Skip to main content
Every Optimize problem sits at one stage, from reading billing data to acting on a finding. Find the symptom below, then work through its cause, check, and fix, following the link to the page that covers the feature in full.

​
Find the stage

​
Billing access

Cause: the connected role can’t call ce:GetCostAndUsage. Check: the IAM role in that account has ReadOnlyAccess or a custom policy with the Cost Explorer reads, and Cost Explorer is turned on in the AWS console. On a new account it can take up to 24 hours to return data. Fix: attach ReadOnlyAccess (recommended), then click Retry scan. The custom policy from the quickstart on its own lets billing load but blocks resource-level findings, so use it only if you can’t attach ReadOnlyAccess.
Cause: the service account can’t read the BigQuery billing data. If you see GCP billing export is required instead, the project has no Standard export table. Check: the service account has BigQuery Data Viewer and BigQuery Job User on the project that holds the export. Fix: grant the missing roles, or turn on the Standard export, then pick the table under GCP billing export table. See the GCP connection guide.
Cause: Cost Management rejected the query. Check: the app registration has Cost Management Reader on the subscription, and, on a Microsoft Customer Agreement, Billing profile reader on the billing profile. Fix: assign the missing role to the service principal, then pick the scope again under Azure billing scope. See the Azure connection guide.
Cause: the last billing refresh failed, for example because of a missing permission or an unreadable billing source. The last good data stays readable, and the cloud connection stays connected. Check: read the alert on Optimize → Overview. Fix: use Copy policy if it shows a missing permission, Check connection to review credentials, then Retry refresh. See Cost anomalies.

​
Scan and data

Cause: the provider returned no spend for the last full month or the current month, or billing data hasn’t arrived yet. AWS Cost Explorer can lag usage by 24 to 48 hours. Check: for GCP, confirm the BigQuery table you picked is the Standard export and has rows. Fix: wait, then click Run scan again (on Findings the same action is Re-scan). See the Optimize quickstart.
Cause: this account has never been scanned, so the savings total stays at $0. Check: the selector next to the page title shows the account you expect. Fix: select Run scan. After the first scan, the button reads Re-scan. See Optimize findings.
Cause: some services couldn’t be scanned, usually because of a missing read permission or a billing problem. The board keeps the findings that completed. Check: the page alert names the problem and counts the services that failed. Fix: fix the permission or billing problem, then select Re-scan. See Optimize findings.
Cause: providers finalize billing after usage happens. AWS Cost Explorer can lag by 24 to 48 hours. Check: the Updated time in the page header. Fix: leave Daily refresh on so Optimize picks up late billing data on its own. See Cost Explorer.

​
Roles and permissions

What each workspace role can do in Optimize: Organization Owners and Admins hold workspace Admin in every workspace. See Roles.
Cause: your workspace role is Viewer. Check: your role in Workspace users. Fix: ask a workspace Admin for the Developer role.
Cause: your role is Viewer. Moving, editing, and assigning need Developer or higher. Check: your role in Workspace users. Fix: ask a workspace Admin for the Developer role.
Cause: marking a finding as expected, snoozed, or disputed needs the workspace Admin role, because a mark changes what Optimize raises and counts later. Check: your role in Workspace users. Fix: ask a workspace Admin to apply the mark, or to change your role. See Mark a finding that needs no action.
Cause: generating and scheduling reports need Developer or higher. The tooltip says “You don’t have permission to schedule reports.” Check: your role in Workspace users. Fix: ask a workspace Admin to change your role. See Optimize reports.

