Multi-tenant FinOps, built with amarra-cais (Go + Amarra Views + Drive + SQLite).
The app UI is available in English and Brazilian Portuguese. Use the EN / PT control in the sidebar (and on the public pages) to switch. The choice is stored in the cifra_locale cookie.
- Isolates customers in workspaces (tenants): accounts, inventory, budgets, and findings never leak
- Syncs Cost Explorer when IAM allows
ce:GetCostAndUsage - Without CE, estimates monthly burn from inventory: Lightsail (instances + IPs) and S3
- Shows the minimum IAM policy needed for real billing data
- Lets each workspace link more AWS accounts (default credential chain or encrypted access keys)
- Links Hetzner Cloud projects with a read API token and estimates EUR monthly burn from live inventory (servers, volumes, IPs, load balancers, snapshots, traffic)
- Breaks down AWS Amplify spend by usage dimension (build, storage, transfer, SSR, WAF), most expensive first
- Refreshes every workspace automatically on the last day of each month (UTC hour via
CIFRA_MONTHLY_SYNC_HOUR, default 23)
Development login: demo@example.com / password.
- Go 1.26 + amarra-cais (Amarra Views + Drive)
- Tailwind 3 (no Vite / Svelte)
- SQLite
- AWS SDK v2 (Cost Explorer, Lightsail, S3, STS)
export PATH="$HOME/go/bin:$PATH"
export LOCALE=en
cp .env.example .env # set CIFRA_SEED_AWS_ACCOUNT_ID if you want a seeded account
amarra-cais install
amarra-cais dev # http://localhost:8080The first visit to the ledger syncs accounts on the active workspace (local ~/.aws chain or tenant access keys).
Do not commit account IDs. In .env (gitignored):
CIFRA_SEED_AWS_ACCOUNT_ID=xxxxxxxxxxxx
Without that variable the Demo workspace starts empty and you link the account in the UI.
Paste the policy from /settings onto a FinOps read role. Without ce:GetCostAndUsage, Cifra estimates from inventory.
go test ./... -count=1