Your biggest cloud bill, read end to end.

Every check we run on AWS

All 214 checks, generated directly from the scanner so this list matches what actually runs. Search for a service to see whether your stack is covered.

No AWS check matches that. It may be covered on another cloud, or it may be something we do not scan yet. Ask us about it .

• Commitment opt-in

  Reserved Instances underutilized

  Aggregate RI utilization < 80% over 30 days. Unused RI hours are money already spent regardless of consumption. Requires Cost Explorer.

• Commitment opt-in

  Savings Plan coverage gap

  On-demand spend that a 1-yr no-upfront Compute SP would cover at a blended ~15% discount. Requires Cost Explorer.

• Compute uses metrics

  App Runner services with no traffic

  Running services averaging < 1 request/day over 14+ days. Provisioned container memory bills around the clock.

• Compute uses metrics

  AppStream fleets idle

  AppStream 2.0 ALWAYS_ON fleets with average InUseCapacity below 1 over the lookback window. ALWAYS_ON instance hours bill regardless of session activity.

• Compute

  Auto Scaling group rightsizing (Compute Optimizer)

  Auto Scaling groups Compute Optimizer flags for a smaller instance type, with CO's estimated monthly savings.

• Compute uses metrics

  Auto Scaling minimum oversized

  ASGs with MinSize > 1 whose member instances average < 10% CPU for 14 days. Lowering MinSize lets the group scale in during quiet periods.

• Compute

  Batch compute environments holding idle capacity

  Compute environments with desiredvCpus > 0 while no jobs are running or queued in any attached queue. Capacity bills whether jobs run or not.

• Compute uses metrics

  EC2 low-CPU oversized

  Running instances with avg CPU < 5% and p95 < 15% over 30 days. Recommends one-step-down within the same family. CPU-only - memory blindness is flagged on each finding.

• Compute

  EC2 zombie instances

  Instances stopped 7+ days but still paying for attached EBS volumes. The 'forgotten dev box' pattern.

• Compute uses metrics

  ECS services with no traffic

  Active services whose ALB target groups handled < 1 req/day for 14 days. Common abandoned-service pattern - tasks keep running, no callers.

• Compute

  EKS Karpenter migration opportunity

  EKS clusters with 3+ managed node groups using static autoscaling. Karpenter typically saves 20% on the EC2 portion by bin-packing across instance types per-pod.

• Compute

  EKS Spot capacity opportunity

  EKS managed node groups running on capacityType=ON_DEMAND with Linux-class AMIs. Spot saves up to 70% for workloads that tolerate interruption (stateless services, batch, CI runners).

• Compute uses metrics

  EKS node groups underutilized

  Managed node groups with desiredSize > 1 and avg EC2 CPU < 20% over 14 days. Recommend shrinking desired size by ~30% and letting cluster-autoscaler grow back.

• Compute opt-in

  EKS pods over-requested

  Workloads whose CPU/memory requests >> actual usage per Kubecost. Right-size requests so cluster-autoscaler can shrink the fleet.

• Compute

  EMR clusters idle (WAITING)

  EMR clusters in WAITING state for 7+ days. The master and core nodes keep paying EC2 charges while no step is running.

• Compute

  EMR clusters structurally oversized

  EMR clusters with > 5 core nodes, auto-terminate disabled, and no termination protection. Surfaces structurally large long-lived clusters that warrant a rightsizing review.

• Compute uses metrics opt-in

  Fargate services oversized

  Fargate services with Container Insights CPU + memory utilization < 20% of task reservation. Recommends halving task size. Paid: Container Insights.

• Compute

  Glue dev endpoints idle

  Glue dev endpoints not modified in the last 90 days. Dev endpoints are billed by DPU-hour while READY, so idle ones are real dollars.

• Compute uses metrics

  Idle Lightsail instances

  Running instances with avg CPU < 5% and egress < 1 MB/day over the lookback. The flat bundle fee bills regardless.

• Compute uses metrics

  Idle MWAA (Airflow) environments

  Environments averaging < 0.1 running tasks over 14+ days. The base environment fee bills 24/7-$350+/month even for small.

• Compute uses metrics

  Lambda Graviton (arm64) candidate

  x86_64 Lambda functions whose runtime has a native arm64 build. Switching architecture is ~20% cheaper per GB-second with no code change for managed runtimes.

• Compute uses metrics

  Lambda Provisioned Concurrency idle

  Lambda Provisioned Concurrency allocations averaging < 30% utilization over 30 days. PC is billed by allocated GB-second, so the unused fraction is wasted spend.

• Compute uses metrics

  Lambda forgotten functions

  Functions with at most 5 invocations on any day in 30 days. Governance finding - Lambda is invocation-priced, so $0 quantified savings; the value is reduced attack surface and tooling noise.