​
Implement

Implement is the only Optimize action that changes your cloud. It needs write access on the connection, and the quickstart grants read-only permissions, so a quickstart connection can analyze a finding but can’t change it.
Cause: the connection is read-only. Either the role, service account, or service principal lacks the write permission, or Allow writes is off on the connection. Check: read the conversation for a refused change or an access-denied error from the provider, then open the connection’s detail panel under More → Workspace settings → Connections. Fix: grant only the write permissions this change needs and turn Allow writes on. See write access for AWS, GCP, and Azure. Then start Implement again.
Cause: every action first checks that the resource still exists and still matches the finding, and Implement also stops if a dependency would break or there’s no way to roll back. Check: the conversation says what changed or what blocked the change. Fix: select Re-scan to refresh the finding, or use Generate Guidelines for a manual plan. See Act on a finding.
Cause: your workspace’s Approvals settings sent the change to a person. On the default Auto · Rules + AI · Ask me mode, an Allow Rule or AI judgment can let a safe change run without asking. On Manual, every change waits for a person. Check: the approval request in the conversation. Fix: approve or reject it. To stop the asks for changes like this one, add an Allow Rule; it takes effect once CloudThinker turns on Rule enforcement for your workspace. To be asked every time instead, choose Manual.

​
Findings and the savings total

Cause: every open finding is marked, or a filter hides them. Check: the page says findings are marked expected or snoozed, or a search or filter is set. Fix: select Show hidden findings, or clear the search and the Service, Effort, and Risk filters. See Optimize findings.
Cause: no finding meets all three conditions for counting. The visible findings are No action, marked, or already Implemented or Ignored. Check: the Quick wins and Needs review cards and the status columns on Findings. Fix: nothing to fix if that’s the real state. See Which findings count.
Cause: a Service filter is set on Findings. Check: the filter bar above the board. Fix: clear the filter and the two totals match.
Cause: the total is shared across the workspace. A snooze date passed, or a teammate moved, marked, cleared a mark on, or edited a finding. A dispute the agent upheld on a scan also removes a finding. Check: open the finding. Its Activity tab lists status changes and edits, and a mark shows who set it and when. Fix: move or edit the finding back if the change was a mistake. See Savings estimates.
Cause: two findings can estimate savings against the same spend, so the total is an upper bound. Check: compare the resources on the largest findings. Fix: count overlapping findings once in your forecast. See Why it is an upper bound.
Cause: the comparison needs a previous completed scan for that account. Check: the account has had only one scan. Fix: the comparison appears after the next scan finishes.

​
Anomalies

Cause: detection needs 14 finalized days of history per service. Check: the page shows Baseline preparing with how many finalized days are available. Fix: wait for billing history to build up. If the account is older, check that the daily refresh is on in the Optimize page header. See Cost anomalies.
Cause: the provider hasn’t finalized that day’s billing yet, the increase is below the size threshold, or it’s a decrease. Check: compare the date with Billing data through. Fix: wait for the day to finalize. Decreases and small changes aren’t flagged.
Cause: your role is Viewer, or the anomaly is retracted. Check: your role in Workspace users, and the Retracted tab for the anomaly. Fix: for a Viewer, ask a workspace Admin for the Developer role. A retracted record is read-only.

​
Cost Explorer

Cause: the account has no completed billing month in Optimize yet. Check: the first scan finished on Overview. Fix: wait for the first full calendar month of billing. See Cost Explorer.
Cause: the request failed. Your saved data isn’t affected. Check: the connection status in More → Workspace settings → Connections. Fix: click Retry.
Cause: per-row asking works only when you group by Service. Check: the Group by setting. Fix: switch Group by to Service, or use Ask CloudThinker in the toolbar. If the icon appears but the panel says Chat access is required to ask CloudThinker, your role is Viewer: asking needs Developer or higher.
Cause: the conversation didn’t start. Your question is kept. Check: the connection status in More → Workspace settings → Connections. Fix: click Retry to send it again.

​
Reports

Cause: the account’s billing refresh failed or hasn’t run yet. Check: the refresh alert on Optimize → Overview for the account. Fix: follow the alert, then generate the report again. See Optimize reports.
Cause: the run ended without saving a report. Check: generate the same report now from its card and read the error in the conversation. Fix: fix what the error names. If the manual run succeeds, the next scheduled run should too.
Cause: schedules keep the accounts captured when they were created. Check: the schedule’s account list. Fix: delete the schedule and create it again with All accounts selected.

​
Next steps

Optimize quickstart

Connect an account and run the first scan

Optimize findings

Work findings through the board and act on them