred by the AWS account over the specified time frame here it is October(01-23).
  • Change(%):  This column shows the cost difference for each service between the two time periods. It displays the absolute change in dollars, followed by the percentage change relative to the cost in the first period. The time periods include Weekly, Monthly, MTD and Custom range.
  • Click on “View All” to see all the AWS accounts and their associated costs.

NOTE: Cost comparison will be available when at least 2 months of data is available.

Tag Explorer

Tag Explorer feature helps you gain insights into your AWS resource tagging practices, by identifying tagged and untagged resources. This will allow you to streamline cost management through the effective use of tags.

  • Total Resources: This shows the total number of resources associated with the account.
  • Tagged Resources: This shows the number of tagged resources along with the percentage.
  • Untagged Resources: This shows the number of untagged resources associated with the account.
  • Additionally a pie chart is used for visual representation of the Tagged and Untagged resources.
  • Click on “View All”, to view All/Tagged/Untagged resources and their Resource, Service Name, Tag Details, Tagged Status, and Cost.

You can also download the report in CSV format by, clicking on the “Download”

Resource Cost Distribution

Resource Cost Distribution helps you visualize your AWS spending by showing the cost split between tagged and untagged resources using pie charts and bar graphs. This feature improves resource management by providing better visibility, allowing you to categorize and track costs associated with different departments or projects.

  • Total Cost of Resources: This shows the total amount spent on AWS resources.
  • Cost Distribution by Tag Status: This shows the cost incurred by tagged and untagged resources.
  • Click on “View”, to view how costs are incurred by Cost Distribution Tag Keys/ Cost Distribution of Untagged Resources By Service can be viewed either by tag/service.

AWS Budget

AWS Budget feature helps you manage cloud costs effectively by allowing you to set custom budgets and track spending against them. It provides clear visualizations of spending patterns over time, helping you identify cost trends and detect anomalies. With this feature, you can pinpoint areas for cost reduction and make informed, data-driven decisions

  • Budget: This feature shows the budget set for the AWS service.
  • Spent: This shows the amount spent by the AWS service.
  • Spare: This shows the remaining budget.
  • To create a custom budget, Click on “Add Custom Budget”
  • Budget Name: A mandatory field where you enter the name of the budget you’re creating.
  • Service List: This dropdown allows you to select specific AWS services that you want to include in the budget. 
  • Budget Limit: A mandatory field where you set the maximum amount (in currency) that you want to allocate for the budget.
  • Granularity: This dropdown likely allows you to select the time period over which the budget applies, such as daily, monthly, or yearly.
  • Set Alerts: Here, you can configure notifications that will be sent out when certain thresholds of your budget are reached.

Analytics

Analytics section helps you gain valuable insights into your AWS spending by providing detailed cost distribution for Amazon Athena and AWS Glue. It enhances your ability to analyze spending patterns across different accounts through visual tools like pie charts, enabling you to spot cost-saving opportunities.

1. Amazon Athena Cost

Amazon Athena Cost feature helps you visualize your AWS Athena spending by showing the cost breakdown for account or usage types this enables you to make informed decisions to optimize resource allocation and reduce unnecessary spending.

  • The feature provides a visual representation representing the costs associated with AWS Athena. 
  • You can select based on Account/Usage type and different timeframes to view and analyze these costs.
  • The time frames include 1 month and month-to-date (MTD).
2. AWS Glue Cost

Amazon Glue Cost feature helps you visualize your AWS Glue spending by showing the cost breakdown for account or usage types this enables you to make informed decisions to optimize resource allocation and reduce unnecessary spending.

  • This feature provides a visual representation of the cost associated with AWS Glue service for a specific account.
  • You can select based on Account/ Usage type and different timeframes to view and analyze these costs. 
  • The time frames include 1 month and month-to-date (MTD).

Database

Database section helps you gain valuable insights into your Amazon Database Services. It visualizes the cost breakdown, showing how much spending is on various database services, providing a clear baseline for understanding your cost structure. This enables you to make informed decisions to optimize database service usage and enhance cost-efficiency.

1. Database Services Cost

Database Services Cost feature helps you understand how much each database service costs and the total spending incurred by all database services. This gives you clear insights into your overall database expenses and helps you manage and optimize costs more effectively.

This feature provides a visual representation of the total cost associated with database services like Amazon Relational Database Service (RDS) and Amazon ElastiCache.

2. Database Cost Trend

Database Cost Trend chart helps you analyze your database services spending by tracking daily. It allows you to identify fluctuations and detect anomalies, such as spikes or drops in spending, improving visibility into spending trends.

  • This feature provides a visual representation of the cost trends associated with database services and can view it daily by selecting 1M /month to date (MTD).
  • X-Axis (Dates): The horizontal axis represents dates within the month and each date corresponds to a daily measurement point.
  • Y-Axis (Cost in Dollars): The vertical axis represents cost values in dollars.

Compute

The compute section helps you get an overview of the cost incurred by Amazon EC2 instance by highlighting your spending across different accounts, analyzing daily cost trends, and daily cost breakdown by instance family. This insight enables you to optimize instance selection and configuration, ensuring you choose the right resources for your needs to improve performance while effectively reducing costs.

1. Spend on EC2 By Accounts

Spend on EC2 by accounts helps you identify which accounts are spending the most. By analyzing this data, you can prioritize which accounts to optimize, potentially leading to significant cost savings.

This feature visually represents spending related to Amazon Elastic Compute Cloud (EC2) by top five/ top 10 / top 15 AWS accounts.

2. Spend on Top 10 EC2 Instances By Accounts

Spend on Top 10 EC2 Instances accounts helps you identify which top 10 accounts are spending the most. By analyzing this data, you can prioritize which accounts to optimize, potentially leading to significant cost savings.

This feature visually represents top 10 spending related to Amazon Elastic Compute Cloud (EC2) by top five/ top 10 / top 15 AWS accounts.

3. EC2 Daily Cost By Instance Family

EC2 Daily Cost By Instance Family feature helps you view a clear and concise visualization of daily costs associated with different instance families, helping you identify patterns and fluctuations over time.

The feature visually represents the daily cost of different EC2 instance families and for each date, there are stacked bars showing the cost contribution from different instance families.

Storage

Storage section helps you identify spending patterns for Amazon S3 and EBS costs. This empowers you to enhance your cost management strategy regarding storage usage. By visualizing cost distributions and trends, you can optimize costs effectively.

1. Cost Division By S3 Storage Classes

Cost Division By S3 Storage Classes helps you visualize the breakdown of S3 costs across different storage classes, making it easy to identify which classes are driving the most costs.

This feature visually represents the costs associated with different Amazon S3 storage and the total spend on the S3 Storage classes, can view in top 5 / top 10 / top 15 AWS S3 storage classes.

2. Amazon S3 Cost Trend

Amazon S3 Cost Trend helps you visualize daily S3 storage costs across different storage classes, making it easy to identify fluctuations and trends over time.

This feature visually represents the daily cost trend associated with Amazon S3 (Simple Storage Service) and can be viewed based on “Accounts/Service” from the dropdown.

3. Amazon EBS Cost Trend 

This feature  provides insights into the cost trends associated with Amazon EBS over a specific time period and can be viewed based on “Accounts/Service” from the dropdown.

4. Cost Division By Usage Type (EBS)  

The feature provides insights into the cost distribution based on usage types for Amazon Elastic Block Store (EBS) and also total cost incurred.

Network & Content Delivery

Network section helps you visualize and analyze your Amazon network and content delivery costs effectively. It highlights network usage trends over time, tracks data transfer trends between regions,the filters for top accounts or cost categories allow you to focus on spot fluctuations or anomalies helping you prioritize regions for cost optimization.

1. Network Usage Trend

Network Usage Trend helps you track daily network activity over time, allowing you to identify usage fluctuations and patterns.

  • This feature provides a visual representation of network usage across different accounts over a specified time period and can be viewed based on “Accounts/Service” from the dropdown.
  • X-Axis (Horizontal Axis): Represents the date and each bar corresponds to a single day within this period.
  • Y-Axis (Vertical Axis): Represents the cost in dollars ($).
2. Data Transfer Trend (Inter Region)

Data Transfer Trend (Inter Region) helps you track data movement between regions over time, allowing you to spot fluctuations in transfer volume.

  • This feature provides a visual representation of network usage across different accounts over a specified time period and can be viewed based on “Accounts/Service/Region” from the dropdown.
  • X-Axis (Horizontal Axis): Represents the date and each bar corresponds to a single day within this period.
  • Y-Axis (Vertical Axis): Represents the cost in dollars ($).
3. Data Transfer Cost By Region

Data Transfer Cost By Region helps you compare the costs of data transfers across different regions, allowing you to quickly identify which regions have higher expenses.

  • This feature provides a visual representation of the cost incurred by data transfer by the region.
  • X-Axis (Horizontal Axis): Represents the cost associated with network usage in dollars ($).
  • Y-Axis (Vertical Axis): Represents the region.
4.  Data Transfer Trend (Global) 

Data Transfer Trend (Global) helps you track data transfer volume fluctuations on a global scale, making it easy to spot periods of high or low activity.

  • This feature provides a visual representation of the cost incurred by data transfer globally and can be viewed based on “Accounts/Usage type/Service/From Location/To Location” from the dropdown.
  • X-Axis (Horizontal Axis): Represents the date and each bar corresponds to a single day within this period.
  • Y-Axis (Vertical Axis): Represents the cost in dollars ($).

Cost Optimization

Cost Optimization section helps you identify potential savings by analyzing usage patterns and costs for Amazon EC2, unallocated Elastic IPs, and AWS Lambda. This analysis can indicate efficient resource allocation or a lack of unallocated IPs, and provide insights for better resource management and cost reduction.

1. EC2 Unallocated Elastic IP

This feature displays cost allocation data related to Elastic IP addresses in Amazon EC2 that are currently unallocated and can be viewed based on “Accounts/Region/Usage type” from the dropdown.

2. AWS Lambda

This feature displays cost allocation data related to AWS Lambda in Amazon EC2 that are currently unallocated and can be viewed based on “Accounts/Item type/Processor type” from the dropdown.

Management & Governance

The Management and Governance section helps you understand and monitor your AWS Config expenses effectively. By analyzing daily cost fluctuations, it allows you to easily identify periods of high and low spending.

  • This feature provides a visual representation of the cost trends related to AWS Config services and can be viewed based on “Accounts/Usage type” from the dropdown.
  • X-Axis (Dates): The horizontal axis represents specific dates and each date corresponds to a data point.
  • Y-Axis (Cost): The vertical axis represents cost values in dollars.

Generate Cost Report

Before generating a Cost Report, it’s helpful to clarify your specific reporting needs and understand the type of information available on the Cost Dashboard. Having a clear idea of what you’re looking to analyze such as monthly spending trends, service-specific costs, or projected end-of-month expenses ensures that the report aligns with your goals.

1. To download the Cost and Usage report, click on the button as shown in the picture.

2. Once clicked, the customized cost report dashboard appears. Here, you can select the accounts, timeframe, and region, as well as choose which features to include or exclude from the report. This allows you to tailor the cost report to your specific needs for a more detailed and accurate analysis.

Whenever you download or generate reports, all downloaded or generated reports automatically appear in Report History, providing a central location for easy access to past reports. This convenient feature ensures that all your past reports are easily accessible in one place, enabling you to track and reference them whenever needed.

Security Assessments

Tevico enables users to capture the security posture of their AWS infrastructure by running Security Assessments. There are two types of assessments supported by Tevico.

1. Standard Security Assessment

Tevico provides a consolidated Security Assessment report which gives an aggregated view of the findings by resource type, status, and severity. You can assess your AWS account security levels using the security score based on CIS AWS Foundations Benchmark v1.2.0 and AWS Foundational Security Best Practices v1.0.0. You will get actionable recommendations for security remediation.

2. Advanced Security Assessment

The Advanced Security Assessment generates the report across various security standards such as CIS-1.2, CIS-1.4, PCI-DSS, NIST, GDPR, SOC2 & 15, HIPAA, and other standards along with guidance for security posture enhancements.
Detailed risk analysis of the generated findings at individual service and resource levels is provided in the summary report for a better infrastructure remediation approach.

3. Technical Expertise Required

Utilizing the security dashboard effectively necessitates a solid understanding of security principles and compliance standards. You should be knowledgeable about interpreting security metrics, monitoring for threats, and implementing incident response protocols. Familiarity with the dashboard’s tools and features is crucial for maintaining optimal security posture. For those new to these concepts, we recommend reviewing relevant security documentation or consulting a security expert for guidance.

Enable Standard Security Assessment

1. Login to https://console.tevi.co

2. Click Dashboard on the navigation bar on the left. On the right side of the page, there are four tabs each for Cost, Security, Reliability & Inventory.

3. Click Security.

4. In the Assessments sub-feature, click Explore Reports.

5. Click Generate under Standard Security Assessment.

6. Select the Region from the drop-down list to run the Standard Security Assessment based on where the existing workload is. You can select one region at a time for a single Standard Security Assessment.

7. When the you click on Open AWS Config, you will receive details about the AWS pricing for the Config service and guidance on setting up a budget for it. You can either set up a budget by selecting Set Budget Now or proceed without setting up any budget.

8. Open a new tab and navigate to the AWS Management Console’s Setup AWS Config page. Keep the default settings unchanged and click Next to proceed to Step 2: Rules page.

9. There is no need to select any specific rule before clicking Next. The user will then be taken to Step 3: Review.

10. Click Confirm to enable AWS Config. The AWS Config Enabled status will now be visible on Tevico as well.

11. Click Generate Report. Tevico will initiate the standard security assessment in your account. This Standard Secuirty assessment typically takes less than 30minutes to complete, after which the data will begin to appear on the dashboard.

12. Once the scan is completed, the Standard Security Assessment dashboard will be displayed as shown below.

Standard Security Assessment

Standard Security Assessment section helps you view the security posture of your AWS account by providing a detailed overview of findings and security scores.With this information, you can enhance your security measures, address vulnerabilities, and maintain compliance, protect your AWS resources and data.

Overview

Overview section displays the AWS security score alongside a line chart that visualizes the score daily. By analyzing this information, you can better understand security trends and identify potential issues that may need attention.

1. AWS Security Score

Security score feature represents the proportion of passed controls across all of your enabled standards. The score is displayed as a percentage rounded up or down to the nearest whole number.

2. Score History

Score History feature displays a line chart of the AWS security score history on a daily basis. Data points represent daily scores, allowing for easy identification of high and low periods.

Findings Classified

The Findings Classified section helps you quickly identify security vulnerabilities in your system by categorizing them by severity or status or resource.  You can categorize by selecting one of the options listed below:
1. Severity
2. Status
3. Resources

1. Severity
  • All Findings feature helps you with a summary of all security findings, detailing the number of findings in each category, including Critical, High, Medium, Low, and Informational. It also presents the percentage contribution of each category.
  • Additionally, a warning message is displayed so that you can take an immediate action to protect your system.
  • List of Findings by Severity feature helps you by providing detailed information about each security finding. This includes the finding, resource ID associated with each finding, and the necessary remediation actions.
  • You can view the findings based on the category such as Critical, High, Medium, Low, and Informational.
  • Click on “View” to see the necessary information about the remediation.
2. Status

The pie chart helps you visualize the summary of all security findings, detailing the number of findings based on the status, including Failed, Not Available, Passed, and Warning. It also presents the percentage contribution of each status.