• Compute

  Lambda memory rightsizing (Compute Optimizer)

  Lambda functions Compute Optimizer flags as over- or under-provisioned on memory, with CO's estimated monthly savings. Replaces the deferred Logs-Insights-based LAMBDA_OVER_MEMORY.

• Compute

  Outposts capacity review

  Active Outposts flagged for a manual capacity review. An Outpost is a fixed prepaid commitment, so an under-filled rack is large waste. But utilization needs per-instance-family CloudWatch data.

• Compute uses metrics

  SageMaker hosted endpoints low traffic

  SageMaker hosted endpoints averaging under 100 invocations/day over 30 days. Endpoints are billed per-instance-hour while InService regardless of traffic.

• Compute uses metrics

  SageMaker notebook instances idle

  SageMaker notebook instances InService with CPU under 1.5% for 14+ days. Notebooks bill per second regardless of activity.

• Compute uses metrics

  Step Functions STANDARD where EXPRESS fits

  STANDARD state machines with > 10k executions/month and avg duration < 5s. EXPRESS pricing is typically ~5x cheaper for this profile.

• Compute

  WorkSpaces ALWAYS_ON idle

  AlwaysOn-mode WorkSpaces with no user connection in 30+ days. AlwaysOn billing charges full monthly fee regardless of session activity.

• Database uses metrics

  Aurora unused read replica

  Aurora reader instance with avg DatabaseConnections < 1 for 30 days while the writer has traffic. Replicas cost full hourly rate.

• Database

  CloudHSM clusters (review high cost)

  CloudHSM clusters with at least one ACTIVE HSM. Each HSM bills $1.45/hour regardless of crypto traffic. Surface every cluster for cost-aware review.

• Database uses metrics

  DocumentDB clusters idle

  DocumentDB clusters with CPUUtilization under 5% and DatabaseConnections under 5 averaged over 30 days.

• Database

  DynamoDB PITR surcharge on large tables

  DynamoDB tables with PITR enabled and > 1 GB stored. The $0.20/GB-month PITR surcharge can add up on large tables; review whether the recovery window is worth the cost.

• Database uses metrics

  DynamoDB on-demand vs provisioned mismatch

  PAY_PER_REQUEST DynamoDB tables sustaining 100+ requests/sec. PROVISIONED with autoscaling targeting 70% utilization is typically 30-50% cheaper at this consistent traffic level.

• Database uses metrics

  DynamoDB provisioned waste

  Provisioned-mode tables with consumed/provisioned < 20% for 30 days. Switch to on-demand or autoscaling to track real load instead of peak.

• Database

  DynamoDB sparse GSI

  Global Secondary Indexes whose item_count is < 10% of the base table. Provisioned RCU/WCU on the GSI is wasted; review or drop.

• Database

  DynamoDB without autoscaling

  Provisioned tables without an autoscaling target attached. Capacity stays flat at peak instead of tracking real load.

• Database uses metrics

  ElastiCache idle clusters

  Clusters with avg CurrConnections < 1 AND CPU < 5% for 30 days. Forgotten test/dev caches - cache.r6g.large alone is ~$150/month.

• Database

  ElastiCache outdated node generation

  Clusters on previous-gen node types (m5/r5/t3) when current-gen Graviton (m6g/r6g/t4g) is cheaper at equivalent specs.

• Database uses metrics

  Kinesis streams over-sharded

  Provisioned-mode Kinesis streams whose observed peak incoming bytes/sec and records/sec sit well below the configured shard count's capacity (1 MB/s and 1000 records/s per shard).

• Database uses metrics

  MSK clusters over-provisioned

  Provisioned MSK clusters with peak broker CPU under 20% across the lookback window. Typical fix is halving the broker count, preserving Kafka's topic partition layout.

• Database uses metrics

  MemoryDB for Redis clusters idle

  MemoryDB clusters with average CurrConnections under 5 and EngineCPUUtilization under 5% over 30 days.

• Database uses metrics

  Neptune clusters idle

  Neptune clusters with cluster-level CPUUtilization under 5% over 30 days. Neptune bills per-instance-hour regardless of query activity.

• Database uses metrics

  OpenSearch domains idle

  OpenSearch / Elasticsearch domains with effectively zero search and indexing activity for 30+ days. Full domain hourly cost is recoverable by deletion.

• Database uses metrics

  OpenSearch domains oversized

  OpenSearch domains with sustained low CPU (<15%) but real traffic. Typical fix is halving the data-node count. Master-eligible / warm nodes are not modified by this finding.

• Database

  RDS Extended Support surcharge

  RDS / Aurora instances running engine versions past standard EOL. AWS charges $0.10/vCPU-hour (Year 1-2; $0.20 in Year 3) until the database is upgraded to a supported version.

• Database

  RDS Multi-AZ on dev/staging

  RDS instances with Multi-AZ enabled and environment tags indicating dev / staging / qa. Multi-AZ doubles the hourly instance cost for a failover that non-prod rarely needs.

