· 3 min read
What a two-week AWS audit actually finds
Four findings that show up in almost every account we review, what each one costs, and why the expensive one is never the bill.
We have run this audit enough times to know what the report will mostly say before we open the account. The specifics vary. The categories do not.
Here is what turns up, roughly in order of how often.
1. You are paying for a staging environment nobody uses
Not a small one, either. The pattern is that staging was sized to match
production during a launch push two years ago, and never resized after. An
db.r5.xlarge sitting at three percent CPU costs about the same as the
production database it was cloned from.
This is the finding clients like most, because it is pure subtraction. It is also the least interesting one, and if it is the biggest thing we find, we will tell you the audit was not worth its fee.
2. Your backups have never been restored
Almost every account has automated backups switched on. Far fewer have ever restored one. Those are different claims, and only the second one is a backup.
The failure mode is specific and boring: snapshots exist, but the restore needs a parameter group, a security group, and a subnet group that were configured by hand three years ago and never captured anywhere. The restore works. It takes eleven hours instead of forty minutes because someone is rediscovering the network layout under pressure.
We test one restore during the audit. That single number — how long it actually took — changes more roadmaps than anything else in the report.
3. An IAM user with long-lived keys and more access than anyone remembers
Usually created for a CI pipeline, an integration, or a contractor. Often with
AdministratorAccess, because scoping it properly was going to take an
afternoon nobody had.
We rank findings by exploitability rather than by whatever severity a scanner prints, and this one ranks high for a reason that has nothing to do with cryptography: the key is in a CI configuration, the CI configuration is in a repository, and the repository has more people in it than the AWS account does.
4. Nobody can tell you how long a one-line fix takes to ship
We ask this directly, and the answer is diagnostic. "About twenty minutes" means the delivery pipeline is healthy. "It depends" means it is not, and the reasons it depends are usually the same handful of things: no environment parity, a test suite slow enough that people skip it, and a deploy step that one person performs from their laptop.
This is the finding that costs the most and appears on no invoice. Everything else on the list is a number you can point at. This one is a tax on every change you will make for the next two years.
What we do not find
Anything about your application code. The audit deliberately stops at the infrastructure boundary — cost, security, reliability, delivery. We read enough of the codebase to understand how it is deployed and no further, because an audit that wanders into code review produces a document that is too long to act on.
The AWS Rescue audit is fixed at $3,500 for two weeks. You keep the report and the architecture diagram whether or not we do the work that follows — the roadmap is written so your own team can execute it, which is deliberate.
AWS · Cost · Reliability · Nearshore