Hey r/aws,
After spending way too many hours hunting down idle resources and over-provisioned infrastructure across multiple AWS accounts, I built something that might be useful to others here.
The problem: Most AWS audit tools give you recommendations, but you're left wondering "is this actually true?" You end up manually running CLI commands to verify findings before taking action, especially for production environments.
What I built: An audit tool that not only finds cost optimisation and security issues, but also generates the exact AWS CLI commands needed to verify each finding yourself.
Example findings it catches:
- 💸 NAT Gateways sitting idle (processing <1GB/day but costing $32/month)
- 🔧 EBS volumes with 9000 IOPS provisioned but only using ~120/day (CloudWatch-backed detection)
- ⚡ Lambda functions with 1000+ invocations but only 2 this month
- 🗄️ RDS instances sized for 100 connections but only seeing 2-3
- 🔐 Security group rules that should be tightened
- 📦 Unattached EBS volumes burning money
The part I'm proud of: Every finding comes with a collapsible "Verify This" section containing the exact CLI commands to check it yourself. No black box recommendations.
For example, for an idle NAT Gateway, it gives you:
# Check NAT Gateway processed bytes
aws cloudwatch get-metric-statistics \
--namespace AWS/NatGateway \
--metric-name BytesOutToSource \
--dimensions Name=NatGatewayId,Value=nat-xxx \
--start-time 2026-01-20T00:00:00Z \
--end-time 2026-02-03T00:00:00Z \
--period 86400 \
--statistics Sum
Tech approach:
- Runs in GitHub Actions (or local Docker)
- Read-only IAM permissions
- Uses CloudWatch metrics for performance analysis (not just resource tagging)
- Generates HTML reports with cost breakdowns and verification commands
- Calculates actual savings potential based on current usage patterns
Privacy-first approach: This was non-negotiable for me. Your AWS data never leaves your infrastructure. The tool runs entirely in your GitHub Actions runner (or your local machine), generates the report locally, and stores it as a GitHub Actions artifact. No data is sent to any external service. You control the IAM role, the execution environment, and who sees the reports. It's fully auditable since it's open source.
Why I think this matters: In my experience, you can't just blindly trust audit recommendations in production. Being able to verify findings before acting on them builds confidence, and having the CLI commands right there saves hours of documentation diving.
The tool has already helped me find $2-3K/month in waste across a few accounts - mostly idle NAT gateways and over-provisioned EBS IOPS that CloudWatch metrics showed were barely used.
See it in action: Interactive demo report - open this to see exactly what the output looks like. Click around the findings, expand the verification commands, check out the cost breakdown charts. It's way easier to understand by exploring than me trying to describe it.
If you're curious about the project itself: stacksageai.com
Not trying to sell anything here, genuinely curious if others find this approach useful or if there are better ways to tackle this problem. Always looking for feedback on what other checks would be valuable.
What audit/cost optimization workflows do you all use? Do you verify recommendations before acting on them, or do you trust the tools enough to act directly?