• Database uses metrics

  RDS idle instances

  RDS instances with avg CPU < 5% AND avg connections < 2 for 30+ days. Forgotten test/dev databases - often the largest single line item.

• Database uses metrics

  RDS storage autoscaling off

  RDS instances with allocated storage far exceeding usage AND MaxAllocatedStorage unset. Enable storage autoscaling so future allocations track real usage; ($0.115/GB-month on gp3).

• Database

  Redshift DC2 to RA3 migration

  DC2-class clusters that have an RA3 equivalent. RA3 separates compute from storage; cheaper at scale once data exceeds the bundled DC2 disk.

• Database

  Redshift non-prod always on

  Non-prod Redshift clusters (env=dev/staging/test) without a pause schedule. Pause + resume during off-hours saves ~60% per cluster.

• Database uses metrics

  Timestream tables idle

  Timestream tables with zero query SampleCount observed over the lookback window. Storage retention keeps billing whether or not the data is queried.

• Governance

  AWS Config recording all resources (no filter)

  AWS Config recorder set to record all supported resource types with no exclusion list. Bills $0.003 per item recorded per region. High-churn resources (e.g. ECS tasks, EC2 Spot interruptions) can quickly dominate the bill.

• Governance uses metrics

  Abandoned empty SQS queues

  Queues with zero messages, no configuration change in 180+ days, and no sends over the metric lookback. Cleanup candidates.

• Governance

  App Runner services paused for months

  Services in PAUSED state with no update in 90+ days. Likely decommissioned in practice. Delete to clear the config.

• Governance uses metrics

  AppSync APIs with no requests

  GraphQL APIs averaging < 1 request/day over the lookback. Abandoned endpoints that still accept queries.

• Governance

  AppSync APIs without logging

  GraphQL APIs with no CloudWatch log config. Debugging and incident response are blind without request logs.

• Governance

  Athena workgroups without query cost cap

  Athena workgroups with no BytesScannedCutoffPerQuery. A single misbehaving SELECT can scan petabytes; this finding identifies workgroups where that cost runaway is not gated.

• Governance

  Carbon-intensity hotspots

  Significant EC2 spend (>$100/month) in regions with a grid carbon intensity > 500 gCO2e/kWh. Reports an emissions estimate to support sustainability targets. No dollar savings claimed.

• Governance

  CloudTrail duplicate trails

  Multiple trails in the same region capturing the same event selectors. AWS gives one trail per region for free; additional trails capturing overlapping events pay $2/100k events twice.

• Governance

  CloudWatch alarms stuck in INSUFFICIENT_DATA

  Metric alarms in INSUFFICIENT_DATA for 30+ days. Usually monitor a metric that no longer reports - either delete or fix the dimension.

• Governance

  CloudWatch dashboards unused

  Accounts with more than 3 dashboards (free tier) where some haven't been modified in 180 days. Each billable stale dashboard is $3/month.

• Governance

  CloudWatch metric streams idle

  CloudWatch metric streams in state=running whose LastUpdateDate is older than 30 days. Often forgotten exports to a third-party observability sink that's no longer in use.

• Governance

  CodeBuild projects unused

  CodeBuild projects with no completed build in the last 90 days. CodeBuild is per-build-minute priced, so the dollar savings are $0. Clean up reduces IAM/source-provider blast radius.

• Governance

  CodeDeploy apps with no recent deployments

  Deploy applications with zero deployments in the last 180 days. Dormant apps leave behind deployment groups + IAM wiring as drift.

• Governance

  CodePipeline pipelines never executed

  Pipelines with no execution history. Scaffolds never wired to a real trigger. Stale config worth removing.

• Governance opt-in

  Cost anomalies (last 30d)

  AWS Cost Anomaly Detection hits over the last 30 days, with impact dollars and root-cause dimension. Requires Cost Explorer.

• Governance

  Disabled EventBridge rules

  Rules in DISABLED state. Often left over from incident response or migrations and never cleaned up.

• Governance

  DynamoDB deletion protection disabled

  DynamoDB table has deletion protection disabled.

• Governance

  DynamoDB point-in-time recovery disabled

  DynamoDB table has point-in-time recovery disabled, so there is no continuous backup for restore-to-timestamp.

• Governance

  EC2 EBS optimization disabled

  EBS-backed instance has EBS optimization disabled, throttling volume throughput on instance types that support it.

• Governance

  EC2 detailed monitoring on non-prod

  Instance has paid detailed (1-minute) CloudWatch monitoring enabled on a non-prod host where basic 5-minute metrics suffice.

• Governance

  ECS dev/staging services running 24/7

  ECS services tagged dev/staging/qa with desiredCount > 0 and no scheduled scaling. A nightly + weekend shut-down via Application Auto Scaling schedule cuts non-prod compute by ~62%.

