Case study · Theliv
Theliv is my own SaaS product. It connects to a team's AWS accounts with a read-only role, checks spend every night, flags cost spikes and waste the day they start, explains what changed, and hands over the fix. It's built for the engineer who has to act on the bill and the founder who pays it.
01 — At a glance
02 — The problem
AWS bills arrive once a month, but cost problems start on a Tuesday: a misconfigured autoscaling rule, a forgotten instance, traffic routed through a NAT gateway. By billing day the waste has compounded for weeks.
AWS Cost Explorer shows what the bill was. It doesn't say why a service jumped, what to change, or whether last month's fix actually saved anything. Teams end up with engineers stopping work to explain an invoice.
03 — What I built
04 — Architecture
Customers connect with one CloudFormation template that creates a cross-account IAM role with read and describe permissions only. Theliv assumes it at runtime through STS with a unique external ID per account, so no long-term AWS keys are ever stored.
Every resource fact and dollar figure comes from deterministic detectors and AWS list prices. The LLM only explains, its output is labelled as AI and drawn dashed in charts, and if the model is unavailable the measured alert still ships.
A finding is credited to the ledger only when a later scan shows the resource changed, or a teammate marks it done. Each saving is credited once, enforced in the database, so the number can go to finance without a caveat.
Every query is scoped to the customer's organization with role-based access, row-level security is enabled on every table, and Slack webhook URLs are AES-256 encrypted at rest.
05 — Challenges
A model that invents a dollar figure would end the product's credibility. Splitting measurement (deterministic) from explanation (AI, labelled) means the model can be wrong about a cause without ever being wrong about a number.
A fixed threshold is noise for a large account and silence for a small one. Spike detection compares each account to its own normal range, and every account has its own sensitivity and alert floor.
Least-privilege, read-only permissions in a single template, every action listed in the onboarding wizard before deployment, and disconnection in one click.
06 — Results
The savings figures on Theliv's own site are illustrative, so none are quoted here as results.
Building something similar?
An MVP or a full SaaS product, built on a foundation that survives its first customers.
07 — Contact
I take on a small number of projects at a time, from full product builds to deployment, performance and automation work: scoped, shipped, and handed over clean.
Bengaluru, India → Open to RelocationReplies under 24h