Harborline Logistics Software, Inc.
Fictional SaaS company · 1 AWS account, 2 regions · Average monthly spend: $18,400
Leadership summary
Harborline's AWS account is reliable and well organized for a team of its size, but it is costing more than it needs to, and a few security settings would worry an auditor or insurer.
We found about $5,490 a month in savings (roughly 30% of current spend), most of which can be made in the next two weeks without any change to how the product works. The biggest items are servers that are larger than they need to be and steady usage that is still billed at the on-demand rate.
On security, the account scores 68 out of 100. Three findings are high risk and should be fixed this week: the root account has no second login factor, two storage buckets can be listed publicly, and the database accepts connections from the whole internet. None shows signs of misuse, and each fix takes under an hour.
Our recommendation: fix the three high-risk items immediately, apply the four low-effort savings this month, and schedule the remaining items for next quarter.
Security score
Weighted by risk. Based on the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices.
- Checks passed
- 112
- High findings
- 3
- Medium findings
- 9
- Low findings
- 17
Top 5 savings
Estimated monthly savings at current usage. The full report lists 14 items.
| Recommendation | Est. monthly saving | Effort |
|---|---|---|
|
Right-size over-provisioned EC2 instances
9 of 14 production servers average under 15% CPU. Moving to the next size down keeps comfortable headroom.
|
$2,140 | Low |
|
Commit steady workloads to a Compute Savings Plan
Baseline usage has been flat for 11 months. A 1-year, no-upfront plan covers it at a lower rate.
|
$1,880 | Low |
|
Delete unattached EBS volumes and old snapshots
3.2 TB of volumes not attached to any server, plus snapshots dating back to 2021.
|
$610 | Low |
|
Move infrequently accessed S3 data to cheaper storage tiers
Log and export buckets are read less than once a month. A lifecycle rule moves them automatically.
|
$470 | Low |
|
Turn off staging environments outside business hours
Staging runs 24/7 but is only used weekdays, 8 a.m. to 7 p.m. A schedule cuts its run time by about two thirds.
|
$390 | Medium |
| Total from top 5 | $5,490 |
Top 5 risks
Ranked by likelihood and impact. The full report covers all 29 findings with step-by-step fixes.
| Risk | Finding | Recommended fix |
|---|---|---|
| High | Root account has no multi-factor authentication | Enable a hardware or app-based MFA device on the root user and lock the credentials away. |
| High | Two S3 buckets allow public listing | Turn on S3 Block Public Access at the account level, then confirm the website bucket still works through CloudFront. |
| High | Database security group open to the internet on port 5432 | Restrict access to the application servers' security group only. |
| Medium | CloudTrail is enabled in one region only | Enable a multi-region trail with log file validation, delivered to a locked-down bucket. |
| Medium | Six IAM access keys are over 400 days old, two belong to former staff | Remove the former staff keys today, then rotate or replace the rest with roles. |
Want a report like this for your account?
Fixed price, about two weeks, read-only access only.