• Governance

  ELB target groups orphaned

  Target groups not attached to any load balancer. No direct hourly cost but they accumulate as IaC drift and noisy CloudWatch dimensions.

• Governance

  Empty Cognito user pools

  User pools older than 90 days with zero users. Leftover from abandoned projects and proofs-of-concept.

• Governance uses metrics

  EventBridge rules that never fire

  Enabled rules with targets whose Invocations sum is zero over 30+ days. The event pattern matches nothing that occurs.

• Governance

  EventBridge rules with no targets

  Enabled rules with zero targets. Every matching event is evaluated and then dropped. Pure misconfiguration.

• Governance opt-in

  Free-tier exhaustion (approx.)

  Free-tier-eligible usage types now incurring paid cost (approximate, CE-derived). Requires Cost Explorer.

• Governance

  Glue jobs idle

  Glue ETL jobs with no successful run in the last 90 days. Glue is per-run priced so the dollar savings are $0, but cleaning up reduces IaC drift, IAM blast radius, and Catalog clutter.

• Governance

  Idle Batch job queues

  Enabled job queues with zero jobs in every status (including recent terminal history). Cleanup candidates.

• Governance uses metrics

  Idle Kendra index

  ACTIVE Kendra indices with ~zero queries over the lookback. The hourly base fee bills 24/7. Enterprise edition is ~$1,000/month.

• Governance uses metrics

  Idle Lex bots

  Available Lex V2 bots with ~zero runtime requests over the lookback. Lex bills per request, so this is governance hygiene (retire dead bots) rather than a cost saving.

• Governance

  IoT topic rules left disabled

  IoT Core message-routing rules in the disabled state. They route nothing. Dead config that obscures the active topology.

• Governance

  KMS key pending deletion

  Customer-managed CMK is in PendingDeletion state, which will break anything still encrypted under it when the window elapses.

• Governance

  Lambda no dead-letter target

  Lambda function has no dead-letter target configured, so failed async events are dropped after retries exhaust.

• Governance

  Lambda runtime deprecated

  Lambda function uses a runtime AWS has deprecated or scheduled for end-of-support.

• Governance

  License Manager configs consuming nothing

  Available license configurations with zero consumed licenses. Tracking rules attached to nothing. Skews compliance reporting.

• Governance

  Load balancer access logs disabled

  ALB/NLB has the access-logging attribute disabled, leaving no request-level audit trail.

• Governance

  Load balancer deletion protection disabled

  ALB/NLB has deletion protection disabled, risking accidental removal of the load balancer.

• Governance opt-in

  ML service usage spend

  Usage-priced ML service spend (Bedrock, Polly, Rekognition, etc.) over the last 30 days. Requires Cost Explorer.

• Governance

  Macie jobs scanning daily

  Macie classification jobs configured with DAILY frequency. Macie bills per-GB scanned at $1/GB (first 50 TB/month); daily re-scans of large buckets often run up the bill far beyond what compliance requires.

• Governance

  Off-hours schedule candidates

  Non-prod EC2 / RDS / ECS resources running continuously. Stopping nights and weekends via EventBridge or Application Auto Scaling schedules saves ~62% of compute time per week.

• Governance

  Production SQS queues without a DLQ

  Production-tagged queues with no redrive policy. Failed messages are silently retried until retention expiry, then lost.

• Governance

  RDS auto minor version upgrade disabled

  RDS instance has AutoMinorVersionUpgrade disabled, drifting from patched engine versions.

• Governance

  RDS automated backups disabled

  RDS instance has BackupRetentionPeriod=0, so automated backups and point-in-time recovery are disabled.

• Governance

  RDS deletion protection disabled

  Production-class RDS instance has DeletionProtection disabled, risking accidental deletion.

• Governance

  Region price arbitrage

  Workloads running in regions where the same instance type costs >15% more than us-east-1, and no data-residency tag justifies the region. The delta is real savings if migration is feasible.

• Governance

  S3 Storage Lens not configured

  No custom S3 Storage Lens configuration exists. The free default dashboard gives account-wide storage analytics that surface cold-data and lifecycle savings. Recommended to enable.

• Governance

  S3 Transfer Acceleration enabled but unused

  Buckets with TransferAcceleration=Enabled and zero accelerated bytes over the lookback window. No billing impact today, but leaves a confusing-to-debug feature on.

• Governance

  S3 buckets without access logging

  Buckets with server-access logging off. Forensics readiness only - not a cost finding. Default-off in the picker; opt in for audited environments.

• Governance

  S3 lifecycle missing abort multipart upload

  Bucket has lifecycle rules but none aborts incomplete multipart uploads, so partial uploads accrue storage charges forever.

• Governance

  SES account in sandbox

  Regions with verified SES identities but no production access. Sends are capped at 200/day to verified recipients only.

• Governance

  SES configuration sets with no destinations

  Configuration sets with zero event destinations. They do nothing. Senders referencing them gain no tracking.