  • List of Findings by Status feature helps you by providing detailed information about each security finding. This includes the finding, resource ID associated with each finding, and the necessary remediation actions.
  • You can view the findings based on the status such as Failed, Not available, Passed, and Warning.
  • Click on “View” to see the necessary information about the remediation.
3. Resources

The bar chart helps you visualize the summary of all security findings based on the resources.

  • List of Findings by Resource feature helps you by providing detailed information about each security finding. 
  • Click on “View” to see the necessary information about the remediation.

Findings

Findings sections help you with a comprehensive overview of each finding, it enables you to assess the security posture effectively and prioritize necessary actions for resolution.

This feature helps you view all the findings along with their details, including the category, status, resource name, resource ID, last updated date, and remediation actions.

Enable Advanced Security Assessment

1. Login to https://console.tevi.co

2. Click on the Dashboard in the navigation bar on the left. On the right side of the page, there are four tabs each for Cost, Security, Reliability & Inventory.

3. Click on Security.

4. In the Assessments sub-feature, click Explore Reports.

5. Click the Generate button in Advanced Security Assessment.

6. The Advanced Security Assessment report will be available after the scan is completed, which typically takes less than 10minutes depending on the workload. However, if there are a large number of findings, the report may take longer to generate.

7. Once the scan is completed, the Advanced Security Assessment dashboard will be displayed as shown below.

Advanced Security Assessment

The Advanced Security Assessment feature provides a comprehensive view of the security posture. It details total checks and findings categorized by severity, which helps highlight trends and areas of concern. Each finding includes detailed information, such as descriptions, locations, and potential impacts, allowing organizations to understand the root causes of vulnerabilities.

Account Summary

Account Summary section displays the total checks and a stacked bar that visualizes the percentage of passed and failed. By analyzing this information, you can better understand security trends and identify potential issues that may need attention.

  • Total checks refer to the number of security checks performed based on the selected compliance standards in the prowler.
  • Total Findings refers to the total number of findings generated.
  • Findings By Status visually represents the percentage of passing and failing findings, while also displaying the number of findings that have passed and failed.
Security Posture Evolution

Security Posture Evolution feature helps you visualize the trends of passed and failed findings with the help of a line chart.

  • X-axis: The specific time intervals, intervals are based on the scans you performed.
  • Y-axis: Indicates the number of security findings on a scale from 0 to the maximum number of findings.
Comparative Analysis

Tevio offers you to compare your review and compare the results of previous scans, to see how they measure up!  This will help you to track improvements or regressions in your security posture over time by identifying recurring issues or new vulnerabilities, you can prioritize future security actions more effectively.

  • Click on “View” to compare and review the scans as depicted in the picture below.
  • After clicking on the “View”, it will take you to the Comparative analysis page.
  • Select reports from different dates to compare and gain insights.

Finding Details

The findings details section helps you quickly identify security vulnerabilities in your system by categorizing them by severity and by giving you a visual representation of regions. Additionally, a warning message is displayed so that you can take an immediate action.

Failed Findings by Severity
  • Failed Findings by Severity feature helps you with a summary of all security findings, detailing the number of findings in each category, including Critical, High, Medium, and Low. It also presents the percentage contribution of each category.
  • Click on “View” to see the detailed information about the findings which include Title, AWS Service, Resource ID, Status, Severity, and Remediation.
  • Clicking on “View ” will help you with the desired AWS  documentation for the remediation.

Compliance

Tevico provides 22 compliance standards to help you meet regulatory requirements such as ISO, HIPAA, and GDPR, covering security, privacy, and regulatory needs. You can easily generate a compliance report. The selected compliances will be listed under the compliance-based status feature. You can export the report, simply click on the export option and choose your preferred format—either PDF or Excel.

You can enhance your security posture by enabling compliance standards. By simply clicking on the “Enable” button, you can activate the relevant compliance standard, automatically generating findings corresponding to your specific compliance framework.

For a detailed view of any specific compliance, click on any mentioned compliance standard in the “Compliance column”.

1. PCI 3.2.1

PCI Security Standards are technical and operational requirements set by the PCI Security Standards Council (PCI SSC) to protect cardholder data. The standards apply to all entities that store, process, or transmit cardholder data – with requirements for software developers and manufacturers of applications and devices used in those transactions.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.
2. HIPAA

Health Insurance Portability and Accountability Act (HIPAA) sets the standard for sensitive patient data protection. Companies that deal with protected health information (PHI) must have physical, network, and process security measures in place and follow them to ensure HIPAA Compliance.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.
  • Additionally the feature also given an warning about the critical failed findings in your system.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.

Unique Compliance provided by Tevico

1. RBI

RBI compliance ensures financial institutions meet RBI’s stringent security and operational standards. It provides automated assessments and detailed reporting.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.
  • Additionally the feature also given an warning about the critical failed findings in your system.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.
2. SEBI

SEBI compliance helps financial institutions follow SEBI rules by automating checks and generating detailed reports.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.
  • Additionally the feature also given an warning about the critical failed findings in your system.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.
Compliance standards that Tevico does not support
  • ISO27001: ISO 27001 sets the framework for all organizations to establish, implement, operate, monitor, review, maintain and continually improve an ISMS (information security management system).
  • FIPS 140-2: FIPS (Federal Information Processing Standard) 140-2 is the benchmark for validating the effectiveness of cryptographic hardware.
  • FISMA: The Federal Information Security Modernization Act (FISMA) defines a framework of guidelines and security standards to protect government information and operations.
  • ITAR: ITAR rules regulate the export of defense articles and services, including technological products and services and technical data.
Failed Findings Count By Service

Failed Findings Count By Service helps you with a visual representation of the number of failed findings per AWS service over time. Each row represents a specific date based on your scans, while the columns display the total count of failed findings for different services, such as IAM, CloudFront, CloudWatch, Well-Architected, and S3.

Code Scan Analysis

Tevico supports scanning infrastructure as code (laC) files for misconfigurations that may lead to security or compliance problems.
This feature explains how to perform the security scan on your Infrastructure as Code (IaC) files using Checkov.

1. Install Checkov and follow the instructions by clicking on “here” to install Checkov on your system.

2. Clicking on “here” as shown above opens “Checkov Installation” dialog box that provides guidance on requirements and installations.”.

3. Generate the JSON Report and use Checkov to scan your IaC files and generate a JSON report and follow the instructions by clicking on “here”.

4. Clicking on “here,” as shown above, opens the “Configuration” dialog box, which offers guidance on configuring various IaC files.

5. Upload the Report and click on the Upload JSON File button. Select the JSON report generated in the previous step.

6. Enter the Report Title in the provided text box and Click on Submit to process the report and view your Infrastructure as Code (IaC) security posture.

7. After submission, your Infrastructure as Code (IaC) Security Posture Score will be displayed as a percentage, giving an overall assessment of the security posture.
8. The score is accompanied by a gauge chart, highlighting your security status.
9. You can also download the report as a PDF.
10. You can view the report history by clicking on this icon as shown in the picture below.

To conclude, submitting the report provides a percentage-based assessment of your Infrastructure as Code (IaC) security posture, accompanied by a gauge chart for a quick visual overview. The report history feature also allows you to track and compare past assessments for continuous security improvement.

Exploring Tevico Cluster Feature

Note: Technical Expertise Required

While this feature offers an interface, managing clusters effectively requires a foundational understanding of cloud infrastructure and system management. You should be familiar with managing EC2 instances, configuring automated jobs, monitoring performance metrics, setting up backup policies, and assigning user roles. For users unfamiliar with these concepts, we recommend consulting relevant AWS documentation or seeking assistance from a technical expert.

This feature helps you enhance cluster management by allowing you to add, monitor, and remove EC2 nodes, automate tasks through jobs, and continuously monitor performance with scanners. It simplifies data protection with backup policies making cluster management both effective and user-friendly.

1. Click Cluster on the navigation bar on the left from the menu on the left-hand side of the webpage.

2. Once you’ve clicked on your desired Cluster, you’ll be directed to the Cluster Detailed page and within the Cluster Detailed Page, you’ll find five features to explore:

  1. Node
  2. Job
  3. Scanner
  4. Backup
  5. Users

Node

  • This feature allows you to add multiple nodes and perform tasks on specific nodes. Each EC2 instance within the cluster is referred to as a node.
  • To add nodes, click on “Add Nodes”.
  • In the “Action” column, there are two actions available for each node:
  1. View: Clicking on this option allows you to view detailed information about the node.
  2. Remove: This option allows you to permanently remove the node from the cluster.
  • This page appears after clicking the view option for a node. At the top right corner, there are three options.

1. Metrics: This section shows the performance metrics of the instance, which includes Health, Reachability, OS, Region,  CPU (Percent),  Disk IO (Percent),  Memory (Percent),  Fullest of Disk (Percent), and  TestCluster.

2. Action Log: This section provides a log of actions performed on the instance, helping you to track any changes or operations executed on the node.

3. Details: This section provides detailed information about the instance, including its hardware specifications, software properties, and any associated AWS Tags.

Jobs

  • This feature allows you to manage and monitor jobs associated with the cluster. Each EC2 instance within the cluster is referred to as a node.
  • To add a job, click on “Add Job”.
  • After clicking on “Add Job”, you will see the following job types:

1. Auto Healing: This feature automatically triggers specific actions when predefined conditions for a particular service on an instance are met. For example, if the set condition is met, Tevico on behalf of the User will trigger the action on the EC2 instance.

2.Scheduled Jobs: These jobs run actions based on a set schedule, independent of any conditions. Users can configure these jobs to execute at regular intervals, such as daily, weekly, or yearly, or by using cron expressions for more desired scheduling. This is useful for routine maintenance tasks, health checks, and updates, that need to occur at consistent times.

3. Manual Job: Allows users to execute tasks manually whenever needed, without any predefined conditions or schedules. This provides flexibility for ad-hoc operations or troubleshooting, enabling users to perform specific actions on demand.

Scanners

  • This feature allows you to continuously monitor the cluster based on the conditions you have specified. It actively scans the metrics, including “Soft Condition”, “Threshold”, “After (Mins)”, and “Hard Condition”, to ensure the cluster maintains the desired performance and operational thresholds.
  • To add a scanner, click on “Add Scanner”.
  • The “Create Scanner” page is displayed, which includes a “Cluster Carepoint is here to help” box. This box guides the user on what information is required and how to fill in the necessary details for creating a new scanner.

Backup

  • This feature allows user to manage their backups and details about the backup which include “Name”, “Type”, “Last modified by”, “Status”, “Report”, “Log”, and “Action”.
  • To create a backup policy, click on “Add Backup Policy”
  • The “Create Backup Policy” page is displayed, which includes a “Cluster Carepoint is here to help” box. This box guides the user on what information is required and how to fill in the necessary details for creating a new backup policy.

Users

  • This feature enables collaboration by allowing you to manage and assign permissions to other users. You can designate roles such as “Cluster Admin”, “Node Admin”, or “Cluster Viewer”, ensuring that each user has the appropriate level of access and control according to their responsibilities.

Well-Architected Framework Review and Remediation

Tevico provides an end-to-end user experience for conducting a Well-Architected Framework Review and Remediation of your workload running in AWS cloud. The process is conducted in 3 phases.

1. Capture the application details:

Customer-Centric Approach: Tevico captures the details of application like architecture diagrams along with technology stack. By deeply understanding your business through Product-Market Synergy, Tevico documents your expectations from the application architecture considering the growth prospect. Tevico aims towards the workloads to be both technically robust and aligned with your specific needs.

2. Review Process:

Expert Guidance and Continuous Improvement: Tevico’s Well-Architected module harnesses AWS Solution Architects’ best practices to help design and operate secure, efficient, and cost-effective workloads. The review process supports continuous improvement, allowing the users to save milestones, track architectural changes, and keep the workloads aligned with the latest AWS standards.

3. Remediation:

Efficient Risk Assessment and Remediation: Tevico simplifies the review and remediation process by focusing on the intent behind each question, enhancing user engagement, and making the process more productive. This approach helps identify potential risks and outlines actionable steps for improvement, ensuring the workloads consistently meet AWS best practices.

Note: Technical Expertise Required

To effectively use Tevico’s Well-Architected Framework Review and Remediation feature, you should understand AWS architecture and core services. Familiarity with the five pillars of the AWS Well-Architected Framework will help you identify risks and propose solutions. If you’re new to these areas, consulting AWS documentation or an AWS Solutions Architect can help you fully leverage Tevico’s capabilities.

Create a Workload

1. Login to https://console.tevi.co

2. Go to the Well-Architected section shown in the navigation bar on the left.

3. Click on Create Workload and enter the necessary details such as

  • Workload Name
  • Description
  • Review Owner
  • AWS Region

4. Click Next to move to Step 2 of the workload creation phase.

5. In the Workload Creation phase, you can draw, upload, or add links to their Application/Infrastructure Architecture Diagram. Upon performing any of these actions click Next.

6. Tevico offers several blueprints using which the review can be done. Blueprints are a set of questions that are to be answered depending on the type of review that the user wishes to conduct. Eg. KYA- Know Your Architecture SSB- Startup Security Baseline WAFR- Well-Architected Framework Review

Select the appropriate blueprint and click Next.

7. Once the workload is created, click Next to place a request for assigning a Solutions Architect to the newly created workload.

8. When the Solutions Architect is assigned to the workload, the workload creation will be complete immediately.

Review a Workload

1. On the Workload Summary page, click Start Review.

2. Enter the necessary details for the Product Market Synergy:

i) Industry Type
ii) Problem Statement
iii) Solution Provided
iv) Traffic Pattern
v) Compliance Requirements
vi) Growth Forecast And Context

3. Click Save.

4. Enter the details related to the Technology Stack 

i) Web Application
ii) Mobile Application
iii) Backend Application
iv) Database(s)
v) Continuous Integration / Continuous Delivery (CI/CD) Pipelines
vi) Artificial Intelligence (AI) / Machine Learning (ML) Workloads
vii) Analytics Workloads

Providing these details will help the assigned Solutions Architect give better recommendations during the review.

5. Click Save.

6. You can ask any queries or add notes on the Queries & Notes page. These queries can be addressed during the review process. Once noted, click Save.

7. A list of all the Pillars under this blueprint will be visible.

i) Security
ii) Reliability
iii) Cost Optimization

8. Click Start Review for Security Pillar.

9. In the Security pillar, you have to answer the sets of questions according to AWS Best Practices implemented in their workload.

10. During this review phase, further details for your infrastructure can also be noted down by you or by the Solution Architect assigned such as

i) Observations
ii) Improvement Plans
iii) Reference Links

11. To submit the Review, you must answer required number of questions for all the pillars. Once done, click on Request Approval.

