Guides to AWS waste, security and audit evidence

Practical, vendor-neutral guides to keeping AWS tidy, secure and audit-ready.

They're written for the person who ends up owning AWS at a company without a FinOps or security team: often a CTO, a platform lead or the most senior engineer. Each guide explains the problem, shows how to check for it yourself in the AWS console or with the AWS CLI, and says what an auditor or a customer's security review will expect to see. You don't need Strays to follow them.

Where to start

• Your AWS bill keeps growing and nobody is sure why: find unused AWS resources.
• You're going for Cyber Essentials: what assessors ask about AWS.
• A customer has sent a security questionnaire: the answers and the evidence.
• Someone is leaving: the AWS leaver checklist.
• You need regular proof of who has access: a monthly access review.

All guides

• Find unused AWS resources (and who owns them)

  Unattached volumes, idle load balancers, old snapshots: where AWS waste hides, how to find it in every region, and how to find out who made it.

• Cyber Essentials for AWS: what assessors ask for

  The five Cyber Essentials controls applied to an AWS account: firewalls, secure configuration, user access, malware protection and patching.

• AWS access reviews: a monthly checklist

  Who can get into your AWS accounts? A monthly access review in five steps, with what auditors and customers' security questionnaires expect to see.

• AWS security questionnaire: answers and evidence

  The AWS questions in customers' security questionnaires: MFA, access reviews, encryption, public data, logging and patching, with the evidence to attach.

• AWS leaver checklist: removing access

  What to do in AWS when someone leaves: access keys, console passwords, roles, what they created and own, and shared secrets to rotate.