• Governance opt-in

  SNS SMS spend

  Monthly SNS SMS spend per region over the last 30 days. Requires Cost Explorer.

• Governance

  SNS topics with no subscriptions

  Topics with zero confirmed or pending subscriptions. Publishes go nowhere; common leftover after a workload moves off SNS.

• Governance

  SQS dead-letter queues growing

  Dead-letter queues holding > 1000 messages. Signals a broken consumer whose failures nobody is redriving.

• Governance

  Security group unused (no attachments)

  Non-default security group is attached to zero ENIs/resources, accumulating audit noise.

• Governance

  Service Catalog products never provisioned

  Catalog products with zero provisioned instances. Offerings nobody launches. Clutters the self-service catalog.

• Governance

  Snow Family jobs completed but not cleaned up

  Snowball/Snowcone jobs in a Complete/Cancelled state older than 90 days. No ongoing charge, but stale inventory worth tidying.

• Governance uses metrics

  Step Functions never executed

  State machines older than 30 days with zero executions over the lookback. Abandoned workflow definitions.

• Governance

  Tag coverage report

  Account-wide summary of how many resources carry each of the common governance tags (Environment, Owner, CostCenter). Pure reporting. No dollar savings. Surfaces tagging debt for FinOps.

• Governance uses metrics

  Unused SES identities

  Verified identities in regions with zero sends over the lookback, or identities with sending disabled. Cleanup.

• Governance

  WAFv2 rules with no traffic

  WAFv2 rules whose 7-day sampled-request population is zero. Each rule bills $1/month independent of whether it has matched any traffic.

• Network uses metrics

  CloudFront unused distributions

  Distributions with zero requests for 30 days. Common forgotten test/staging deployments still tying up CNAMEs and cert bindings.

• Network opt-in

  Data transfer top talkers

  Costliest data-transfer usage types (inter-AZ, NAT, inter-region, internet egress) over the last 30 days. Requires Cost Explorer.

• Network uses metrics

  Direct Connect ports running under-utilized

  Dedicated Direct Connect ports averaging < 5% of the provisioned speed. The flat per-port hourly fee scales with speed, so downgrading one tier is a large recurring saving.

• Network

  ELB Classic migration candidate

  Classic Load Balancers are in maintenance mode. ALB (for HTTP/HTTPS) or NLB (for TCP) is the recommended successor with cheaper LCU pricing and modern features (HTTP/2, WAF, WebSockets, gRPC).

• Network

  Global Accelerator with no endpoints

  Enabled accelerators with no endpoints behind any listener. The flat $0.025/hr per-accelerator fee bills while routing to nothing.

• Network uses metrics

  Idle Application Load Balancers

  Application LBs with < 100 requests/day for 14+ days. Idle LBs still pay the hourly base charge.

• Network

  Lightsail load balancers with no targets

  Load balancers with zero attached instances. The flat $18/month fee bills regardless.

• Network uses metrics

  NAT Gateways with low traffic

  NAT Gateways processing < 1 GB/day for 30 days. Often replaceable with VPC endpoints (S3, DynamoDB, ECR) at zero per-hour cost.

• Network uses metrics

  Network Load Balancers with no traffic

  Network Load Balancers with avg ActiveFlowCount below 1 over 14+ days. NLBs pay the hourly base regardless of traffic.

• Network

  Route 53 orphaned health checks

  Health checks not referenced by any record set in any hosted zone. $0.50/check/month - small individually, accumulate quickly.

• Network uses metrics

  Transit Gateway attachments unused

  Transit Gateway attachments (VPC / VPN / DX / peering) that have forwarded effectively zero bytes in the lookback window. Each active attachment is billed $0.05/hr regardless of traffic.

• Network

  Unattached Elastic IPs

  Elastic IPs without an active association. AWS bills idle EIPs by the hour - small per-EIP, big in aggregate.

• Network uses metrics

  VPC endpoints unused

  Interface / GatewayLoadBalancer VPC endpoints with effectively zero BytesProcessed in the lookback window. Billed per AZ per hour regardless of traffic.

• Security

  ACM Private CA unused

  ACM Private CA in ACTIVE state with no state change in 90 days. $400/CA/month while it exists - real money for an unused CA.

• Security

  ACM certificate expiring soon

  Certificates with NotAfter within 30 days that are referenced by an AWS resource. CRITICAL - misses here cause customer outages.

• Security

  ACM certificates not in use

  Issued certs with empty InUseBy. Free at AWS, but adds review noise and IaC drift; safe to delete after a final ownership check.

• Security

  ALB HTTP listener without HTTPS redirect

  Application Load Balancers with a port-80 HTTP listener whose default action is not a redirect to HTTPS. Traffic between client and ALB is unencrypted.

• Security

  AMI is public

  Self-owned EC2 AMIs with launchPermission shared as ``all``. Anyone with an AWS account can launch instances from the AMI; if it baked in secrets, they leak.