12. Click Submit Review. Once the request is submitted, a Solution Architect will accept your request.

Remediate HRIs and MRIs from a Workload

1. On the Workload summary page, click on Start Remediation to start the remediation process.

2. After clicking on Start Remediation for security, you will have to remediate the HRIs and MRIs that are generated.

3. Once the remediation is complete for all the pillars, click on Request Approval. Wait for the Solution Architect’s approval.

4. After the Solution Architect approves the remediation request, click Submit Remediation.

5. Well-Architected Framework remediation has now completed successfully.

6. The remediation report can be downloaded by choosing the Download Report.

USER ROLES AVAILABLE IN TEVICO

Tevico uses role-based access control to manage user permissions. Each role defines specific responsibilities, allowing you to delegate tasks securely and efficiently. The following are the user roles available in Tevico:

Root Admin

A first user identity in Tevico when a new account is created on the platform. This root user has all access to all the resources and modules in Tevico as per the plan.

Secondary Admin

Has visibility into users and resources in Tevico. The secondary admin can assist with the management of users and their access to the product.

Operations Admin

A user who manages the day to day operations of the Tevico account. He is expected to perform a broad range of basic administrative and support tasks.

Read-Only Admin

A read-only admin is an administrator without the permissions for modification.

Well-Architected Teammate

A user who gets full access of well-architected review module in Tevico. The user can create WAFR review workload and conduct a WAFR.

Library Developer

A user role created to collaborate by adding workflow automation scripts (actions and scanner plugins). These scripts can be shared with community if the user wishes to.

Library Viewer

A read-only access to all workflow automation scripts (actions and scanner plugins)

HOW TO INVITE A USER AND ASSIGN THEM A ROLE IN TEVICO

1. Login into your Tevico Root account and navigate to the Users page.

2. In the top-right corner of the Users page, click the “Invite User” button. 

3. A pop-up form will appear. In the provided field, enter the email ID of the user you want to invite.

4. From the dropdown menu, choose an appropriate role for the user. Be responsible for the permissions associated with each role. 

5. By default, Tevico automatically enforces MFA (Multi-Factor Authentication) for added security. Users will be prompted to set up their MFA when they first sign up or log in.

6. Click the “Save” button to finalize the invitation. A success notification will confirm that the user invitation was sent successfully.

7. The invited user will receive an invitation email to join the Tevico account. Once they accept the invitation, their status will be updated in the Users page.

Tevico Deboarding

If a user wants to unsubscribe from Tevico, the steps given below are to be followed.

  • Unsubscribe from AWS Marketplace.
  • Delete cross-account IAM role and other resources created by the platform during the onboarding process.
  • Close Tevico account.

Unsubscribe from AWS Marketplace

1. Log in to the same AWS Account from which the you have subscribed to Tevico. Navigate to AWS Marketplace from the AWS Management Console.

2. Search for Tevico in the Manage Subscriptions section and click Manage.

3. Click Cancel Subscription from the Actions drop-down.

4. You will receive a Subscription Cancellation email on the registered email ID.

5. Once the platform is done cleaning up resources created by Tevico in your AWS account, you will receive a final email indicating completion of Subscription Cancellation.

5. After completing the steps above, you have unsubscribed from the Tevico AWS Marketplace subscription.

Note: It takes 1 hour to unsubscribe from the AWS Marketplace, during which your resources will be deleted and billing will be settled completely.

Delete cross-account IAM role and other resources created by the platform during the onboarding process.

The resources created in the AWS account during onboarding need to be removed. To achieve this, the CloudFormation stack must be deleted.

Note: Before initiating the CloudFormation stack delete operation, ensure that the S3 buckets created for storing Security Assessment Reports and/or CUR data are ’empty’. Failure to do so will result in an error during S3 bucket deletion and CloudFormation stack deletion. If you prefer not to delete these S3 buckets, please tick the appropriate checkbox during the Delete Stack operation in the AWS Management Console

1. Log in to the same AWS Account and open S3.

2. Empty the respective S3 buckets.

3. Go to AWS CloudFormation. Select the Tevico stack and then click Delete.

4. Wait until the stacks transition to DELETE_COMPLETE without encountering any errors.

5. After the stack transition completes, the resources are successfully deleted.

Close Tevico Account

To close the Tevico account, follow the steps given below:

1. Login to https://console.tevi.co using your Tevico credentials.

2. Go to Account Settings and select Close Account from the sub-menu.

3. Request an OTP for the account closure activity from the Close Account subsection on the Account Settings page.

4. Enter the OTP received on your registered email and click Submit.

5. Your Tevico account is closed successfully.

Website/Social Media

To know more about Tevico, here are quick reference links:

Website Link: https://tevi.co

Contact Us: connect@tevi.co


Social Media: LinkedIn, X(Twitter)

Appendix

In the cross-account IAM role, Tevico requires the following permissions in your AWS account to capture insights and display them in the dashboard. Among the below permission sets, only Cross-Account Permission is mandatory for onboarding. EC2 Instance Account Permission and Workflow Automation Permission are required for enabling “Workflow Automation”.

 

{

    “Version”: “2012-10-17”,

    “Statement”: [

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudwatch:PutMetricAlarm”,

                “cloudwatch:SetAlarmState”,

                “cloudwatch:DeleteAlarms”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudWatchAlarmManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudwatch:PutMetricAlarm”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudWatchAlarmCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “events:PutRule”,

                “events:PutTargets”,

                “events:PutEvents”,

                “events:DeleteRule”,

                “events:RemoveTargets”,

                “events:DisableRule”,

                “events:EnableRule”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EventBridgeManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “events:PutRule”,

                “events:PutTargets”,

                “events:PutEvents”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EventBridgeCreate”

        },

        {

            “Action”: [

                “budgets:ModifyBudget”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “BudgetManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “budgets:createbudgetaction”,

                “budgets:deletebudgetaction”,

                “budgets:TagResource”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “BudgetCreate”

        },

        {

            “Action”: [

                “wellarchitected:*”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”

        },

        {

            “Action”: [

                “securityhub:BatchEnableStandards”,

                “securityhub:EnableSecurityHub”,

                “securityhub:UpdateSecurityHubConfiguration”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SecurityHubManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “access-analyzer:CreateAnalyzer”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “AccessAnalyzerCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “access-analyzer:DeleteAnalyzer”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “AccessAnalyzerDelete”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ssm:DeleteDocument”,

                “ssm:UpdateDocument”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SSMDocumentManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ssm:CreateDocument”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SSMDocumentCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “ec2:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ssm:SendCommand”

            ],

            “Resource”: [

                “arn:aws:ssm:*:*:document/*”,

                “arn:aws:ec2:*:*:instance/*”

            ],

            “Effect”: “Allow”,

            “Sid”: “SSMCommandExecution”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “sns:Subscribe”,

                “sns:Publish”,

                “sns:SetTopicAttributes”,

                “sns:DeleteTopic”,

                “sns:Unsubscribe”,

                “sns:AddPermission”,

                “sns:TagResource”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SNSManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “sns:CreateTopic”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SNSCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ec2:CopyImage”,

                “ec2:CopySnapshot”,

                “ec2:CreateImage”,

                “ec2:CreateTags”,

                “ec2:DeleteSnapshot”,

                “ec2:DeregisterImage”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EC2Management”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ec2:CreateImage”,

                “ec2:CopyImage”,

                “ec2:CopySnapshot”,

                “ec2:CreateTags”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EC2Create”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “iam:PassRole”,

                “iam:CreateServiceLinkedRole”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudtrail:CreateTrail”,

                “cloudtrail:AddTags”,

                “cloudtrail:CreateEventDataStore”,

                “cloudtrail:CreateChannel”,

                “cloudtrail:CreateServiceLinkedChannel”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudTrailCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudtrail:Start*”,

                “cloudtrail:Stop*”,

                “cloudtrail:Delete*”,

                “cloudtrail:PutResourcePolicy”,

                “cloudtrail:PutEventConfiguration”,

                “cloudtrail:CancelQuery”,

                “cloudtrail:UpdateChannel”,

                “cloudtrail:PutEventSelectors”,

                “cloudtrail:UpdateEventDataStore”,

                “cloudtrail:UpdateTrail”,

                “cloudtrail:GenerateQuery”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudTrailManage”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “lambda:InvokeFunction”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “LambdaInvocation”

        },

        {

            “Action”: [

                “cur:PutReportDefinition”,

                “cur:DeleteReportDefinition”,

                “cur:ModifyReportDefinition”,

                “cur:DescribeReportDefinitions”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CURManagement”

        },

        {

            “Action”: [

                “support:CreateCase”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “AWSSupportAccess”

        },

        {

            “Condition”: {

                “ForAnyValue:StringEquals”: {

                    “aws:TagKeys”: “Created By”

                }

            },

            “Action”: [

                “ec2:DeleteTags”,

                “sns:UntagResource”,

                “events:UntagResource”,

                “lambda:UntagResource”,

                “cloudwatch:UntagResource”,

                “s3:DeleteObjectTagging”

            ],

            “Resource”: “*”,

            “Effect”: “Deny”,

            “Sid”: “PreventTagRemoval”

        },

        {

            “Action”: [

                “sqs:ReceiveMessage”,

                “s3:GetObject”

            ],

            “Resource”: “*”,

            “Effect”: “Deny”,

            “Sid”: “ExplicitDenyWideReadonlyActions”

        }

    ]

}

Get started

Introduction

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras interdum accumsan sollicitudin. Nullam malesuada egestas quam, id sodales erat consequat ut. In id facilisis massa, nec pulvinar arcu. Aenean augue justo, gravida quis lectus at, lobortis ultrices felis. Integer tristique lorem sit amet risus gravida, at maximus magna facilisis. Aliquam eget dictum ex. Etiam sed nibh auctor, feugiat tortor quis, rutrum justo. Quisque dui ipsum, pellentesque tempor diam quis, posuere feugiat ligula. Nullam id urna convallis, pellentesque arcu id, cursus neque. Ut faucibus velit at orci interdum luctus. Duis pellentesque vestibulum sapien eget pulvinar. Quisque iaculis ex ac tincidunt tempor.

Get started

Introduction

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras interdum accumsan sollicitudin. Nullam malesuada egestas quam, id sodales erat consequat ut. In id facilisis massa, nec pulvinar arcu. Aenean augue justo, gravida quis lectus at, lobortis ultrices felis. Integer tristique lorem sit amet risus gravida, at maximus magna facilisis. Aliquam eget dictum ex. Etiam sed nibh auctor, feugiat tortor quis, rutrum justo. Quisque dui ipsum, pellentesque tempor diam quis, posuere feugiat ligula. Nullam id urna convallis, pellentesque arcu id, cursus neque. Ut faucibus velit at orci interdum luctus. Duis pellentesque vestibulum sapien eget pulvinar. Quisque iaculis ex ac tincidunt tempor.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras interdum accumsan sollicitudin. Nullam malesuada egestas quam, id sodales erat consequat ut. In id facilisis massa, nec pulvinar arcu. Aenean augue justo, gravida quis lectus at, lobortis ultrices felis. Integer tristique lorem sit amet risus gravida, at maximus magna facilisis. Aliquam eget dictum ex. Etiam sed nibh auctor, feugiat tortor quis, rutrum justo. Quisque dui ipsum, pellentesque tempor diam quis, posuere feugiat ligula. Nullam id urna convallis, pellentesque arcu id, cursus neque. Ut faucibus velit at orci interdum luctus. Duis pellentesque vestibulum sapien eget pulvinar. Quisque iaculis ex ac tincidunt tempor.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras interdum accumsan sollicitudin. Nullam malesuada egestas quam, id sodales erat consequat ut. In id facilisis massa, nec pulvinar arcu. Aenean augue justo, gravida quis lectus at, lobortis ultrices felis. Integer tristique lorem sit amet risus gravida, at maximus magna facilisis. Aliquam eget dictum ex. Etiam sed nibh auctor, feugiat tortor quis, rutrum justo. Quisque dui ipsum, pellentesque tempor diam quis, posuere feugiat ligula. Nullam id urna convallis, pellentesque arcu id, cursus neque. Ut faucibus velit at orci interdum luctus. Duis pellentesque vestibulum sapien eget pulvinar. Quisque iaculis ex ac tincidunt tempor.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras interdum accumsan sollicitudin. Nullam malesuada egestas quam, id sodales erat consequat ut. In id facilisis massa, nec pulvinar arcu. Aenean augue justo, gravida quis lectus at, lobortis ultrices felis. Integer tristique lorem sit amet risus gravida, at maximus magna facilisis. Aliquam eget dictum ex. Etiam sed nibh auctor, feugiat tortor quis, rutrum justo. Quisque dui ipsum, pellentesque tempor diam quis, posuere feugiat ligula. Nullam id urna convallis, pellentesque arcu id, cursus neque. Ut faucibus velit at orci interdum luctus. Duis pellentesque vestibulum sapien eget pulvinar. Quisque iaculis ex ac tincidunt tempor.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras interdum accumsan sollicitudin. Nullam malesuada egestas quam, id sodales erat consequat ut. In id facilisis massa, nec pulvinar arcu. Aenean augue justo, gravida quis lectus at, lobortis ultrices felis. Integer tristique lorem sit amet risus gravida, at maximus magna facilisis. Aliquam eget dictum ex. Etiam sed nibh auctor, feugiat tortor quis, rutrum justo. Quisque dui ipsum, pellentesque tempor diam quis, posuere feugiat ligula. Nullam id urna convallis, pellentesque arcu id, cursus neque. Ut faucibus velit at orci interdum luctus. Duis pellentesque vestibulum sapien eget pulvinar. Quisque iaculis ex ac tincidunt tempor.

Introduction

Tevico is a Cloud Governance and Monitoring tool designed to efficiently manage AWS cloud resources, with a focus on cost, security, reliability, and compliance. As a SaaS platform, Tevico provides organizations with centralized visibility and control over their AWS environments, enabling teams to onboard accounts, track expenditures, assess security posture, and maintain compliance, all from a single interface. In today’s cloud-driven infrastructure landscape, Tevico serves as a unified governance layer that bridges the gap between operational complexity and actionable insights, helping organizations enforce best practices, reduce unnecessary spend, and maintain a secure, well-architected AWS environment at scale.

This manual covers the complete setup and usage of Tevico, beginning with AWS Marketplace subscription and account onboarding, and extending through the configuration of core platform features. Tevico consolidates key cloud management workflows into a single platform by delivering cost visibility and right-sizing recommendations; providing security assessments and compliance reporting aligned with industry standards; offering audit logging for account activity tracking; supporting containerized workload management through the Cluster feature; and enabling Well-Architected Framework reviews to identify and address architectural gaps. Together, these capabilities allow teams to operate their AWS environments with greater efficiency, security, and governance.

User Manual Overview

This user manual for Tevico provides comprehensive guidance for onboarding your AWS account onto the platform. It outlines the prerequisites for onboarding and offers step-by-step instructions for utilizing key features such as Cost Dashboard, Security Assessments, Cluster and Well-Architected Framework Review.

