What clients see in under a minute

Open to the entire internet

bastion-sg · us-east-1

Security group bastion-sg allows SSH (22) from the entire internet. That is a common breach path.

Storage bucket may be public

acme-backups-prod · us-east-1

Bucket acme-backups-prod may allow public access. Confirm Block Public Access is on.

Server looks unused

staging-worker-3 · us-east-1

staging-worker-3 shows near-zero CPU for the lookback window while still billing.

~$88/mo

Website has no web firewall

web-alb · us-east-1

Application Load Balancer web-alb has no WAF association.

Unused public IP address

3.88.1.2 · us-east-1

Elastic IP 3.88.1.2 is not associated with a running instance.

~$4/mo