• Security

  API Gateway methods without auth

  REST API methods configured with authorizationType=NONE and no API key required. Open to anyone on the internet.

• Security

  API Gateway stage without WAF

  REST API stages with no Web ACL attached. WAF is the first line of defense against common L7 attacks (SQLi, XSS) and rate-limiting bots.

• Security opt-in

  Access key unused (verified)

  Active IAM access keys never used, or unused for the entire lookback window, per iam:GetAccessKeyLastUsed. Requires CloudTrail lookup.

• Security

  Cognito user pools without MFA

  User pools with MFA disabled and 50+ users. Credential stuffing against Cognito-hosted login pages is routine.

• Security opt-in

  Console login without MFA

  ConsoleLogin events where MFAUsed=No over the lookback window. Password-only console access is a top account-takeover vector. Requires CloudTrail lookup.

• Security

  EBS encryption by default disabled

  Account/region EBS encryption-by-default is off, so new volumes are created unencrypted unless each request opts in.

• Security

  EBS snapshot is public

  EBS snapshots with createVolumePermission shared as ``all``. Anyone with an AWS account can create a volume from the snapshot and read every byte.

• Security

  EBS volume not encrypted

  In-use EBS volumes with Encrypted=false. Data at rest on the volume (and its snapshots) is stored unencrypted.

• Security

  EC2 IMDSv2 not enforced

  Running instance allows IMDSv1 (HttpTokens != required), exposing the metadata SSRF credential-theft path.

• Security

  EC2 instance has public IP

  Instance has a public IPv4 association, widening the attack surface beyond private networking.

• Security

  ECR repository policy public

  ECR repository policy grants pull/push to a wildcard principal without a restricting Condition (public or cross-account exposure).

• Security

  ECR repository tags mutable

  ECR repository image-tag mutability is MUTABLE, allowing tags to be silently overwritten (supply-chain risk).

• Security

  ECR scanning disabled

  ECR repositories with image scan-on-push disabled. Basic scanning is free and catches OS-package CVEs at push time. No excuse not to have it on.

• Security

  EFS file system not encrypted

  EFS file systems with Encrypted=false, leaving file data unencrypted at rest.

• Security

  GuardDuty disabled in region

  Region has no GuardDuty detector. GuardDuty is the AWS-managed threat-detection service; without it, malicious API calls and compromised EC2 traffic go unflagged.

• Security

  IAM old access keys

  Access keys created more than 365 days ago. Long-lived keys are a rotation hygiene problem; short-lived sessions or roles are preferred.

• Security

  IAM policy with Action=* Resource=*

  Customer-managed or inline policies attached to a role that Allow Action=* on Resource=* without a Condition. The IAM equivalent of 'root' for the attached principal.

• Security

  IAM role with wildcard principal

  Roles whose AssumeRolePolicyDocument allows Principal=* (or AWS=*) without a Condition narrowing it. Lets any AWS account assume the role.

• Security

  IAM root account access keys

  Root account has API access keys. AWS recommends never using these; compromise is account-takeover with no rotation path.

• Security

  IAM unused users

  Users whose console login and all access keys have been idle 90+ days. Dormant users widen the attack surface.

• Security opt-in

  IAM user with no verified activity

  IAM users with zero console or API activity across the CloudTrail lookback window (credential report + LookupEvents). Verified-unused; stronger than the age-based IAM_USER_UNUSED. Requires CloudTrail lookup.

• Security

  IAM users without MFA

  Users with console access but no MFA device. Phishing-only path to the AWS Console; MFA shuts that down.

• Security

  Inspector v2 not enabled

  Inspector v2 status is DISABLED for one or more of EC2 / ECR / Lambda in the region. Inspector is the AWS-managed CVE scanner; leaving services unscanned hides known vulnerabilities.

• Security

  KMS key policy too wide

  Customer-managed KMS keys whose default policy allows ``kms:*`` from Principal=* or a cross-account principal without a ``kms:CallerAccount`` Condition.

• Security opt-in

  KMS key unused (verified)

  Customer-managed CMKs with zero Decrypt/Encrypt/GenerateDataKey events in the lookback window. Safe-to-schedule-deletion; recovers ~$1/key/mo. Requires CloudTrail lookup.

• Security

  KMS keys without rotation

  Customer-managed symmetric KMS keys with KeyRotationEnabled=False. Annual rotation is a one-toggle compliance + hygiene win.

• Security

  KMS unused customer-managed keys

  Customer-managed CMKs older than 1 year. Heuristic only - true usage requires CloudTrail data events. $1/key/month adds up across many environments.

• Security

  Lambda function URL with no auth

  Functions with a Lambda Function URL configured at AuthType=NONE. Anyone on the internet can invoke the function with no signing required.

• Security

  Lambda resource policy wildcard principal

  Lambda resource policy grants invoke to a wildcard principal without a source ARN or account condition.