Product Features

This user manual explains how to upgrade subscription plans. Currently, Tevico offers the following plans:

  • Collaborator Plan
  • Basic Plan
  • Premium Plan

Key Features

By the end of this guide, users will be able to:

  • Onboard their AWS account onto Tevico.
  • Upgrade their account to the Premium plan.
  • Monitor and optimize your AWS expenditures with the Cost Dashboard.
  • Identify, analyze, and remediate security findings using Tevico’s Security Assessment.
  • Generate detailed security reports that are compliant with various standards.
  • Take advantage of the Cluster Feature to manage and secure workloads.
  • Create a Well-Architected Framework workload, review it against industry best practices, and address identified gaps.
  • Be aware and take advantage of the multi-account linking process.
  • Utilize the Audit Logs feature to track and review account activities.

Prerequisites

1. To begin using Tevico as a cloud management platform, we utilize a Cross-Account IAM role, and we provision all necessary resources for this access using a CloudFormation Template provided by the platform upon subscription.

You need to create the following access permissions to set up the necessary resources in your AWS account and grant Tevico the required permissions:

 

{
    “Version”: “2012-10-17”,
    “Statement”: [
        {
            “Sid”: “FullAccess”,
            “Effect”: “Allow”,
            “Action”: [

                “aws-marketplace:Subscribe”,

                “aws-marketplace:ViewSubscriptions”,

                “aws-marketplace:Unsubscribe”,

                “config:*”,

                “cloudformation:CreateStack”,

                “cloudformation:UpdateStack”,

                “cloudformation:DeleteStack”,

                “cloudformation:CreateChangeSet”,

                “cloudformation:ContinueUpdateRollback”,

                “cloudformation:DeleteChangeSet”,

                “cloudformation:DescribeChangeSet”,

                “cloudformation:DescribeStacks”,

                “cloudformation:DescribeStackEvents”,

                “cloudformation:ListChangeSets”,

                “cloudformation:DetectStackDrift”,

                “cloudformation:DescribeStackDriftDetectionStatus”,

                “cloudformation:DescribeStackResourceDrifts”,

                “cloudformation:ListStackInstanceResourceDrifts”,

                “cloudformation:GetTemplateSummary”,

                “cloudformation:ListStacks”,

                “cloudformation:ListStackResources”,

                “cloudformation:ListStackSets”,

                “cloudformation:ListTypes”,

                “cloudformation:ListTypeVersions”,

                “cur:DescribeReportDefinitions”,

                “cur:PutReportDefinition”,

                “cur:ModifyReportDefinition”,

                “cur:GetClassicReport”,

                “cur:GetUsageReport”,

                “cur:DeleteReportDefinition”,

                “iam:CreateRole”,

                “iam:CreateInstanceProfile”,

                “iam:CreateServiceLinkedRole”,

                “iam:CreatePolicy”,

                “iam:CreatePolicyVersion”,

                “iam:PutRolePolicy”,

                “iam:UpdateRole”,

                “iam:AttachRolePolicy”,

                “iam:DetachRolePolicy”,

                “iam:GetRole”,

                “iam:ListRoles”,

                “iam:PassRole”,

                “iam:GetPolicy”,

                “iam:ListPolicyVersions”,

                “iam:DeleteRole”,

                “iam:DeleteRolePolicy”,

                “iam:DeletePolicyVersion”,

                “iam:AddRoleToInstanceProfile”,

                “iam:RemoveRoleFromInstanceProfile”,

                “iam:GetInstanceProfile”,

                “iam:DeleteInstanceProfile”,

                “lambda:CreateFunction”,

                “lambda:ListFunctions”,

                “lambda:GetFunction”,

                “lambda:InvokeFunction”,

                “lambda:ListVersionsByFunction”,

                “lambda:PublishVersion”,

                “lambda:UpdateFunctionCode”,

                “lambda:DeleteFunction”,

                “license-manager:ListReceivedLicenses”,

                “sns:ListTopics”,

                “s3:ListBucket”,

                “s3:CreateBucket”,

                “s3:PutBucketPolicy”,

                “s3:GetBucketPolicy”,

                “s3:DeleteBucketPolicy”,

                “s3:GetBucketAcl”,

                “s3:GetBucketLocation”,

                “s3:PutBucketOwnershipControls”,

                “s3:DeleteBucket”,

                “s3:GetObject”,

                “s3:PutObject”
            ],
            “Resource”: [“*”]
        }
    ]
}

 

2. During the onboarding process, before creating a stack with the CloudFormation template, you must enter a valid email address to receive an activation link.

3. To generate security assessment reports, you must enable Security Hub and ensure resource recording in AWS Config on your AWS account.

4. To enable notifications for GuardDuty, Billing etc you need to either have a slack webhook preconfigured and/or a Jira Service Desk in place.

5. To get consolidated findings for cost, security & inventory, you need to onboard your organization account.

Access Management and Security Controls

Overview

The functionality of Tevico is supported through IAM roles and policies that have been defined with strict adherence to the principle of least privilege. Permissions have been scoped narrowly and assigned to AWS services such as EC2 and Lambda. Each permission has been properly tagged to ensure that the tool does not interact with any resource/s that is/are not created by Tevico or the tool does not have access to. Access control mechanisms, S3 bucket & policies, and justification for granted permissions have been implemented to ensure security. Only the permissions required for the intended functionality have been granted, thereby reducing risk while enabling necessary platform features.

All the data that is used for creating dashboard is stored in the user’s AWS account in respective buckets.

Access Management Strategy

Access is governed using least privilege principles, with IAM roles configured to allow only required actions. Permissions are tightly scoped, and sensitive resources are protected through enforced conditions, external ID constraints, and resource-level limitations.

Cross-account access is facilitated using trusted relationships constrained by policy and verified identifiers. Internal service interactions are enabled through controlled roles assigned with minimal privileges. S3 buckets involved in Tevico’s operation are secured through encryption, strict access policies, and version control.

By this approach, a secure, auditable, and compliant environment is maintained according to AWS best practices and enterprise standards.

IAM Roles

1. TevicoSsmRole

Purpose: Manages AWS Systems Manager (SSM) operations for EC2 instances
– Assumed By: EC2 and SSM services
– AWS Managed Policies Attached:

  • AmazonEC2RoleforSSM
  • AmazonSSMManagedInstanceCore

– Custom Policy Permissions:

  • CloudWatch metrics management
  • SNS operations for notifications

Justification: Required for automated instance management and monitoring

2. Custom Policy Permissions

Purpose: Enables cross-account access for Tevico to read metadata from accounts managed by Tevico
– Assumed By: Trusted Account (with External ID requirement)
– AWS Managed Policies Attached:

  • ReadOnlyAccess

– Custom Policy Permissions:

  • CloudWatch alarm management
  • EventBridge rules management
  • Well-Architected Framework access
  • Security Hub enablement
  • Access Analyzer management
  • SSM document management
  • SNS topic management
  • Limited EC2 operations
  • CUR report management

Justification: Required for cost optimization, security assessment, well-architected framework review, and resource management.

3. TevicoNotificationLambdaRole

Purpose: Enables Lambda function to send notifications to Tevico
– Assumed By: AWS Lambda service
– Custom Policy Permissions:

  • CloudWatch Logs management
  • CloudFormation stack description

Justification: Required for operational monitoring and CloudFormation stack management

S3 Bucket & Policies

1. CUR Bucket & Associated Policies

This bucket is created in the user’s account for storing data generated by Cost & Usage Report

Purpose: Attaching required AWS Cost and Usage Report policies to the S3 bucket in user’s AWS account.
– Permissions:

  • Allows bcm-data-exports.amazonaws.com to put objects
  • Allows a trusted account to read objects

– Security Controls:

  • Enforces SSL/TLS
  • Restricts public access
2. Utility Bucket & Policies

This bucket is created in the user’s account for storing metadata used for Security and Inventory dashboards

Purpose: Attaching required policies to the S3 bucket for storing metadata securely in user’s AWS account.
– Permissions:

  • Allows Tevico engine with CFNTevicoAssumeRole to put objects
  • Allows a trusted account to read objects

– Security Controls:

  • Enforces SSL/TLS
  • Blocks public access
  • Enforces bucket owner control

Least Privilege Implementation

Security Controls
  • External ID Requirement: Enforced for cross-account roles to add an extra layer of security
  • Conditional Access: S3 access requires SSL/TLS; Lambda assumes role only from the verified source account
  • Resource-Level Restrictions: Permissions are scoped to specific buckets and resources along with Tag Conditions applied wherever feasible
Write Permissions Justification
  • CloudWatch & EventBridge: Necessary for monitoring setup and cost optimization triggers
  • Security Services: Required to enable/configure security assessments and maintain compliance
  • S3 Operations: Scoped to designated buckets for storing assessment data and reports only
Best Practices Implementation
  • Resource Tagging: All resources are tagged with ‘created By:Tevico’
  • Version Control: Versioning is enabled on all S3 buckets; lifecycle policies manage older versions
  • Access Control: Public access blocked on all S3 buckets; SSL/TLS enforced for secure data transfer; Bucket owner enforced for data integrity

Tevico Onboarding

Subscribe to Tevico from the AWS Marketplace

1.  Login into the AWS management console and navigate to AWS Marketplace

2. In the AWS Marketplace, click on “Discover products” and search “Tevico” in the search bar.

3. Select the product Tevico, and click “View purchase options” to get the price details.

4. In “Available offers”, you can find the “Public” and “Free trial” offers.

5. Click on “Subscribe” to complete the purchase.

6. Click on the “Set up your Account” button on the top right of the page. It will take the user to Tevico’s sign-up process defined in detail in the Sign up on Tevico section given below.

Note: For financial management, onboarding a management or organization account provides centralized management, eliminating the need for separate onboarding for each sub-account or child account. However, if you want to use features like the Well-Architected Framework or workload automation across accounts (whether part of the same organization or not), each account must be onboarded individually.

Sign up on Tevico

Please follow the steps below to complete the onboarding process.

1. After clicking “Set up your account” in the previous step, you will be directed to the “Let’s get you Onboarded” page.

2. On the “Let’s get you Onboarded” page, sign up using Google or enter a valid name, email id and proceed to “I accept the Terms and Conditions” and click on  “Create Account”.

3. Click Launch Stack.

Note: To monitor the resources that will be or have already been created in your AWS account while onboarding through Tevico, Click on “here” to access the CloudTrail page in a new browser tab. This allows you to review logs and activities without disrupting your ongoing workflow.

4. A new tab or window will open, taking you to the AWS CloudFormation Stack creation page. Keep the pre-populated values as they are, and check the boxes related to IAM capabilities to allow the stack to create IAM resources.

5. Wait until the status for both the stacks changes from ‘CREATE_IN_PROGRESS’ to ‘CREATE_COMPLETE’.

6. Tevico will automatically fetch the Role ARN and populate the correct value in the placeholder text box. Once it is fetched, click “Continue” to proceed.

7. After clicking the “Continue” button, you will receive an email. In the email, click on the “Complete” button to finalize the setup.

8. The above link will take you to the “Complete Account Setup”. The email address you previously entered will automatically appear in the Email ID text box, create the password (according to the password requirements mentioned), and click “Setup”.

9. After clicking on “Setup”, you will be redirected to the “Sign into your account” page. Enter your credentials, then click Sign in to proceed.

10. The sign-up created on Tevico is in the Basic Plan. To access advanced features offered by the Premium Plan, you need to upgrade to the Premium subscription plan.

Upgrading to the Premium Plan

Follow the steps given below to upgrade your Tevico account to the Premium plan:

1. Log in to https://console.tevi.co using your valid credentials. Click on the Tevico Account ID on the top right corner after logging in.

2. Go to the Account Settings page from the options given in the sidebar.

3. Click on “Plan” from the sub-sections as shown below.

4. Scroll down and click the on “Upgrade Plan” button under the Premium plan.

5. And click on “Change Plan” to use the premium plan features.

6. Refresh the screen to view the Premium tag under your Tevico Account ID to ensure that premium plan features are activated successfully.

Accessing Audit Logs

Audit logs provide a clear record of who made the changes when those changes occurred, and what actions were taken. This helps you to monitor and verify that only authorized individuals are making changes reducing the risk of unauthorized actions.

1. Login to https://console.tevi.co

2. Click on the Show Audit Log icon, as depicted in the image provided below.

3. This will display the audit logs, allowing you to review the detailed history of actions and activities within your Tevico account.

4. Tevico allows you to view audit logs based on the specific section you’re in. For example, if you’re in the “Dashboard” or “Well-Architected” or “Cluster” section and want to see the logs for actions performed in that particular section you can switch between viewing logs specific to that section or account. This helps you track actions performed in different sections, giving you more flexibility in reviewing activities.

Note:
To ensure comprehensive monitoring and auditability, we maintain a log retention policy where all logs are preserved for 180 days. This retention period allows you to effectively track and analyze historical data, aiding in security analysis, and compliance requirements.

Multi-Account Management

Overview

Tevico simplifies multi-account management on AWS by integrating directly with AWS Organizations. It discovers all member accounts automatically and provides a unified dashboard to monitor security posture and track cloud costs across the entire organization.

With seamless onboarding and account linking, teams can securely manage accounts, enforce governance, and gain visibility into both operational and financial performance.

Account Management Process

1. Organization Account Onboarding
  • Onboarding begins via AWS Marketplace.
  • Once connected, Tevico automatically discovers all member accounts in the AWS Organization.
  • A dedicated organization dashboard is available to manage and track all linked accounts, along with the list of accounts that are not linked or onboarded.
2. Member Account Integration/Linking Your Accounts
a. Member Account Subscription
  • Each member account must be onboarded to Tevico through AWS Marketplace.
  • This ensures compliance with AWS billing and subscription policies.
b. Account Linking
  • Once onboarded, member accounts can be linked to the organization account via the Tevico interface.
  • Once the member account is onboarded, then the account has to be linked.
  • Login to the organization account.
  • At the “Home” page, you’ll see the “View Organization” link.
  • Click on “View Organization” and you’ll be redirected to the Organization dashboard.
  • Search for the onboarded member account.
  • Click on the action button(three dots) and click on “Link”.

Linking enables:

  • Aggregated AWS budget monitoring.
  • Consolidated findings for Security where you can track security posture for all the accounts.
  • Centralized dashboard for inventory to track all the resources present in your accounts.
3. Monitoring Capabilities
Without Account Linking
  • View cost data across the organization using Cost and Usage Reports (CUR).
  • Track costs per account.
  • Basic account discovery and inventory listing.
With Account Linking
  • Monitor rolled-up budget information.
  • Access detailed operational data across accounts through a unified dashboard.
  • Get access to a centralized dashboard for monitoring the security posture of your linked accounts.
  • Track all the resources that are present within your organization with the Inventory dashboard.
Key Features
  • Automated discovery of all member accounts within an AWS Organization.
  • Option to link accounts for unified visibility.
  • Centralized interface for managing organization-wide cloud operations.
  • Secure IAM-based cross-account access.
  • Integrated CUR-based cost tracking and analysis.
  • Improved security posture visibility across all linked accounts.
Security and Compliance
  • Secure cross-account IAM role assumption with enforced policies.
  • Operations adhere to least-privilege access models.
  • Fully aligned with AWS Marketplace and AWS Organizations compliance requirements.
  • Maintains strict security control at both the member and organization levels.

