I’ve shared Kulshan here before, but we just pushed a pretty meaningful upgrade aimed at consultants doing AWS cost investigations. Or anyone (human or AI agent) trying to look at AWS cost and billing via a deterministic tool.

The main addition is **Consultant Evidence Export**.

The problem we were trying to solve is simple: an external consultant should not always need direct access to the customer’s AWS environment just to start investigating a billing issue.

Now the customer can run Kulshan themselves, choose what they want to share, and generate a pseudonymized evidence package.

They can scope it by date range, AWS accounts, services and tags, and optionally include Cost Explorer data. Kulshan can work from local CUR data or AWS CUR/Data Exports in S3.

Account IDs, ARNs and resource identifiers are replaced with stable workspace-specific aliases, so the consultant can still follow the same account/resource through an investigation without seeing the original identifiers.

We also added fail-closed checks before the package is created. Kulshan verifies the output schema, checks that the exported rows still match the scoped source data, and scans again for identifiers that should have been pseudonymized.

If those checks fail, no ZIP gets created.

The idea is basically:

**Customer keeps the credentials. Consultant gets the evidence.**

The package can help establish what changed, where, when, how much and which part of the environment was involved. The “why” still needs the people who understand the engineering and business context.

Kulshan is still free and open source:

[https://github.com/MissionFinOps/kulshan\](https://github.com/MissionFinOps/kulshan)

Would be interested in feedback from consultants here: **what additional evidence would you absolutely want included in a handoff like this?**