The handoff problem
A useful cost investigation needs detail. A consultant rarely needs the identifiers.
AWS Cost and Usage Report data carries the detail needed to investigate movement: dates, services, usage types, operations, costs, account fields, resource identifiers, and tags. That same richness makes an unfiltered export a poor handoff artifact.
The new kulshan export consultant command creates a narrower evidence package. You define the period and can restrict the export by account or service. Kulshan preserves the financial evidence while replacing classified customer identifiers with deterministic aliases.
The package
The recipient gets evidence and a record of how it was prepared.
The output is a ZIP containing scoped Parquet evidence plus a manifest, privacy report, and README. The manifest records the export scope, pseudonymization policy, and validation results. Optional Cost Explorer evidence can be included with --ce.
Account IDs, resource IDs, ARNs, and classified tag values are pseudonymized. Numeric billing values are preserved. Unknown columns block the export by default so a new AWS field does not silently pass through.
If an unclassified column is not needed, --drop-unclassified-columns removes it and records that decision in the package. If a tag key is required for the investigation, --keep-tag KEY includes the key while its values still pass through the privacy checks.
Validation
The ZIP is created only after three gates pass.
- Schema gate: every source column must be classified as safe, pseudonymized, dropped, or explicitly handled.
- Integrity gate: scoped source rows and exported rows are compared in both directions, including duplicates, so matching totals cannot hide changed row-level values.
- Residual gate: the output is scanned for source identifiers and identifier patterns before packaging.
A failure stops the export. There is no consultant-mode flag to reveal identifiers and no interactive terminal exception.
Usage
Export from local Parquet or the configured S3 source.
From a local CUR/Data Export directory:
kulshan export consultant ./cur-data \ --from 2026-07-01 \ --to 2026-08-01 \ --keep-tag environment \ -o consultant-export.zip
From an S3 export configured in a Kulshan workspace:
kulshan export consultant -w customer-workspace \ --from 2026-07-01 \ --to 2026-08-01 \ --service AmazonEC2 \ -o consultant-export.zip
You can also use --s3 s3://bucket/prefix directly. The start date is inclusive and the end date is exclusive. Account and service include/exclude options let you make the scope smaller before the package is built.
Limits
A safer handoff is still a handoff.
The export does not decide whether a consultant should receive the evidence. Customer approval, contractual scope, retention, transfer method, and deletion requirements still belong in the engagement.
Aliases can support analysis across rows without exposing the original identifier, but they may still reveal repeated activity and relationships. Cost and usage patterns can also be commercially sensitive without an account ID attached.
Kulshan 0.6.0 is tagged in the public repository. Check the current release and installation status before using the command in a customer workflow.
Keep reading