Cost Dashboard

Tevico’s cost dashboard is a central hub designed to help you monitor, analyze, and optimize your AWS costs. It offers a detailed breakdown of your AWS spending across different services and resources, helping you make informed decisions to reduce unnecessary expenditures. The dashboard is structured into multiple sections, enabling you to identify excess spending, allocate budgets effectively, and implement cost-saving strategies.

Alignment to account structures

Aligning cost management with account structures gives you better visibility and control over spending by grouping costs based on departments, projects, or environments (e.g., production vs. development). This simplifies cost allocation, ensuring each team is accountable for its own expenses, which aids in budgeting and financial reporting.

Tevico supports the onboarding of organizational accounts and allows for the integration of multiple child accounts i.e. within the main organizational account, you can integrate multiple child accounts. A dropdown menu is available for both the accounts and regions to select and switch between different AWS accounts or regions.

Cost Summary

Cost Summary section provides you with high-level insights into the account consumption, services used, and regions or accounts that contribute to the highest costs. You can monitor the regions, services, or accounts driving their costs and track trends over time.

1. Account Consumption

Account Consumption feature helps you compare costs with the previous month, anticipate your total monthly consumption, and identify potential cost fluctuations early, enhancing overall financial management.

  • Month-To-Date Balance: This shows the current amortized “month-to-date” balance. Amortized means reflecting the effective cost of the upfront and monthly fees spread across the billing period.
  • Last Month: The amount spent last month.
  • Forecast: This shows the account consumption for the current month and estimates that the account consumption for this month is anticipated to be less/more than what was consumed last month.
2. Services Used

Services used feature helps you to track the number of AWS services used over time, making it easier for you to identify services that were either added or discontinued, enabling better resource management and optimization. Highlighting the top spending service, helping you manage expenses more effectively.

  • Last Month: This shows the number of services used in the last month.
  • This Month: This shows the number of services used in the current month.
  • Top Spending Service: This shows the top spent AWS service in the current month.
  • Click on “View All” to view all the “Total Services Used”.This will provide detailed information about the services utilized last month but not in the current month.
  • This Month: This shows the number of services used in the current month.
  • Last Month: This shows the number of services used in the previous month.
  • Services Used: This shows the name of the AWS Service/tool.
  • Accounts Count: This shows the number of accounts used by AWS Service/tool.
  • Last Month: This shows whether the AWS Service/tool was used () or not () in the previous month.
  • Current Month: This shows whether the AWS Service/tool was used () or not () in the current month.
3. Accounts Used

Accounts used feature helps you to track the number of AWS accounts used over time making it easier for you to identify accounts that were either added or discontinued. Highlighting the top spending account, helping you manage expenses more effectively.

  • Last Month: This shows the number of accounts used in the last month.
  • This Month: This shows the number of accounts used in the current month.
  • Top Spending Service: This shows the top spent account including the amount spent in the current month.
4. By Region – Top five cost-incurring regions

By Region feature allows you to monitor cloud spending across various AWS regions. You can quickly identify which region is being consumed most. By highlighting the region with the maximum spending and providing detailed insights into specific regional expenditures, you can optimize costs more effectively.

  • This feature shows a graphical representation of the top 5 regions and the amount each region spent. By selecting one of the options, you can view spending for the previous month and also for the Month-to-date.
  • Region with the maximum spend: This shows the region with the maximum spend and the amount spent.
  • Click on “View All” to view detailed information on spending by each region. By selecting one of the options, you can view spending for the previous month or Month-to-date.
5. By Service – Top five cost-incurring services

By Service feature allows you to monitor cloud spending across various AWS services. You can quickly identify which service is being consumed most. By highlighting the top five services with the maximum spending and providing detailed insights into specific service expenditures, you can optimize costs more effectively.

  • This feature displays an overview of costs incurred by the top 5 AWS services in the workload and by selecting one of the options, you can view spending for the previous month or Month-to-date.
  • Service: This column shows the name of the service.
  • Cost: This column shows the cost incurred for each service.

Click on “View All”, to view a detailed breakdown of all AWS services and their associated cost.

6. By Accounts – Top five cost-incurring accounts

By Accounts feature allows you to monitor spending across various AWS accounts. You can quickly identify which account is being consumed most. By highlighting the top five accounts with the maximum spending and providing detailed insights into specific account expenditures, you can optimize costs more effectively.

  • This feature shows a bar chart that displays an overview of costs incurred by the top 5 AWS accounts in the workload. By selecting one of the options, you can view spending for the previous month or Month-to-date.
  • Click on “View All”, to view a detailed breakdown of all AWS accounts and their associated cost.
7. Invoice Trend – Get the newest insights on invoice trends within a timeframe

Invoice Trend feature helps you with a detailed breakdown of their invoice spending over time. By visualizing trends, you can identify any significant increases or decreases in spending This enables businesses to make informed decisions regarding resource allocation, and budget planning.

  • This feature shows a graphical representation of the “Invoice Trend” over the last three months using both a bar graph and a line graph.
  • Invoice Trend: This highlights the percentage change in invoice amounts between consecutive months.
  • Click on “View All”, to view a detailed breakdown of all AWS accounts and their associated spending.
  • You can view the information for 3 months or 6 months or 1 Year.

Cost Analysis

Cost analysis section helps you to gain a comprehensive understanding of your spending patterns, identify opportunities for cost reduction, and make data-driven decisions to optimize your resource usage and minimize expenses.

1. Total Usage Graph

Total Usage Graph feature helps you easily identify trends, compare usage across different time periods, detect anomalies, and make informed decisions. By understanding your account or service consumption patterns you can optimize their resource utilization, reduce costs, and effectively manage their cloud resources.

  • Total Usage Graph: This feature shows a graphical representation of the AWS services spent over a time period. The costs are broken down by top five/ top 10 / top 15 AWS services/accounts.
  • The time periods include 1 week (1W), 2 weeks (2W), 1 month (1M), 3 months (3M), 6 months (6M), 1 year (1Y), month to date (MTD), and year to date (YTD) and also can select “Custom date range”.
  • The graph is set to show spending by service or per account.
2. Daily Cost Trend

Daily Cost Trend graph helps you with a detailed view of their daily spending on cloud resources. This graph allows you to easily identify fluctuations in daily costs and you can optimize your resource utilization, reduce costs, and effectively manage your cloud resources.

  • This feature shows a graphical representation of daily cost trends.
  • The time periods include 1 week (1W), 2 weeks (2W), 1 month (1M), 3 months (3M), 6 months (6M), 1 year (1Y), month to date (MTD), and year to date (YTD) and also can select “Custom date range”.

Resource Right Sizing

Resource right sizing section helps you to optimize cloud resource allocation, reduce costs, improve performance, and avoid performance issues. By analyzing resource usage and providing recommendations for EC2, EBS, RDS, and reserved instances will help you significantly reduce your cloud spending while maintaining and improving application performance.

1. EC2 Compute Optimization

EC2 Compute Optimization feature helps you by identifying over-provisioned and under-provisioned instances, you can optimize costs, improve resource utilization, and make informed decisions about your EC2 instance usage.

  • Total: This shows the total number of Elastic computes present in the account.
  • Over Provisioned: This shows the number of EC2s that are over-provisioned.
  • Under Provisioned: This shows the number of EC2s that are under-provisioned.
  • Optimized: This shows the number of EC2s that are optimized.
  • Additionally, a stacked bar chart is provided to visually represent EC2 Compute Optimization.
  • Click on “View All”, to view all EC2 Right-Sizing Recommendations and you can also export the data in CSV/Excel by clicking on “Export”. 
2. EBS Volumes Optimization

EBS Volumes Optimization helps you with valuable insights into your EBS volume usage. By assessing volume utilization and identifying optimization opportunities, you can make informed decisions about your volume allocation and improve resource utilization.

  • Total Volumes: This shows the total number of EBS Volumes present in the account.
  • Attached:  This shows the number of EBS volumes attached to the EC2s.
  • Unattached:  This shows the number of EBS volumes unattached to the EC2s.
  • Additionally, a stacked bar chart is provided to visually represent the EBS optimization status.
3. EBS Operations Cost

EBS Operations Cost section helps you with valuable insights into your EBS operation costs. By visualizing daily, weekly, monthly, and yearly spending trends, you can identify cost-consuming EBS operations, analyze spending patterns, and make informed decisions to optimize your EBS volume usage.

  • This feature shows a graphical representation (bar graph) to represent the EBS (Elastic Block Store) operations costs over a week, highlighting the most and least cost-consuming operations.
  • Each bar represents the total cost of these operations for each day, with the height of each color segment showing the respective operation’s cost contribution.
  • The time periods include 1 week (1W), 2 weeks (2W), 1 month (1M), 3 months (3M), 6 months (6M), 1 year (1Y), month to date (MTD), and year to date (YTD).
4. Top 5 Cost consuming EBS Volumes

Top 5 Cost consuming EBS Volumes feature allows you to monitor spending across your AWS accounts. You can quickly identify which EBS operation is being consumed most and by focusing on the top 5 cost-consuming EBS volumes you can optimize costs more effectively.

  • This feature shows the top 5 cost-consuming EBS volumes with their Volume ID, Type, Encryption Status, EC2 Instance, Recommendation Status, and Cost.
  • Click on “View All”, to view all the EBS Volumes and their Volume ID, Type, Encryption Status, EC2 Instance, Recommendation Status, and Cost.
5. Recommendation for ECS Services on Fargate

Recommendations for ECS Services on Fargate help you to reduce costs and provide valuable insights into the efficiency of your Amazon Elastic Container Service (ECS) services running on Fargate. The feature highlights ECS services that can be optimized and empowers you to make informed decisions about your ECS service configuration.

  • This feature gives recommendations for optimizing ECS (Elastic Container Service) services running on AWS Fargate.
  1. Optimized: This displays the number of ECS services that are optimized.
  2. Under Provisioned: This displays the number of ECS services that are under-provisioned.
  3. Over Provisioned: This displays the number of ECS services that are over-provisioned.
  4. Max. Estimated Savings ($0): This displays the cost savings that could be achieved by optimizing the services, based on the recommendations provided.
  5. Additionally, the feature shows the Top 5 ECS Services based on monthly savings, along with each ECS service’s ARN, maximum estimated savings, current CPU and memory allocation, and recommendations for resizing based on usage. Actions such as resizing or adjusting settings can be taken if recommendations are available.
  6. Click on “View All” to view all the recommendations which include details about Service Arn, Maximum Estimated Savings, Current CPU Size, Current Memory Size.
6. RDS Cost Recommendation

RDS Cost Recommendations feature helps you to highlight the number of optimized, under-provisioned, and over-provisioned instances, as well as the top 5 RDS instances based on the cost savings by following the recommendations, you can significantly reduce the RDS costs while ensuring the databases are running efficiently.

This feature gives recommendations for optimizing RDS (Relational Database Services) and allows filtering the spending by instance or storage.

  • Optimized: This displays the number of RDS services that are optimized.
  • Under Provisioned: This displays the number of RDS services that are under-provisioned.
  • Over Provisioned: This displays the number of RDS services that are over-provisioned.
  • Max. Estimated Savings ($0): This displays the cost savings that could be achieved by optimizing the services, based on the recommendations provided.
  • Additionally, the feature shows the top 5 RDS instances by estimated savings, along with each RDS service’s ARN, maximum estimated savings, current CPU and memory allocation, and recommendations for resizing based on usage. Actions such as resizing or adjusting settings can be taken if recommendations are available.
  • Click on “View All” to view all the RDS recommendations which include details about Resource Arn, Last Updated,  Recommendations Count,  Maximum Estimated Savings, and Action.
7. Reserved Instances Recommendation

Reserved Instances Recommendation feature helps you to optimize AWS Instances costs and gain the flexibility to adapt to changing requirements by exchanging instances for different configurations, ensuring optimal cost-efficiency and flexibility.

This feature provides insights into optimizing your AWS costs by purchasing Reserved Instances (RIs) for your EC2 (Elastic Compute Cloud) resources, Relational Database Service (RDS), and DynamoDB.

  • Service: This dropdown allows you to choose the following options to analyze and optimize your Reserved Instances.
  1. Elastic Compute Cloud (EC2).
  2. Relational Database Service (RDS).
  3. DynamoDB.
  • Term: This dropdown allows you to choose the term length for the Reserved Instances which include 1 year or 3 years.
  • Payment: This dropdown allows you to choose the payment option for your Reserved Instances, selecting between All Upfront, Partial Upfront, or No Upfront payment plans.
  • Offering Class: This dropdown allows you to choose from various types of Reserved Instances, including “Standard” and “Convertible”.
  • Total Recommendations: This shows the total number of recommendations available based on the parameters.
  • Estimated Monthly Savings: This shows the potential savings per month if the recommended Reserved Instances are purchased.
  • Estimated Savings vs On-Demand Rates: This metric illustrates the percentage of savings compared to the on-demand pricing model.

Savings Plan Recommendations

Savings Plan Recommendations feature helps you identify the savings plan that offers the estimated savings based on your AWS usage. By using this feature, you can optimize your costs and improve budget efficiency.

1. Compute Savings Plan
  • Estimated Savings: This shows the amount of money you will save each month and month by using the savings plan.
  • Term: This is the commitment period for the savings plan. In this case, the user commits to using the savings plan for 3 years to benefit from discounted rates.
  • Payment: This indicates the payment method for the savings plan.
  • Based on: The estimated savings are calculated based on data collected from the last 60 days of your compute usage.
  • Click on “View All” to access the purchase savings plan. You can customize your view by selecting between the 1-year or 3-year savings plan, choosing the payment option (Upfront, Partial Upfront, or No Upfront from the dropdown), and filtering by the based on period (7 days, 30 days, or 60 day) from the dropdown).
  • Before Recommended Purchase: The current usage and costs before applying the savings plan.
  • After Recommended Purchase: The projected costs after applying the recommended savings plan.
  • Estimated Savings: The amount of savings you can expect after applying the recommended savings plan.
  • Additionally, under Recommendation Details, you’ll find:
  1. Total Commitment ($/hr): The total cost commitment per hour.
  2. Estimated Savings (%): The percentage of savings you will achieve with the plan.

To purchase the savings plans, click on “Purchase Savings Plan” as shown in the picture above. It will navigate you to the AWS Billing and Cost Management.

