FAQ

How does MilkStraw AI connect to my AWS environment?#

MilkStraw AI connects using a secure least-privilege cross-account IAM role that you deploy in your AWS management account or across your organization via CloudFormation. The role includes a unique external ID for verification.

What AWS permissions does the MilkStraw AI role have?#

The role has least-privilege permissions to monitor usage and savings coverage across various AWS services. It can’t change your workloads, such as instances, databases, or networks. A few write permissions let MilkStraw AI add MilkBoxes to your AWS Organization, create an AWS Organization if your account isn’t in one, and set up S3 Storage Lens and AWS Compute Optimizer. See Permissions for the full list.

Does MilkStraw AI take over my AWS billing?#

No, you continue to pay AWS directly for your cloud usage as normal. The MilkStraw AI service fee is separate and based on the savings achieved.

How are MilkBoxes added to or removed from my AWS Organization?#

After you activate savings on the Overview page, our team adds MilkBoxes to your organization. When MilkBoxes are underutilized, our team removes them.

Does MilkStraw AI access my workloads or data?#

No. MilkStraw AI never reads the contents of your files, databases, or logs, and MilkBoxes have no access to your workloads or VPCs. The connection is for billing, usage monitoring, and MilkBox management.

What happens to a milkbox account after it leaves my organization?#

It leaves your AWS Organization and no longer shares billing with your organization. MilkBoxes only hold commitment-based discounts and never run your workloads.

How often is my AWS usage monitored?#

MilkStraw AI scans your resources and usage metrics every hour, and refreshes your cost and savings data every day. AWS can take up to 2 days to report costs.

What AWS services are covered by the Fluid savings provided via MilkBoxes?#

You can check the covered services page for the full list.

What is the difference in connecting a single AWS account versus an AWS Organization?#

For a single account, the role is deployed directly via a CloudFormation stack. For an AWS Organization, you first deploy the same stack in the management account. Then you turn on StackSets trusted access and deploy a CloudFormation StackSet wrapper, which deploys the same role to all member accounts in the organization.

What if I already have existing Savings Plans or Reserved Instances?#

Our fee is calculated only from the incremental savings delivered by the MilkBoxes we provide, separate from your existing commitments. AWS applies a Database Savings Plan and a Reserved Instance to different workloads, never to the same one.

Can I add another AWS Organization to my MilkStraw account?#

Yes! You can connect multiple AWS Organizations to a single MilkStraw account. To do so:

1. Click your organization name in the bar at the bottom of the app.
2. Click Create Organization.
3. Follow the standard organization onboarding flow as described in the Quickstart guide — the process is the same as connecting your first organization.

Once connected, you can switch between your organizations at any time by clicking your organization name in the bottom bar.