How Pump Works with AWS

This page is for AWS account managers who want to understand how Pump operates within the AWS ecosystem. For customer-facing setup instructions, see Connecting Your AWS Account.

Pump's AWS Partner Status

Detail	Value
Program	AWS Solution Provider Program (Advanced Tier)
Competencies	Cloud Operations Services Competency, AI Services Competency
Additional programs	Authorized Commercial Solutions Provider, AWS Well-Architected Partner Program
Partner listing	partners.amazonaws.com/partners/0018W00001wuP0XQAU/Pump
Distribution	Ingram Micro

How the AWS Relationship Works

When a customer joins Pump on AWS, their account is invited into a Pump-controlled AWS Organization. Pump becomes the payer account for billing consolidation purposes. The customer's account, resources, workloads, and configurations remain entirely under the customer's control.

Pump uses the AWS Organizations consolidated billing structure to aggregate demand across its customer base, enabling volume-tier pricing.

What changes for the customer

Before Pump	After Pump
Customer pays AWS directly	Customer receives a consolidated invoice from Pump
Customer manages their own RI/SP purchases	Pump manages commitment purchases on the customer's behalf (if Autopilot is enabled)
Customer's account is standalone or in their own Org	Customer's account is a member of Pump's AWS Organization

What does not change

The customer retains full ownership and administrative control of their AWS account. The customer's existing AWS support plan remains active and unchanged. The customer's AM relationship is unaffected.

Permissions Pump Receives

Pump uses an IAM cross-account role with a unique External ID per customer. The role is deployed via a CloudFormation Quick-Create Stack (the customer clicks a link and confirms in the AWS Console). No manual IAM configuration is required.

Read-only role (all customers)

Used for cost visibility and optimization analysis. Includes:

Service	Permissions
Cost Explorer	ce:Get*, ce:List*
Cost and Usage Reports	cur:Describe*, cur:List*
Organizations	organizations:Describe*, organizations:List*
EC2	ec2:DescribeInstances, ec2:DescribeReservedInstances*
RDS, Redshift, ElastiCache, OpenSearch	Describe* (reserved instance and cluster metadata)
Pricing	pricing:*
Savings Plans	savingsplans:Describe*

Autopilot role (customers who opt into automated commitment management)

Includes all read-only permissions above, plus the ability to purchase commitments:

Service	Permissions
EC2	ec2:PurchaseReservedInstancesOffering
RDS	rds:PurchaseReservedDbInstancesOffering
Savings Plans	savingsplans:* (purchase and describe)

Pump Secure role (customers using Pump Secure)

Read-only security and inventory permissions for vulnerability scanning and compliance monitoring:

Service	Permissions
EC2, RDS, ECS, EKS	Describe* (resource inventory)
Security Hub, GuardDuty	Read-only (security findings)
CloudTrail	Read-only (audit logs)
Macie	Read-only (data classification)

Pump Infra role (customers using infrastructure recommendations)

Read-only compute and performance data for right-sizing analysis:

Service	Permissions
Compute Optimizer	compute-optimizer:* (read-only)
EC2, Lambda, RDS, ECS	Describe*, Get*, List*
CloudWatch	Read-only (performance metrics)

How Commitments Are Managed

Pump's commitment management engine analyzes the customer's usage patterns, existing RI/SP portfolio, and expiration schedules. It computes optimal commitment purchases per offering type and term.

Commitments purchased by Pump land in the customer's own account. Pump does not pool commitments across customers. Each commitment is keyed to a single customer account ID. If a customer leaves Pump, their commitments remain in their account and run off on their natural expiration schedule.

Customers can choose between two modes:

Mode	Behavior
Autopilot	Pump automatically executes recommended commitment purchases. Customer can block individual recommendations.
Manual	Pump generates recommendations. Customer reviews and explicitly approves before any purchase is made.

Impact on AM Quota

Customer spend that flows through Pump still counts toward the AWS AM's quota and attribution. Pump does not take commission from AWS AMs. Pump's solutions provider model is additive to the AM relationship.

Data Sources Pump Uses

Source	What Pump reads	Purpose
Cost Explorer API	Daily and monthly cost/usage data	Cost analysis, dashboards, forecasting
Cost and Usage Reports (CUR)	Detailed line-item billing data (S3)	RI utilization detail, granular cost breakdowns
AWS Organizations API	Account structure metadata	Multi-account visibility
EC2/RDS/ElastiCache/OpenSearch Describe APIs	Instance types, reserved instance inventory	Right-sizing analysis, commitment planning
AWS Pricing API	Current pricing for all services	Cost optimization calculations

Data backfill

On first connection, Pump pulls up to 12 months of historical cost data from Cost Explorer. CUR-based ingestion backfills every calendar month since the account was created. After initial setup, Pump refreshes cost data on a rolling 31-day window.

SOC 2 Type II

Pump is SOC 2 Type II certified. Audit reports are available on request through [e-mail].

Questions?

If you have questions about a specific customer's Pump setup or about Pump's AWS partner status, contact [e-mail].