Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
60
Curated Reports
2077+
Controls Checked
3
Cloud Providers
5 min
To First Results
Cost & Resource Hygiene Best Practices
37 controls
27 services covered
Checks spend controls and stale-resource cleanup — Budgets and Cost Explorer anomaly detection, lifecycle and retention policies, previous-generation instances, unattached or idle assets, certificate and domain expiry, and Elastic IP capacity hygiene.
What we check
Route 53 Domains3
- Route 53 domains auto renew should be enabled
- Route 53 domains should not expire within next 30 days
- Route 53 domains should not be expired
ACM Certificates3
- Imported and ACM-issued certificates should be renewed within 30 days of expiration
- ACM Certificates Not in FAILED State
- ACM Certificates Have No Pending Validation
AWS Budgets2
- AWS Cost Budget Defined
- AWS Budget Notifications Defined
Cost Anomaly Detection2
- AWS Cost Anomaly Detection is Enabled
- Cost Anomaly Detection has a Subscription Defined
Organizations Tag Policies2
- AWS Organizations Tag Policies Enabled
- Organizations tag policies are enabled and attached
EBS Volumes2
- Attached EBS Volume Delete on Termination Enabled
- EBS gp2 Volume In Use (Instead of gp3)
S3 Lifecycle Policies2
- S3 Bucket Lifecycle Rules are Configured
- S3 Version Lifecycle Policy Check
IAM Identities2
- IAM Policies Unused (Unattached) Should Be Removed
- No Expired IAM Server Certificates
Backup Plans1
- Backup Plans Include Lifecycle Policies
CloudWatch Alarms1
- CloudWatch Log Groups Retention Policy Configured
EC2 Instances1
- EC2 Previous Generation Instance Types Are Not Used
EC2 AMIs1
- Ensure Images (AMI) are not older than 90 days
EC2 Network Interfaces1
- Ensure unused ENIs are removed
ECR Repositories1
- ECR Lifecycle Policies Enabled
EFS File Systems1
- EFS Lifecycle Policies are Configured
WAF Resource Associations1
- WAF Classic Web ACL Associated to a Resource
VPC Subnets1
- VPC Subnets have Available IP Space (25% Free)
DMS Certificates1
- Ensure that all the expired DMS certificates are removed
RDS Certificates1
- RDS DB instances CA certificates should not expire within next 7 days
Data Lifecycle Manager Policies1
- DLM EBS snapshot lifecycle policy should be enabled
EKS Clusters1
- EKS Cluster CA Remains Valid Beyond 90 Days
Transfer Family Certificates1
- Transfer Family AS2 Certificates Remain Valid
Trusted Advisor Alerts1
- Real-Time Alerts Configured for Trusted Advisor Findings
Directory Service Certificates1
- Directory Service Certificates Do Not Expire Within 90 Days
Firewall Manager Policies1
- Firewall Manager Policy Resource Cleanup Enabled
Security Lake Data Lakes1
- Security Lake Data Lake Lifecycle Configured
Resource Tagging1
- AWS resources have the configured required tag keys
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.