How Strays works
Four steps. Connecting an account takes about two minutes, and the first results usually arrive within 10.
Transcript
Connect each AWS account with one read-only role. Strays can't change anything. Strays checks every region for wasted spend and security risks. $210 a month of waste found in this account, and 16 security risks. Each one goes to whoever made it, found from tags or CloudTrail. This 500 GiB disk costs $58 a month. Its owner is Sam. So Strays asks Sam directly, in Slack or Microsoft Teams. Every item comes with a ready-to-run fix. One tap, and the decision is recorded. Every scan, decision and fix is dated in Reports. Evidence for Cyber Essentials, ISO 27001, SOC 2 and customer questionnaires. Find out whose they are. Your first account is free at getstrays.com
Transcript
Sign up with your work email (MFA is required), then name your organisation. Add your first AWS account. One click opens AWS CloudFormation with a read-only role, ready to create. When the stack is created, check the connection. Connected. The first scan starts straight away.
Transcript
A few minutes later: waste and security risks across every region. Each finding has an owner, from tags or from CloudTrail. Filter to security risks, highest first. Keep something that's intended, snooze it, or fix it. Every decision is recorded. Kept, and the list stays where you were. Undo is one click away. Owners get the same buttons in Slack.
Transcript
The evidence pack answers Cyber Essentials and security questionnaires. Each answer comes with the evidence behind it. Reports keep a dated history: every scan, decision and fix. Monthly access reviews and leaver reports show who can get in.
-
Sign up
Sign up with your work email (MFA is required) and name your organisation. Invite your team as admins, members or viewers whenever you like.
-
Connect one AWS account, or every account at once
Strays offers both, side by side. Not sure? If your company has several AWS accounts under one bill, connect them all through AWS Organizations.
One AWS account
Enter its 12-digit ID. Strays opens AWS CloudFormation with our template and your external ID filled in. Choose Create stack; about a minute later the read-only
strays-auditrole exists. Prefer Terraform? Use our module, or read the template first.Every account, through AWS Organizations
On Business and in the trial. Enter the ID of your management account (the one that pays the bill for the others) and create one stack there: it puts the same read-only role in every account you choose, including accounts created later. Read that template first if you like.
-
Strays scans
Every enabled region, weekly on Team and daily on Business, plus an hourly check for new high risks. Each finding gets an owner: from tags like
Owner, otherwise from who created it in CloudTrail. -
Owners act; you keep the evidence
Owners get a Slack message with buttons; your team gets a weekly email of what changed. Everything is recorded: what was found, who decided what, what was fixed and what it saved. Download the evidence pack or the quarterly report whenever someone asks.
What Strays checks
Prefer to check by hand first? The guides show how, with or without Strays.
Waste
- Unattached volumes and old snapshots
- Idle load balancers, NAT gateways and Elastic IPs
- Stopped instances still paying for storage
- Databases with no connections
- Logs kept forever, versioned buckets without lifecycle rules
- Savings Plan recommendations
Security
- Security groups open to the internet
- Public buckets, snapshots, images and databases
- Root without MFA, users without MFA, old access keys
- Roles other accounts can assume without an external ID
- CloudTrail and GuardDuty gaps
- Outdated runtimes, expiring certificates and domains
Start your 14-day trial Start free
The trial has all the Business features on up to 3 AWS accounts with weekly scans, for 14 days, no card.