2. EC2 Instance Savings Plan
  • Estimated Savings: This shows the amount of money you will save each month and hour by using the savings plan.
  • Term: This is the commitment period for the savings plan. In this case, the user commits to using the savings plan for 3 years to benefit from discounted rates.
  • Payment: This indicates about the payment method for the savings plan.
  • Based on: The estimated savings are calculated based on data collected from the last 7 days of your compute usage.
  • Click on “View All” to access the purchase savings plan. You can customize your view by selecting between the 1-year or 3-year savings plan, choosing the payment option (Upfront, Partial Upfront, or No Upfront from the dropdown), and filtering by the based on period (7 days, 30 days, or 60 day) from the dropdown).
  • Before Recommended Purchase: The current usage and costs before applying the savings plan.
  • After Recommended Purchase: The projected costs after applying the recommended savings plan.
  • Estimated Savings: The amount of savings you can expect.
  • Additionally, under Recommendation Details, you’ll find:
  1. Total Commitment ($/hr): The total cost commitment per hour.
  2. Estimated Savings (%): The percentage of savings you will achieve with the plan.

To purchase the savings plans, click on “Purchase Savings Plan” as shown in the picture above. It will navigate you to the AWS Billing and Cost Management.

EC2 Coverage

EC2 Instance Cost Distribution section helps you by visualizing the cost distribution across different instance types and pricing models, users can identify areas for optimization and make informed decisions about your EC2 instance usage. The section breaks down the costs into EC2 Compute Cost and EC2 Processors, allowing you to analyze the contributions of different components to your overall spending.

1. Cost Distribution EC2 Compute

EC2 Compute Cost feature shows the total cost of EC2 instances and breaks down costs by pricing model (On-Demand, Spot, Reserved). This will help you identify cost-saving opportunities and reduce costs.

  • Total: This shows the total cost incurred by the EC2s present in the account over the specified time frame.
  • Spot:  This shows the cost incurred by the Spot instances in the account over the specified time frame.
  • On-Demand:  This shows the cost incurred by the On-Demand instances in the account over the specified time frame.
  • Reserved: This shows the cost incurred by the Reserved instances in the account over the specified time frame. The time periods include Last 7 days, Last 14 days, Last 1 month (selected), Last 3 months, Last 6 months, Last 1 year, MTD, and YTD.
  • Additionally, a stacked bar chart is provided to visually represent the cost distribution of EC2 instances, helping to identify which instances are contributing the most to the total cost.
2. Cost Distribution EC2 Processors
  • Total: This shows the total cost incurred by the EC2 processors present in the account over the specified time frame.
  • AMD:  This shows the cost incurred by the AMD processor  in the account over the specified time frame.
  • Graviton:  This shows the cost incurred by the Graviton processor in the account over the specified time frame.
  • Intel:  This shows the cost incurred by the Intel processor in the account over the specified time frame.
  • Additionally, a stacked bar chart is provided to visually represent the cost distribution of EC2 processors, helping to identify which instances are contributing the most to the total cost.

Cost Comparison

Cost Comparison section helps you with valuable insights into AWS spending across services, helping you track spending changes over time and identify services with significant cost increases. By offering a centralized view the feature allows you to monitor spending and detect anomalies by helping you improve cloud cost management and achieve your financial goals.

1. By Service

Cost comparison by service feature helps you track spending across AWS services, identify areas with rising costs, and find opportunities for cost optimization. This enables better financial control and informed decision-making.

  • Services used: This column shows the name of AWS service/tool over the specified time frame.
  • Column 2: This column shows the cost incurred by the AWS service/tool over the specified time frame here it is July(12-18).
  • Column 3: This column shows the cost incurred by the AWS service/tool over the specified time frame here it is July(19-25).
  • Change(%):  This column shows the cost difference for each service between the two time periods. It displays the absolute change in dollars, followed by the percentage change relative to the cost in the first period. The time periods include Weekly, Monthly, MTD and Custom range.

NOTE: Cost comparison will be available when at least 2 months of data is available.

Click on “View All” to see all the AWS services and their associated costs.

2. By Account 

Cost comparison by account feature helps you track spending across accounts, identify areas with rising costs, and find opportunities for cost optimization. This enables you for better financial control and informed decision-making.

  • Accounts: This column shows the account id.
  • Column 2: This column shows the cost incurred by the AWS account over the specified time frame here it is September(01-23).
  • Column 3: This column shows the cost incurred by the AWS account over the specified time frame here it is October(01-23).
  • Change(%):  This column shows the cost difference for each service between the two time periods. It displays the absolute change in dollars, followed by the percentage change relative to the cost in the first period. The time periods include Weekly, Monthly, MTD and Custom range.
  • Click on “View All” to see all the AWS accounts and their associated costs.

NOTE: Cost comparison will be available when at least 2 months of data is available.

Tag Explorer

Tag Explorer feature helps you gain insights into your AWS resource tagging practices, by identifying tagged and untagged resources. This will allow you to streamline cost management through the effective use of tags.

  • Total Resources: This shows the total number of resources associated with the account.
  • Tagged Resources: This shows the number of tagged resources along with the percentage.
  • Untagged Resources: This shows the number of untagged resources associated with the account.
  • Additionally a pie chart is used for visual representation of the Tagged and Untagged resources.
  • Click on “View All”, to view All/Tagged/Untagged resources and their Resource, Service Name, Tag Details, Tagged Status, and Cost.

You can also download the report in CSV format by, clicking on the “Download”

Resource Cost Distribution

Resource Cost Distribution helps you visualize your AWS spending by showing the cost split between tagged and untagged resources using pie charts and bar graphs. This feature improves resource management by providing better visibility, allowing you to categorize and track costs associated with different departments or projects.

  • Total Cost of Resources: This shows the total amount spent on AWS resources.
  • Cost Distribution by Tag Status: This shows the cost incurred by tagged and untagged resources.
  • Click on “View”, to view how costs are incurred by Cost Distribution Tag Keys/ Cost Distribution of Untagged Resources By Service can be viewed either by tag/service.

AWS Budget

AWS Budget feature helps you manage cloud costs effectively by allowing you to set custom budgets and track spending against them. It provides clear visualizations of spending patterns over time, helping you identify cost trends and detect anomalies. With this feature, you can pinpoint areas for cost reduction and make informed, data-driven decisions

  • Budget: This feature shows the budget set for the AWS service.
  • Spent: This shows the amount spent by the AWS service.
  • Spare: This shows the remaining budget.
  • To create a custom budget, Click on “Add Custom Budget”
  • Budget Name: A mandatory field where you enter the name of the budget you’re creating.
  • Service List: This dropdown allows you to select specific AWS services that you want to include in the budget. 
  • Budget Limit: A mandatory field where you set the maximum amount (in currency) that you want to allocate for the budget.
  • Granularity: This dropdown likely allows you to select the time period over which the budget applies, such as daily, monthly, or yearly.
  • Set Alerts: Here, you can configure notifications that will be sent out when certain thresholds of your budget are reached.

Analytics

Analytics section helps you gain valuable insights into your AWS spending by providing detailed cost distribution for Amazon Athena and AWS Glue. It enhances your ability to analyze spending patterns across different accounts through visual tools like pie charts, enabling you to spot cost-saving opportunities.

1. Amazon Athena Cost

Amazon Athena Cost feature helps you visualize your AWS Athena spending by showing the cost breakdown for account or usage types this enables you to make informed decisions to optimize resource allocation and reduce unnecessary spending.

  • The feature provides a visual representation representing the costs associated with AWS Athena. 
  • You can select based on Account/Usage type and different timeframes to view and analyze these costs.
  • The time frames include 1 month and month-to-date (MTD).
2. AWS Glue Cost

Amazon Glue Cost feature helps you visualize your AWS Glue spending by showing the cost breakdown for account or usage types this enables you to make informed decisions to optimize resource allocation and reduce unnecessary spending.

  • This feature provides a visual representation of the cost associated with AWS Glue service for a specific account.
  • You can select based on Account/ Usage type and different timeframes to view and analyze these costs. 
  • The time frames include 1 month and month-to-date (MTD).

Database

Database section helps you gain valuable insights into your Amazon Database Services. It visualizes the cost breakdown, showing how much spending is on various database services, providing a clear baseline for understanding your cost structure. This enables you to make informed decisions to optimize database service usage and enhance cost-efficiency.

1. Database Services Cost

Database Services Cost feature helps you understand how much each database service costs and the total spending incurred by all database services. This gives you clear insights into your overall database expenses and helps you manage and optimize costs more effectively.

This feature provides a visual representation of the total cost associated with database services like Amazon Relational Database Service (RDS) and Amazon ElastiCache.

2. Database Cost Trend

Database Cost Trend chart helps you analyze your database services spending by tracking daily. It allows you to identify fluctuations and detect anomalies, such as spikes or drops in spending, improving visibility into spending trends.

  • This feature provides a visual representation of the cost trends associated with database services and can view it daily by selecting 1M /month to date (MTD).
  • X-Axis (Dates): The horizontal axis represents dates within the month and each date corresponds to a daily measurement point.
  • Y-Axis (Cost in Dollars): The vertical axis represents cost values in dollars.

Compute

The compute section helps you get an overview of the cost incurred by Amazon EC2 instance by highlighting your spending across different accounts, analyzing daily cost trends, and daily cost breakdown by instance family. This insight enables you to optimize instance selection and configuration, ensuring you choose the right resources for your needs to improve performance while effectively reducing costs.

1. Spend on EC2 By Accounts

Spend on EC2 by accounts helps you identify which accounts are spending the most. By analyzing this data, you can prioritize which accounts to optimize, potentially leading to significant cost savings.

This feature visually represents spending related to Amazon Elastic Compute Cloud (EC2) by top five/ top 10 / top 15 AWS accounts.

2. Spend on Top 10 EC2 Instances By Accounts

Spend on Top 10 EC2 Instances accounts helps you identify which top 10 accounts are spending the most. By analyzing this data, you can prioritize which accounts to optimize, potentially leading to significant cost savings.

This feature visually represents top 10 spending related to Amazon Elastic Compute Cloud (EC2) by top five/ top 10 / top 15 AWS accounts.

3. EC2 Daily Cost By Instance Family

EC2 Daily Cost By Instance Family feature helps you view a clear and concise visualization of daily costs associated with different instance families, helping you identify patterns and fluctuations over time.

The feature visually represents the daily cost of different EC2 instance families and for each date, there are stacked bars showing the cost contribution from different instance families.

Storage

Storage section helps you identify spending patterns for Amazon S3 and EBS costs. This empowers you to enhance your cost management strategy regarding storage usage. By visualizing cost distributions and trends, you can optimize costs effectively.

1. Cost Division By S3 Storage Classes

Cost Division By S3 Storage Classes helps you visualize the breakdown of S3 costs across different storage classes, making it easy to identify which classes are driving the most costs.

This feature visually represents the costs associated with different Amazon S3 storage and the total spend on the S3 Storage classes, can view in top 5 / top 10 / top 15 AWS S3 storage classes.

2. Amazon S3 Cost Trend

Amazon S3 Cost Trend helps you visualize daily S3 storage costs across different storage classes, making it easy to identify fluctuations and trends over time.

This feature visually represents the daily cost trend associated with Amazon S3 (Simple Storage Service) and can be viewed based on “Accounts/Service” from the dropdown.

3. Amazon EBS Cost Trend 

This feature  provides insights into the cost trends associated with Amazon EBS over a specific time period and can be viewed based on “Accounts/Service” from the dropdown.

4. Cost Division By Usage Type (EBS)  

The feature provides insights into the cost distribution based on usage types for Amazon Elastic Block Store (EBS) and also total cost incurred.

Network & Content Delivery

Network section helps you visualize and analyze your Amazon network and content delivery costs effectively. It highlights network usage trends over time, tracks data transfer trends between regions,the filters for top accounts or cost categories allow you to focus on spot fluctuations or anomalies helping you prioritize regions for cost optimization.

1. Network Usage Trend

Network Usage Trend helps you track daily network activity over time, allowing you to identify usage fluctuations and patterns.

  • This feature provides a visual representation of network usage across different accounts over a specified time period and can be viewed based on “Accounts/Service” from the dropdown.
  • X-Axis (Horizontal Axis): Represents the date and each bar corresponds to a single day within this period.
  • Y-Axis (Vertical Axis): Represents the cost in dollars ($).
2. Data Transfer Trend (Inter Region)

Data Transfer Trend (Inter Region) helps you track data movement between regions over time, allowing you to spot fluctuations in transfer volume.

  • This feature provides a visual representation of network usage across different accounts over a specified time period and can be viewed based on “Accounts/Service/Region” from the dropdown.
  • X-Axis (Horizontal Axis): Represents the date and each bar corresponds to a single day within this period.
  • Y-Axis (Vertical Axis): Represents the cost in dollars ($).
3. Data Transfer Cost By Region

Data Transfer Cost By Region helps you compare the costs of data transfers across different regions, allowing you to quickly identify which regions have higher expenses.

  • This feature provides a visual representation of the cost incurred by data transfer by the region.
  • X-Axis (Horizontal Axis): Represents the cost associated with network usage in dollars ($).
  • Y-Axis (Vertical Axis): Represents the region.
4.  Data Transfer Trend (Global) 

Data Transfer Trend (Global) helps you track data transfer volume fluctuations on a global scale, making it easy to spot periods of high or low activity.

  • This feature provides a visual representation of the cost incurred by data transfer globally and can be viewed based on “Accounts/Usage type/Service/From Location/To Location” from the dropdown.
  • X-Axis (Horizontal Axis): Represents the date and each bar corresponds to a single day within this period.
  • Y-Axis (Vertical Axis): Represents the cost in dollars ($).

Cost Optimization

Cost Optimization section helps you identify potential savings by analyzing usage patterns and costs for Amazon EC2, unallocated Elastic IPs, and AWS Lambda. This analysis can indicate efficient resource allocation or a lack of unallocated IPs, and provide insights for better resource management and cost reduction.

1. EC2 Unallocated Elastic IP

This feature displays cost allocation data related to Elastic IP addresses in Amazon EC2 that are currently unallocated and can be viewed based on “Accounts/Region/Usage type” from the dropdown.

2. AWS Lambda

This feature displays cost allocation data related to AWS Lambda in Amazon EC2 that are currently unallocated and can be viewed based on “Accounts/Item type/Processor type” from the dropdown.

Management & Governance

The Management and Governance section helps you understand and monitor your AWS Config expenses effectively. By analyzing daily cost fluctuations, it allows you to easily identify periods of high and low spending.

  • This feature provides a visual representation of the cost trends related to AWS Config services and can be viewed based on “Accounts/Usage type” from the dropdown.
  • X-Axis (Dates): The horizontal axis represents specific dates and each date corresponds to a data point.
  • Y-Axis (Cost): The vertical axis represents cost values in dollars.

Generate Cost Report

Before generating a Cost Report, it’s helpful to clarify your specific reporting needs and understand the type of information available on the Cost Dashboard. Having a clear idea of what you’re looking to analyze such as monthly spending trends, service-specific costs, or projected end-of-month expenses ensures that the report aligns with your goals.

1. To download the Cost and Usage report, click on the button as shown in the picture.

2. Once clicked, the customized cost report dashboard appears. Here, you can select the accounts, timeframe, and region, as well as choose which features to include or exclude from the report. This allows you to tailor the cost report to your specific needs for a more detailed and accurate analysis.