• Security

  Load balancer weak TLS policy

  HTTPS/TLS listener uses an outdated SSL policy permitting TLS 1.0 or TLS 1.1.

• Security

  No multi-region CloudTrail

  No multi-region CloudTrail exists in the account. Regional trails only capture API activity in their home region. Actions in any other region are invisible to audit.

• Security

  OpenSearch domain encryption disabled

  OpenSearch domains with encryption-at-rest or node-to-node encryption disabled.

• Security

  OpenSearch domain public endpoint

  OpenSearch domain has no VPC endpoint and an access policy that permits open/wildcard principals.

• Security

  RDS publicly accessible

  RDS instances with PubliclyAccessible=true. The DB endpoint resolves to a public IP - one misconfigured security group away from exposure.

• Security

  RDS snapshot is public

  Manual RDS / Aurora snapshots whose restore attribute is shared with ``all``. Anyone in AWS can restore the snapshot into their own account.

• Security

  RDS storage not encrypted

  RDS instances with StorageEncrypted=false. Database storage, automated backups, and snapshots are unencrypted at rest.

• Security

  Redshift cluster not encrypted

  Redshift clusters with Encrypted=false, leaving warehouse storage unencrypted at rest.

• Security

  Redshift cluster publicly accessible

  Redshift cluster has PubliclyAccessible=true, exposing the data warehouse endpoint to the internet.

• Security opt-in

  Root account used

  Root-account console sign-in or API activity in the CloudTrail lookback window. Root should be used essentially never. Requires CloudTrail lookup.

• Security

  S3 Block Public Access disabled

  Buckets without all four BlockPublicAccess flags set. Public exposure risks data leaks AND unbounded egress charges from scrapers.

• Security

  S3 bucket does not enforce TLS

  Bucket policy lacks an aws:SecureTransport=false Deny, so plaintext HTTP access to the bucket is permitted.

• Security

  S3 bucket has ACLs enabled

  Buckets with ObjectOwnership != BucketOwnerEnforced still allow object-level ACL grants, which can bypass the bucket policy and create unexpected public access.

• Security

  S3 bucket policy wildcard principal

  Bucket policy grants a Principal:* Allow with no restricting Condition (account / VPCE / source IP), exposing the bucket.

• Security

  S3 buckets without default encryption

  Buckets with no default SSE rule. SSE-S3 is free and a single API call to enable; SSE-KMS is the next step for compliance.

• Security

  S3 versioned bucket without MFA Delete

  Versioned bucket without MFA Delete, so object versions can be permanently purged without a second factor.

• Security

  SNS topic not encrypted

  SNS topics with no KmsMasterKeyId set, so messages are not encrypted at rest.

• Security

  SNS topics with public access policy

  Topic policies allowing Principal=* without an account-scoping Condition (aws:SourceAccount / aws:SourceOwner / aws:SourceArn). Anyone on the internet can publish or subscribe.

• Security

  SQS queue not encrypted

  SQS queues with neither SSE-SQS nor SSE-KMS enabled, leaving messages unencrypted at rest.

• Security

  SQS queue policy public

  SQS queue policy grants send/receive to a wildcard principal without a restricting Condition.

• Security opt-in

  Secret never accessed

  Secrets Manager secrets with no GetSecretValue events in the lookback window. Dead weight or stale credential. Requires CloudTrail lookup.

• Security

  Secrets Manager rotation disabled

  Actively-used Secrets Manager secrets (LastAccessedDate within 30 days) with rotation disabled. Long-lived credentials in active production code are a stale-key risk.

• Security

  Secrets Manager unused secrets

  Secrets last accessed more than 90 days ago. $0.40/secret/month - common cleanup target in accounts with many environments.

• Security

  Security group RDP open to the world

  Security groups with port 3389 (Windows RDP) reachable from 0.0.0.0/0 or ::/0. Frequently scanned and exploited.

• Security

  Security group SSH open to the world

  Security groups with port 22 (SSH) reachable from 0.0.0.0/0 or ::/0. Anyone on the internet can attempt to log in - brute force / 0-day risk.

• Security

  Security group all ports open to the world

  Security groups with -1 (all protocols) or full 0-65535 port range reachable from 0.0.0.0/0 or ::/0. Top-severity exposure.

• Security

  Security group database ports open to the world

  Security groups with database ports (3306, 5432, 1433, 27017, 6379, 9200, ...) reachable from 0.0.0.0/0 or ::/0. Direct internet exposure of databases is a top data-breach pattern.

• Security

  Security group egress fully open

  Security group has an unrestricted 0.0.0.0/0 all-protocol egress rule, enabling unbounded data exfiltration paths.

• Security

  VPC flow logs disabled

  VPCs without any flow-log subscription. Flow logs are the only record of in-VPC traffic; without them, incident response has no network forensics signal.

