Free review
Cost and security review of your AWS account
With a read-only role we review your account and deliver a report of what we found, ranked by savings and by risk. Free, with no commitment and nothing installed in your account.
- Read-only access
- Nothing installed in your account
- Report ranked by savings and risk
What we review
These are the checks we run in every region you use. Each finding comes with the read-only query we used, so your team can verify it.
Compute and storage
- Running Amazon Elastic Compute Cloud (Amazon EC2) instances with low usage: CPU below 5% over 14 days
- Previous-generation instances
- Test environments running around the clock
- Stopped instances still paying for disks
- Unattached volumes, gp2 volumes that can move to gp3, and piled-up snapshots
- Amazon CloudWatch log groups with no retention
Network
- NAT Gateways with no traffic in the last 7 days
- Load balancers with no targets
- Unassociated public IPs
Databases and containers
- Amazon Relational Database Service (Amazon RDS) databases reachable from the internet, unencrypted or without automated backups
- RDS databases on previous classes or on versions with an extended support charge
- Amazon Elastic Kubernetes Service (Amazon EKS) clusters on extended support
- Test services on Amazon Elastic Container Service (Amazon ECS) running around the clock
- Amazon Elastic Container Registry (Amazon ECR) repositories with no cleanup policy
- AWS Lambda functions on unsupported runtimes
Spend and commitments
- Last month’s spend and top services
- Savings Plans coverage
- AWS Cost Optimization Hub and AWS Compute Optimizer recommendations
- Amazon S3 buckets with no lifecycle rules
- Budget alerts
Security
- Root user without MFA and console users without MFA
- Access keys not rotated
- SSH or RDP open to the whole internet
- AWS CloudTrail, Amazon GuardDuty and AWS Config turned off
- Disks not encrypted by default and incomplete S3 Block Public Access
Amounts are estimated with AWS list prices and are meant for prioritizing. The final figure comes from your bill.
How it works
- 1
Non-disclosure agreement
We sign it before any access. It can be yours or ours.
- 2
Read-only role
Your team creates it with an AWS CloudFormation template in about 10 minutes. We send the access code through a separate channel.
- 3
Review
We run it from our own account, within a few business days of getting access.
- 4
Results session
We walk you through the report and you decide what to implement: with your team, with your current partner or with us.
How you give us access safely
Access is an AWS Identity and Access Management (IAM) role that your team creates and controls. No users, passwords or software involved.
What the role allows
- Viewing service configuration
- Viewing billing and usage metrics
- Reading the savings recommendations AWS already generates
What the role does not allow
- Creating, changing or deleting resources
- Reading the contents of S3 files, of databases, or secret values
- Signing in without the access code (ExternalId) that only your team and ours know
Every query is logged in your AWS CloudTrail, and deleting the stack removes the access. Each Cost Explorer query costs USD 0.01 on your bill: a few cents per review.
Your technical team can review the permissions before talking to us.
What the report looks like
This report was generated on a CloudTing lab account where we set up common mistakes on purpose: a NAT Gateway with no traffic, a load balancer with no targets, a public database with no backups, and a test service running all day. It is not a client account.
What it includes
- Estimated monthly and yearly savings
- Security risks by severity
- Priorities, from highest to lowest impact
- Details by area, with the query used
Amounts are small because the lab is small. The review is the same on a large account. The sample report is in Spanish.
Open the sample report (in Spanish) ↗Frequently asked questions
Why is it free?
It is how we start working with a company: you see how we work and what we find before deciding anything. If you later want help implementing the changes, we discuss it separately; it is not a condition.
Is it useful if I already have an AWS partner?
Yes. It works as a second pair of eyes on the account and replaces no one. The report is yours to implement with your team or your partner.
Do you install anything in my account?
No. Your team creates a read-only role from a template it can review first, and the queries run from our account.
Can you see my data?
No. The role shows service configuration and billing, not the contents of S3 files, of databases, or secret values.
How long does it take?
Creating the role takes about 10 minutes. The review takes a few business days after we get access, and then we schedule the results session.
Do you review every region and account?
We review the regions and accounts you tell us about. If you have several accounts, the role is created in each one.
What happens to the access when we are done?
When you delete the stack, the role is gone and access stops working immediately. The review information is treated as confidential under the agreement we sign.
Request the review
Leave your details and we will write to you to arrange the non-disclosure agreement. If you can, tell us in the message roughly how much you spend on AWS each month and in which regions.
Or email us at
hola@cloudting.com.co