a sample audit, built from the patterns we see across real AWS accounts
58/100 infra health
21findings
3critical
$1,899/moleaking
oversized compute$610
no savings plans$430
dev and staging 24/7$340
NAT gateway traffic$185
log retention$120
orphaned resources$119
old volumes and snapshots$95
$4,860today
$2,961after fixes
this week, in order
close the public databaseone leaked password away from a breach
kill the root access keysanyone holding those keys owns the account
point alarms at a humanalarms have been firing into the void for months
what most audits miss
traffic to S3 billed through NAT, free endpoints never added
the alert topic has zero subscribers
IAM keys of people who already left
burstable instances quietly throttled, users feel it
week 1
stop the bleedingthe breach scenarios die first
week 2
turn the lights onfrom here, nothing fails silently
week 3
stop the leaksthe waste in the bill gets cut
week 4
make it rebuildablethe setup stops living on one person's laptop
handed over