Account Management

How to disconnect your AWS account from CostSave

Delete the CloudFormation stack, remove the account from CostSave, and verify no access remains. Takes under 5 minutes.

Last updated: June 2026·4 min read

⚡

Do Step 1 first. Revoking access from AWS side is the most important step — it immediately blocks all API calls regardless of what CostSave does. Step 2 (removing from CostSave) cleans up stored data.

How CostSave connects to AWS

CostSave uses a cross-account IAM Role created via CloudFormation — not Access Keys. When you connected your account, a CloudFormation stack was deployed in your AWS account that created a read-only IAM Role. CostSave assumes this role to run scans. Deleting the stack immediately and permanently revokes all access.

Step 1

Delete the CloudFormation stack (AWS side)

This deletes the cross-account IAM Role. CostSave's sts:AssumeRole calls will immediately fail.

1Open AWS Console → search for CloudFormation

2Find the stack named CostSaveRole (or similar) → select it

3Click Delete → confirm → wait for status to show DELETE_COMPLETE

AWS CloudFormation → Stacks → CostSaveRole

Stacks

CostSaveRoleCREATE_COMPLETEDelete ▾

→ Select stack → Click Delete → Confirm

✓

Role deleted. The IAM Role no longer exists. CostSave cannot assume it.

Step 2

Remove the account from CostSave

This permanently deletes all scan history, resource data, and stored credentials from our database.

1Log in to CostSave → go to your accounts list

2Find the AWS account → click ⚙ Manage → Remove Account

3Confirm — all scan results, cost history, and encrypted credentials are permanently deleted

CostSave → Accounts → Manage → Remove Account

My AWS Accounts

production-accountLast scanned 2h ago⚙ Manage

→ Manage → Remove Account → Confirm

✓

All data deleted. Encrypted credentials and all scan results are permanently removed from our database.

Verify AWS access is revoked

Check IAM → Roles

Search for "CostSave" in IAM → Roles. The role should not appear after the CloudFormation stack is deleted.

Check CloudTrail

Go to CloudTrail → Event History → filter by the old role name. After deletion, no new CostSave events should appear.

FAQ

Does removing from CostSave also revoke AWS access?

No. Removing from CostSave only deletes our stored copy of the Role ARN. You must also delete the CloudFormation stack from AWS (Step 1) to fully revoke access.

What if I only want to pause scanning temporarily?

You don't need to disconnect. Simply don't run a scan — the IAM Role only gives access when CostSave actively calls it. No background polling happens.

Can CostSave still access my account after credentials are deleted from the DB?

No. Without the Role ARN, CostSave has no way to authenticate. Every scan requires fetching credentials from the database — they are not cached anywhere else.

I want to delete my entire CostSave account

Log in to CostSave → Settings → Danger Zone → Delete My Account. Verify with OTP. All data is permanently erased. Complete Step 1 first to also revoke AWS access.