Whenever you download or generate reports, all downloaded or generated reports automatically appear in Report History, providing a central location for easy access to past reports. This convenient feature ensures that all your past reports are easily accessible in one place, enabling you to track and reference them whenever needed.

Security Assessments

Tevico enables users to capture the security posture of their AWS infrastructure by running Security Assessments. There are two types of assessments supported by Tevico.

1. Standard Security Assessment

Tevico provides a consolidated Security Assessment report which gives an aggregated view of the findings by resource type, status, and severity. You can assess your AWS account security levels using the security score based on CIS AWS Foundations Benchmark v1.2.0 and AWS Foundational Security Best Practices v1.0.0. You will get actionable recommendations for security remediation.

2. Advanced Security Assessment

The Advanced Security Assessment generates the report across various security standards such as CIS-1.2, CIS-1.4, PCI-DSS, NIST, GDPR, SOC2 & 15, HIPAA, and other standards along with guidance for security posture enhancements.
Detailed risk analysis of the generated findings at individual service and resource levels is provided in the summary report for a better infrastructure remediation approach.

3. Technical Expertise Required

Utilizing the security dashboard effectively necessitates a solid understanding of security principles and compliance standards. You should be knowledgeable about interpreting security metrics, monitoring for threats, and implementing incident response protocols. Familiarity with the dashboard’s tools and features is crucial for maintaining optimal security posture. For those new to these concepts, we recommend reviewing relevant security documentation or consulting a security expert for guidance.

Enable Standard Security Assessment

1. Login to https://console.tevi.co

2. Click Dashboard on the navigation bar on the left. On the right side of the page, there are four tabs each for Cost, Security, Reliability & Inventory.

3. Click Security.

4. In the Assessments sub-feature, click Explore Reports.

5. Click Generate under Standard Security Assessment.

6. Select the Region from the drop-down list to run the Standard Security Assessment based on where the existing workload is. You can select one region at a time for a single Standard Security Assessment.

7. When the you click on Open AWS Config, you will receive details about the AWS pricing for the Config service and guidance on setting up a budget for it. You can either set up a budget by selecting Set Budget Now or proceed without setting up any budget.

8. Open a new tab and navigate to the AWS Management Console’s Setup AWS Config page. Keep the default settings unchanged and click Next to proceed to Step 2: Rules page.

9. There is no need to select any specific rule before clicking Next. The user will then be taken to Step 3: Review.

10. Click Confirm to enable AWS Config. The AWS Config Enabled status will now be visible on Tevico as well.

11. Click Generate Report. Tevico will initiate the standard security assessment in your account. This Standard Secuirty assessment typically takes less than 30minutes to complete, after which the data will begin to appear on the dashboard.

12. Once the scan is completed, the Standard Security Assessment dashboard will be displayed as shown below.

Standard Security Assessment

Standard Security Assessment section helps you view the security posture of your AWS account by providing a detailed overview of findings and security scores.With this information, you can enhance your security measures, address vulnerabilities, and maintain compliance, protect your AWS resources and data.

Overview

Overview section displays the AWS security score alongside a line chart that visualizes the score daily. By analyzing this information, you can better understand security trends and identify potential issues that may need attention.

1. AWS Security Score

Security score feature represents the proportion of passed controls across all of your enabled standards. The score is displayed as a percentage rounded up or down to the nearest whole number.

2. Score History

Score History feature displays a line chart of the AWS security score history on a daily basis. Data points represent daily scores, allowing for easy identification of high and low periods.

Findings Classified

The Findings Classified section helps you quickly identify security vulnerabilities in your system by categorizing them by severity or status or resource.  You can categorize by selecting one of the options listed below:
1. Severity
2. Status
3. Resources

1. Severity
  • All Findings feature helps you with a summary of all security findings, detailing the number of findings in each category, including Critical, High, Medium, Low, and Informational. It also presents the percentage contribution of each category.
  • Additionally, a warning message is displayed so that you can take an immediate action to protect your system.
  • List of Findings by Severity feature helps you by providing detailed information about each security finding. This includes the finding, resource ID associated with each finding, and the necessary remediation actions.
  • You can view the findings based on the category such as Critical, High, Medium, Low, and Informational.
  • Click on “View” to see the necessary information about the remediation.
2. Status

The pie chart helps you visualize the summary of all security findings, detailing the number of findings based on the status, including Failed, Not Available, Passed, and Warning. It also presents the percentage contribution of each status.

  • List of Findings by Status feature helps you by providing detailed information about each security finding. This includes the finding, resource ID associated with each finding, and the necessary remediation actions.
  • You can view the findings based on the status such as Failed, Not available, Passed, and Warning.
  • Click on “View” to see the necessary information about the remediation.
3. Resources

The bar chart helps you visualize the summary of all security findings based on the resources.

  • List of Findings by Resource feature helps you by providing detailed information about each security finding. 
  • Click on “View” to see the necessary information about the remediation.

Findings

Findings sections help you with a comprehensive overview of each finding, it enables you to assess the security posture effectively and prioritize necessary actions for resolution.

This feature helps you view all the findings along with their details, including the category, status, resource name, resource ID, last updated date, and remediation actions.

Enable Advanced Security Assessment

1. Login to https://console.tevi.co

2. Click on the Dashboard in the navigation bar on the left. On the right side of the page, there are four tabs each for Cost, Security, Reliability & Inventory.

3. Click on Security.

4. In the Assessments sub-feature, click Explore Reports.

5. Click the Generate button in Advanced Security Assessment.

6. The Advanced Security Assessment report will be available after the scan is completed, which typically takes less than 10minutes depending on the workload. However, if there are a large number of findings, the report may take longer to generate.

7. Once the scan is completed, the Advanced Security Assessment dashboard will be displayed as shown below.

Advanced Security Assessment

The Advanced Security Assessment feature provides a comprehensive view of the security posture. It details total checks and findings categorized by severity, which helps highlight trends and areas of concern. Each finding includes detailed information, such as descriptions, locations, and potential impacts, allowing organizations to understand the root causes of vulnerabilities.

Account Summary

Account Summary section displays the total checks and a stacked bar that visualizes the percentage of passed and failed. By analyzing this information, you can better understand security trends and identify potential issues that may need attention.

  • Total checks refer to the number of security checks performed based on the selected compliance standards in the prowler.
  • Total Findings refers to the total number of findings generated.
  • Findings By Status visually represents the percentage of passing and failing findings, while also displaying the number of findings that have passed and failed.
Security Posture Evolution

Security Posture Evolution feature helps you visualize the trends of passed and failed findings with the help of a line chart.

  • X-axis: The specific time intervals, intervals are based on the scans you performed.
  • Y-axis: Indicates the number of security findings on a scale from 0 to the maximum number of findings.
Comparative Analysis

Tevio offers you to compare your review and compare the results of previous scans, to see how they measure up!  This will help you to track improvements or regressions in your security posture over time by identifying recurring issues or new vulnerabilities, you can prioritize future security actions more effectively.

  • Click on “View” to compare and review the scans as depicted in the picture below.
  • After clicking on the “View”, it will take you to the Comparative analysis page.
  • Select reports from different dates to compare and gain insights.

Finding Details

The findings details section helps you quickly identify security vulnerabilities in your system by categorizing them by severity and by giving you a visual representation of regions. Additionally, a warning message is displayed so that you can take an immediate action.

Failed Findings by Severity
  • Failed Findings by Severity feature helps you with a summary of all security findings, detailing the number of findings in each category, including Critical, High, Medium, and Low. It also presents the percentage contribution of each category.
  • Click on “View” to see the detailed information about the findings which include Title, AWS Service, Resource ID, Status, Severity, and Remediation.
  • Clicking on “View ” will help you with the desired AWS  documentation for the remediation.

Compliance

Tevico provides 22 compliance standards to help you meet regulatory requirements such as ISO, HIPAA, and GDPR, covering security, privacy, and regulatory needs. You can easily generate a compliance report. The selected compliances will be listed under the compliance-based status feature. You can export the report, simply click on the export option and choose your preferred format—either PDF or Excel.

You can enhance your security posture by enabling compliance standards. By simply clicking on the “Enable” button, you can activate the relevant compliance standard, automatically generating findings corresponding to your specific compliance framework.

For a detailed view of any specific compliance, click on any mentioned compliance standard in the “Compliance column”.

1. PCI 3.2.1

PCI Security Standards are technical and operational requirements set by the PCI Security Standards Council (PCI SSC) to protect cardholder data. The standards apply to all entities that store, process, or transmit cardholder data – with requirements for software developers and manufacturers of applications and devices used in those transactions.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.
2. HIPAA

Health Insurance Portability and Accountability Act (HIPAA) sets the standard for sensitive patient data protection. Companies that deal with protected health information (PHI) must have physical, network, and process security measures in place and follow them to ensure HIPAA Compliance.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.
  • Additionally the feature also given an warning about the critical failed findings in your system.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.

Unique Compliance provided by Tevico

1. RBI

RBI compliance ensures financial institutions meet RBI’s stringent security and operational standards. It provides automated assessments and detailed reporting.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.
  • Additionally the feature also given an warning about the critical failed findings in your system.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.
2. SEBI

SEBI compliance helps financial institutions follow SEBI rules by automating checks and generating detailed reports.

Summary

The summary section provides a comprehensive overview of compliance findings to help you prioritize and address issues effectively. This will allow you to monitor progress, prioritize high-risk findings, and identify affected AWS services for targeted action.

Finding by status

  • This feature displays the number of checks that have passed or failed, indicating compliance with the specified standard.

Findings by Severity

  • Findings by Severity feature helps you with a summary of all findings, detailing the number of findings in each category, including Critical, High, Medium, and Low.
  • Additionally the feature also given an warning about the critical failed findings in your system.

Findings by service

  • Findings by Service feature provides a comprehensive visual representation of findings for each service, offering an overview to help you effectively assess your security posture. Hovering over a specfic bar in the graph displays an overview of the findings, including color-coded severity levels and the count of findings by severity, making it easier to understand and address potential issues.
  • In this section, you can view all the checks along with their associated metadata. This includes the check title, AWS service, resource ID, status, severity, and detailed information for each check, providing a comprehensive overview of your compliance status and allowing for more informed decision-making and issue resolution.
  • Clicking on “View” will redirect you to a page that displays detailed information about the check, including the associated risks, recommendations for resolution, and relevant reference information. This helps you understand the issue in depth and provides guidance on how to address it.
Compliance standards that Tevico does not support
  • ISO27001: ISO 27001 sets the framework for all organizations to establish, implement, operate, monitor, review, maintain and continually improve an ISMS (information security management system).
  • FIPS 140-2: FIPS (Federal Information Processing Standard) 140-2 is the benchmark for validating the effectiveness of cryptographic hardware.
  • FISMA: The Federal Information Security Modernization Act (FISMA) defines a framework of guidelines and security standards to protect government information and operations.
  • ITAR: ITAR rules regulate the export of defense articles and services, including technological products and services and technical data.
Failed Findings Count By Service

Failed Findings Count By Service helps you with a visual representation of the number of failed findings per AWS service over time. Each row represents a specific date based on your scans, while the columns display the total count of failed findings for different services, such as IAM, CloudFront, CloudWatch, Well-Architected, and S3.

Code Scan Analysis

Tevico supports scanning infrastructure as code (laC) files for misconfigurations that may lead to security or compliance problems.
This feature explains how to perform the security scan on your Infrastructure as Code (IaC) files using Checkov.

1. Install Checkov and follow the instructions by clicking on “here” to install Checkov on your system.

2. Clicking on “here” as shown above opens “Checkov Installation” dialog box that provides guidance on requirements and installations.”.

3. Generate the JSON Report and use Checkov to scan your IaC files and generate a JSON report and follow the instructions by clicking on “here”.

4. Clicking on “here,” as shown above, opens the “Configuration” dialog box, which offers guidance on configuring various IaC files.

5. Upload the Report and click on the Upload JSON File button. Select the JSON report generated in the previous step.

6. Enter the Report Title in the provided text box and Click on Submit to process the report and view your Infrastructure as Code (IaC) security posture.

7. After submission, your Infrastructure as Code (IaC) Security Posture Score will be displayed as a percentage, giving an overall assessment of the security posture.
8. The score is accompanied by a gauge chart, highlighting your security status.
9. You can also download the report as a PDF.
10. You can view the report history by clicking on this icon as shown in the picture below.

To conclude, submitting the report provides a percentage-based assessment of your Infrastructure as Code (IaC) security posture, accompanied by a gauge chart for a quick visual overview. The report history feature also allows you to track and compare past assessments for continuous security improvement.

Exploring Tevico Cluster Feature

Note: Technical Expertise Required

While this feature offers an interface, managing clusters effectively requires a foundational understanding of cloud infrastructure and system management. You should be familiar with managing EC2 instances, configuring automated jobs, monitoring performance metrics, setting up backup policies, and assigning user roles. For users unfamiliar with these concepts, we recommend consulting relevant AWS documentation or seeking assistance from a technical expert.

This feature helps you enhance cluster management by allowing you to add, monitor, and remove EC2 nodes, automate tasks through jobs, and continuously monitor performance with scanners. It simplifies data protection with backup policies making cluster management both effective and user-friendly.

1. Click Cluster on the navigation bar on the left from the menu on the left-hand side of the webpage.

2. Once you’ve clicked on your desired Cluster, you’ll be directed to the Cluster Detailed page and within the Cluster Detailed Page, you’ll find five features to explore:

  1. Node
  2. Job
  3. Scanner
  4. Backup
  5. Users

Node

  • This feature allows you to add multiple nodes and perform tasks on specific nodes. Each EC2 instance within the cluster is referred to as a node.
  • To add nodes, click on “Add Nodes”.
  • In the “Action” column, there are two actions available for each node:
  1. View: Clicking on this option allows you to view detailed information about the node.
  2. Remove: This option allows you to permanently remove the node from the cluster.
  • This page appears after clicking the view option for a node. At the top right corner, there are three options.

1. Metrics: This section shows the performance metrics of the instance, which includes Health, Reachability, OS, Region,  CPU (Percent),  Disk IO (Percent),  Memory (Percent),  Fullest of Disk (Percent), and  TestCluster.

2. Action Log: This section provides a log of actions performed on the instance, helping you to track any changes or operations executed on the node.

3. Details: This section provides detailed information about the instance, including its hardware specifications, software properties, and any associated AWS Tags.

Jobs

  • This feature allows you to manage and monitor jobs associated with the cluster. Each EC2 instance within the cluster is referred to as a node.
  • To add a job, click on “Add Job”.
  • After clicking on “Add Job”, you will see the following job types:

1. Auto Healing: This feature automatically triggers specific actions when predefined conditions for a particular service on an instance are met. For example, if the set condition is met, Tevico on behalf of the User will trigger the action on the EC2 instance.

2.Scheduled Jobs: These jobs run actions based on a set schedule, independent of any conditions. Users can configure these jobs to execute at regular intervals, such as daily, weekly, or yearly, or by using cron expressions for more desired scheduling. This is useful for routine maintenance tasks, health checks, and updates, that need to occur at consistent times.