• Storage

  AMI sprawl (pinned snapshot storage)

  Self-owned AMIs older than 90 days with no live instances launched from them. Their pinned EBS snapshots keep paying storage charges until the AMI is deregistered.

• Storage

  AWS Backup plans without lifecycle

  AWS Backup plan rules with no DeleteAfterDays. Recovery points accumulate forever. A daily backup with no expiry doubles storage every year.

• Storage

  CloudWatch Logs verbose loggers

  Log groups storing > 100 GB even with retention set. Hint that a verbose logger or DEBUG-by-default config is wasting space.

• Storage

  CloudWatch Logs without retention

  Log groups with no retention policy and > 1 GB stored. Logs accumulate forever at $0.03/GB-month - common pattern from Lambda / API Gateway.

• Storage

  CodeArtifact domains unused

  CodeArtifact domains with zero repositories but residual asset storage. Storage bills $0.05/GB-month regardless of whether any repository remains.

• Storage

  DataSync tasks never executed

  Transfer tasks with no execution history. DataSync bills per-GB transferred, so these carry no ongoing charge. But they're stale config, usually a migration that never happened.

• Storage uses metrics

  EBS provisioned IOPS over-allocated

  io1 / io2 / above-baseline gp3 volumes whose observed peak VolumeReadOps+WriteOps sit well below the provisioned IOPS. Provisioned IOPS are billed separately from the volume's storage charge.

• Storage

  EBS volume rightsizing (Compute Optimizer)

  EBS volumes Compute Optimizer flags for a cheaper type / IOPS / throughput configuration, with CO's estimated monthly savings.

• Storage

  ECR repositories large + stale

  ECR repositories holding 1+ GB of images whose newest image was pushed more than 90 days ago. ECR doesn't expose pull counts, but a repo with no recent push activity is a strong proxy for an abandoned image set still paying storage.

• Storage

  ECR repositories without lifecycle policy

  Private ECR repositories with no lifecycle policy attached. Without one, every pushed image (including untagged CI intermediates) accumulates at $0.10/GB-month.

• Storage

  EFS without lifecycle policy

  EFS file systems > 100 GB without a transition-to-IA policy. EFS Standard is 12x more expensive than IA per GB-month.

• Storage uses metrics

  FSx file systems with low usage

  File systems whose daily read+write volume is < 5% of provisioned capacity for 14+ days. Capacity bills regardless.

• Storage

  FSx manual backup sprawl

  File systems with > 100 user-initiated backups or a manual backup older than 180 days. FSx never expires manual backups.

• Storage

  Idle EBS Fast Snapshot Restore

  Fast Snapshot Restore enabled per snapshot per AZ bills ~$0.75/hr (~$540/month) whether or not volumes are restored from it.

• Storage

  Orphaned AWS Backup recovery points

  Recovery points older than 7 days whose source resource ARN is not present in the current scan. Likely safe to delete after a final review.

• Storage

  Orphaned EBS snapshots

  Snapshots whose source volume no longer exists, older than 30 days. Likely safe to delete after a final review.

• Storage

  RDS manual snapshots > 90 days

  Manual RDS DB / cluster snapshots older than 90 days. Snapshot storage bills $0.095/GB-month indefinitely. Clean up the long tail of one-off pre-change snapshots.

• Storage

  S3 Intelligent-Tiering candidate

  Buckets > 1 TB in Standard with no Intelligent-Tiering configuration and no lifecycle transition. IT auto-moves cold objects to IA / Archive at no retrieval cost.

• Storage

  S3 buckets with cold-data candidates

  Buckets > 10 GB in Standard with no lifecycle transition. Recommend Intelligent-Tiering (no retrieval fees) or IA / Glacier with honest retrieval-discounted savings.

• Storage

  S3 incomplete multipart uploads

  Buckets without an AbortIncompleteMultipartUpload rule. Failed multipart uploads accumulate paid storage indefinitely.

• Storage

  S3 versioning without lifecycle

  Buckets with versioning enabled but no rule expiring noncurrent versions. Old object versions accumulate forever - silent cost leak.

• Storage uses metrics

  Storage Gateways with no cloud activity

  Running gateways with near-zero CloudBytesUploaded/Downloaded over the lookback. The gateway host keeps costing money after the workload moves off.

• Storage

  Unattached EBS volumes

  EBS volumes in 'available' state for 7+ days. Pay full storage cost for nothing - usual cause is forgotten cleanup after instance terminate.

• Storage

  Unattached Lightsail disks

  Additional block-storage disks not attached to any instance. They bill per GB-month while holding stale data.

• Storage

  gp2 to gp3 migration

  gp2 volumes safe to migrate to gp3 in-place. ~20% cheaper, no downtime, matches gp2 baseline performance for volumes within 3000 IOPS.

Checks marked opt-in use a paid or billing-data cloud API and never run unless you switch them on. A default scan uses only free APIs.