3. Manual Job: Allows users to execute tasks manually whenever needed, without any predefined conditions or schedules. This provides flexibility for ad-hoc operations or troubleshooting, enabling users to perform specific actions on demand.

Scanners

  • This feature allows you to continuously monitor the cluster based on the conditions you have specified. It actively scans the metrics, including “Soft Condition”, “Threshold”, “After (Mins)”, and “Hard Condition”, to ensure the cluster maintains the desired performance and operational thresholds.
  • To add a scanner, click on “Add Scanner”.
  • The “Create Scanner” page is displayed, which includes a “Cluster Carepoint is here to help” box. This box guides the user on what information is required and how to fill in the necessary details for creating a new scanner.

Backup

  • This feature allows user to manage their backups and details about the backup which include “Name”, “Type”, “Last modified by”, “Status”, “Report”, “Log”, and “Action”.
  • To create a backup policy, click on “Add Backup Policy”
  • The “Create Backup Policy” page is displayed, which includes a “Cluster Carepoint is here to help” box. This box guides the user on what information is required and how to fill in the necessary details for creating a new backup policy.

Users

  • This feature enables collaboration by allowing you to manage and assign permissions to other users. You can designate roles such as “Cluster Admin”, “Node Admin”, or “Cluster Viewer”, ensuring that each user has the appropriate level of access and control according to their responsibilities.

Well-Architected Framework Review and Remediation

Tevico provides an end-to-end user experience for conducting a Well-Architected Framework Review and Remediation of your workload running in AWS cloud. The process is conducted in 3 phases.

1. Capture the application details:

Customer-Centric Approach: Tevico captures the details of application like architecture diagrams along with technology stack. By deeply understanding your business through Product-Market Synergy, Tevico documents your expectations from the application architecture considering the growth prospect. Tevico aims towards the workloads to be both technically robust and aligned with your specific needs.

2. Review Process:

Expert Guidance and Continuous Improvement: Tevico’s Well-Architected module harnesses AWS Solution Architects’ best practices to help design and operate secure, efficient, and cost-effective workloads. The review process supports continuous improvement, allowing the users to save milestones, track architectural changes, and keep the workloads aligned with the latest AWS standards.

3. Remediation:

Efficient Risk Assessment and Remediation: Tevico simplifies the review and remediation process by focusing on the intent behind each question, enhancing user engagement, and making the process more productive. This approach helps identify potential risks and outlines actionable steps for improvement, ensuring the workloads consistently meet AWS best practices.

Note: Technical Expertise Required

To effectively use Tevico’s Well-Architected Framework Review and Remediation feature, you should understand AWS architecture and core services. Familiarity with the five pillars of the AWS Well-Architected Framework will help you identify risks and propose solutions. If you’re new to these areas, consulting AWS documentation or an AWS Solutions Architect can help you fully leverage Tevico’s capabilities.

Create a Workload

1. Login to https://console.tevi.co

2. Go to the Well-Architected section shown in the navigation bar on the left.

3. Click on Create Workload and enter the necessary details such as

  • Workload Name
  • Description
  • Review Owner
  • AWS Region

4. Click Next to move to Step 2 of the workload creation phase.

5. In the Workload Creation phase, you can draw, upload, or add links to their Application/Infrastructure Architecture Diagram. Upon performing any of these actions click Next.

6. Tevico offers several blueprints using which the review can be done. Blueprints are a set of questions that are to be answered depending on the type of review that the user wishes to conduct. Eg. KYA- Know Your Architecture SSB- Startup Security Baseline WAFR- Well-Architected Framework Review

Select the appropriate blueprint and click Next.

7. Once the workload is created, click Next to place a request for assigning a Solutions Architect to the newly created workload.

8. When the Solutions Architect is assigned to the workload, the workload creation will be complete immediately.

Review a Workload

1. On the Workload Summary page, click Start Review.

2. Enter the necessary details for the Product Market Synergy:

i) Industry Type
ii) Problem Statement
iii) Solution Provided
iv) Traffic Pattern
v) Compliance Requirements
vi) Growth Forecast And Context

3. Click Save.

4. Enter the details related to the Technology Stack 

i) Web Application
ii) Mobile Application
iii) Backend Application
iv) Database(s)
v) Continuous Integration / Continuous Delivery (CI/CD) Pipelines
vi) Artificial Intelligence (AI) / Machine Learning (ML) Workloads
vii) Analytics Workloads

Providing these details will help the assigned Solutions Architect give better recommendations during the review.

5. Click Save.

6. You can ask any queries or add notes on the Queries & Notes page. These queries can be addressed during the review process. Once noted, click Save.

7. A list of all the Pillars under this blueprint will be visible.

i) Security
ii) Reliability
iii) Cost Optimization

8. Click Start Review for Security Pillar.

9. In the Security pillar, you have to answer the sets of questions according to AWS Best Practices implemented in their workload.

10. During this review phase, further details for your infrastructure can also be noted down by you or by the Solution Architect assigned such as

i) Observations
ii) Improvement Plans
iii) Reference Links

11. To submit the Review, you must answer required number of questions for all the pillars. Once done, click on Request Approval.

12. Click Submit Review. Once the request is submitted, a Solution Architect will accept your request.

Remediate HRIs and MRIs from a Workload

1. On the Workload summary page, click on Start Remediation to start the remediation process.

2. After clicking on Start Remediation for security, you will have to remediate the HRIs and MRIs that are generated.

3. Once the remediation is complete for all the pillars, click on Request Approval. Wait for the Solution Architect’s approval.

4. After the Solution Architect approves the remediation request, click Submit Remediation.

5. Well-Architected Framework remediation has now completed successfully.

6. The remediation report can be downloaded by choosing the Download Report.

USER ROLES AVAILABLE IN TEVICO

Tevico uses role-based access control to manage user permissions. Each role defines specific responsibilities, allowing you to delegate tasks securely and efficiently. The following are the user roles available in Tevico:

Root Admin

A first user identity in Tevico when a new account is created on the platform. This root user has all access to all the resources and modules in Tevico as per the plan.

Secondary Admin

Has visibility into users and resources in Tevico. The secondary admin can assist with the management of users and their access to the product.

Operations Admin

A user who manages the day to day operations of the Tevico account. He is expected to perform a broad range of basic administrative and support tasks.

Read-Only Admin

A read-only admin is an administrator without the permissions for modification.

Well-Architected Teammate

A user who gets full access of well-architected review module in Tevico. The user can create WAFR review workload and conduct a WAFR.

Library Developer

A user role created to collaborate by adding workflow automation scripts (actions and scanner plugins). These scripts can be shared with community if the user wishes to.

Library Viewer

A read-only access to all workflow automation scripts (actions and scanner plugins)

HOW TO INVITE A USER AND ASSIGN THEM A ROLE IN TEVICO

1. Login into your Tevico Root account and navigate to the Users page.

2. In the top-right corner of the Users page, click the “Invite User” button. 

3. A pop-up form will appear. In the provided field, enter the email ID of the user you want to invite.

4. From the dropdown menu, choose an appropriate role for the user. Be responsible for the permissions associated with each role. 

5. By default, Tevico automatically enforces MFA (Multi-Factor Authentication) for added security. Users will be prompted to set up their MFA when they first sign up or log in.

6. Click the “Save” button to finalize the invitation. A success notification will confirm that the user invitation was sent successfully.

7. The invited user will receive an invitation email to join the Tevico account. Once they accept the invitation, their status will be updated in the Users page.

Tevico Deboarding

If a user wants to unsubscribe from Tevico, the steps given below are to be followed.

  • Unsubscribe from AWS Marketplace.
  • Delete cross-account IAM role and other resources created by the platform during the onboarding process.
  • Close Tevico account.

Unsubscribe from AWS Marketplace

1. Log in to the same AWS Account from which the you have subscribed to Tevico. Navigate to AWS Marketplace from the AWS Management Console.

2. Search for Tevico in the Manage Subscriptions section and click Manage.

3. Click Cancel Subscription from the Actions drop-down.

4. You will receive a Subscription Cancellation email on the registered email ID.

5. Once the platform is done cleaning up resources created by Tevico in your AWS account, you will receive a final email indicating completion of Subscription Cancellation.

5. After completing the steps above, you have unsubscribed from the Tevico AWS Marketplace subscription.

Note: It takes 1 hour to unsubscribe from the AWS Marketplace, during which your resources will be deleted and billing will be settled completely.

Delete cross-account IAM role and other resources created by the platform during the onboarding process.

The resources created in the AWS account during onboarding need to be removed. To achieve this, the CloudFormation stack must be deleted.

Note: Before initiating the CloudFormation stack delete operation, ensure that the S3 buckets created for storing Security Assessment Reports and/or CUR data are ’empty’. Failure to do so will result in an error during S3 bucket deletion and CloudFormation stack deletion. If you prefer not to delete these S3 buckets, please tick the appropriate checkbox during the Delete Stack operation in the AWS Management Console

1. Log in to the same AWS Account and open S3.

2. Empty the respective S3 buckets.

3. Go to AWS CloudFormation. Select the Tevico stack and then click Delete.

4. Wait until the stacks transition to DELETE_COMPLETE without encountering any errors.

5. After the stack transition completes, the resources are successfully deleted.

Close Tevico Account

To close the Tevico account, follow the steps given below:

1. Login to https://console.tevi.co using your Tevico credentials.

2. Go to Account Settings and select Close Account from the sub-menu.

3. Request an OTP for the account closure activity from the Close Account subsection on the Account Settings page.

4. Enter the OTP received on your registered email and click Submit.

5. Your Tevico account is closed successfully.

Website/Social Media

To know more about Tevico, here are quick reference links:

Website Link: https://tevi.co

Contact Us: connect@tevi.co


Social Media: LinkedIn, X(Twitter)

Appendix

In the cross-account IAM role, Tevico requires the following permissions in your AWS account to capture insights and display them in the dashboard. Among the below permission sets, only Cross-Account Permission is mandatory for onboarding. EC2 Instance Account Permission and Workflow Automation Permission are required for enabling “Workflow Automation”.

 

{

    “Version”: “2012-10-17”,

    “Statement”: [

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudwatch:PutMetricAlarm”,

                “cloudwatch:SetAlarmState”,

                “cloudwatch:DeleteAlarms”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudWatchAlarmManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudwatch:PutMetricAlarm”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudWatchAlarmCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “events:PutRule”,

                “events:PutTargets”,

                “events:PutEvents”,

                “events:DeleteRule”,

                “events:RemoveTargets”,

                “events:DisableRule”,

                “events:EnableRule”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EventBridgeManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “events:PutRule”,

                “events:PutTargets”,

                “events:PutEvents”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EventBridgeCreate”

        },

        {

            “Action”: [

                “budgets:ModifyBudget”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “BudgetManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “budgets:createbudgetaction”,

                “budgets:deletebudgetaction”,

                “budgets:TagResource”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “BudgetCreate”

        },

        {

            “Action”: [

                “wellarchitected:*”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”

        },

        {

            “Action”: [

                “securityhub:BatchEnableStandards”,

                “securityhub:EnableSecurityHub”,

                “securityhub:UpdateSecurityHubConfiguration”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SecurityHubManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “access-analyzer:CreateAnalyzer”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “AccessAnalyzerCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “access-analyzer:DeleteAnalyzer”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “AccessAnalyzerDelete”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ssm:DeleteDocument”,

                “ssm:UpdateDocument”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SSMDocumentManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ssm:CreateDocument”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SSMDocumentCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “ec2:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ssm:SendCommand”

            ],

            “Resource”: [

                “arn:aws:ssm:*:*:document/*”,

                “arn:aws:ec2:*:*:instance/*”

            ],

            “Effect”: “Allow”,

            “Sid”: “SSMCommandExecution”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “sns:Subscribe”,

                “sns:Publish”,

                “sns:SetTopicAttributes”,

                “sns:DeleteTopic”,

                “sns:Unsubscribe”,

                “sns:AddPermission”,

                “sns:TagResource”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SNSManagement”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “sns:CreateTopic”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “SNSCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ec2:CopyImage”,

                “ec2:CopySnapshot”,

                “ec2:CreateImage”,

                “ec2:CreateTags”,

                “ec2:DeleteSnapshot”,

                “ec2:DeregisterImage”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EC2Management”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “ec2:CreateImage”,

                “ec2:CopyImage”,

                “ec2:CopySnapshot”,

                “ec2:CreateTags”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “EC2Create”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “iam:PassRole”,

                “iam:CreateServiceLinkedRole”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:RequestTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudtrail:CreateTrail”,

                “cloudtrail:AddTags”,

                “cloudtrail:CreateEventDataStore”,

                “cloudtrail:CreateChannel”,

                “cloudtrail:CreateServiceLinkedChannel”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudTrailCreate”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “cloudtrail:Start*”,

                “cloudtrail:Stop*”,

                “cloudtrail:Delete*”,

                “cloudtrail:PutResourcePolicy”,

                “cloudtrail:PutEventConfiguration”,

                “cloudtrail:CancelQuery”,

                “cloudtrail:UpdateChannel”,

                “cloudtrail:PutEventSelectors”,

                “cloudtrail:UpdateEventDataStore”,

                “cloudtrail:UpdateTrail”,

                “cloudtrail:GenerateQuery”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CloudTrailManage”

        },

        {

            “Condition”: {

                “StringEquals”: {

                    “aws:ResourceTag/Created By”: “Tevico”

                }

            },

            “Action”: [

                “lambda:InvokeFunction”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “LambdaInvocation”

        },

        {

            “Action”: [

                “cur:PutReportDefinition”,

                “cur:DeleteReportDefinition”,

                “cur:ModifyReportDefinition”,

                “cur:DescribeReportDefinitions”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “CURManagement”

        },

        {

            “Action”: [

                “support:CreateCase”

            ],

            “Resource”: “*”,

            “Effect”: “Allow”,

            “Sid”: “AWSSupportAccess”

        },

        {

            “Condition”: {

                “ForAnyValue:StringEquals”: {

                    “aws:TagKeys”: “Created By”

                }

            },

            “Action”: [

                “ec2:DeleteTags”,

                “sns:UntagResource”,

                “events:UntagResource”,

                “lambda:UntagResource”,

                “cloudwatch:UntagResource”,

                “s3:DeleteObjectTagging”

            ],

            “Resource”: “*”,

            “Effect”: “Deny”,

            “Sid”: “PreventTagRemoval”

        },

        {

            “Action”: [

                “sqs:ReceiveMessage”,

                “s3:GetObject”

            ],

            “Resource”: “*”,

            “Effect”: “Deny”,

            “Sid”: “ExplicitDenyWideReadonlyActions”

        }

    ]

}

Tevico brings innovative solutions to help businesses manage their cloud infrastructure efficiently. Get in touch with us or book a demo and learn how Tevico can help you.

Quick Links

Contact Us

Sign up to our newsletter

© Copyright 2026

Partner with Tevico

Connect with sales to become a partner with tevico