SAMPLE EXECUTIVE AUDIT DOSSIER

What a $25,000 per month teardown looks like

An illustrative example of the Executive Teardown deliverable. Subject: Anonymised Australian retail and logistics group,6 AWS accounts in ap-southeast-2. Every organisation, account, principal and figure below is invented. It describes no real customer.

Download sample PDF

Well-Architected score: 66 / 100
Recoverable per month: $8,430
Annualised: $101,160
Share of spend: 33.7%

6-pillar Well-Architected scorecard

20 high-risk and 31 medium-risk issues across the six pillars. Overall 66 / 100.

Pillar	/ 100	High	Med	Headline finding
Operational Excellence	71	2	5	Runbooks exist for 4 of 11 production services; no tested rollback for 3 stacks.
Security	58	6	9	3 cross-account roles trust an external principal without an ExternalId; 5 wildcard policies.
Reliability	74	3	4	Single-AZ RDS in 2 non-production accounts that serve production reporting.
Performance Efficiency	80	1	3	212 attached gp2 volumes could move to gp3 with no downtime.
Cost Optimization	49	7	6	Savings Plan and RI coverage is 18% against a steady-state baseline above 70%.
Sustainability	66	1	4	Idle non-production fleet runs 24x7; no scheduled stop or scale-to-zero.

FinOps waste breakdown

$8,430 AUD per month recoverable (33.7% of the $25,000 monthly bill). Each row names the evidence the read-only audit counted.

ID	Finding	Evidence	AUD / mo	AUD / yr	Fix
FINOPS-W32	Unattached EBS volumes (9 gp2, 5 io1)	14 volumes, 7.9 TiB, status=available > 30 days	$1,420	$17,040	Snapshot, then delete
FINOPS-W41	Unreserved steady-state RDS (On-Demand 24x7 > 90 days)	6 instances, db.r5 and db.r6g, 3 accounts	$2,310	$27,720	1-year Reserved Instances
FINOPS-W44	Unreserved steady-state EC2 (Compute Savings Plan coverage 18%)	m5, c5 and r5 fleet, 41 instances	$2,870	$34,440	Compute Savings Plan to 70% coverage
FINOPS-W57	NAT Gateway hairpin (S3 and DynamoDB traffic via NAT)	11 NAT Gateways, 20 TiB per month processed	$1,180	$14,160	Gateway VPC endpoints; one NAT per non-production VPC
FINOPS-W60	gp2 volumes that should be gp3	212 attached volumes	$360	$4,320	In-place modify_volume to gp3
FINOPS-W71	CloudWatch log groups with no retention	58 log groups, 'Never expire'	$290	$3,480	Set 30 to 90 day retention
Total recoverable			$8,430	$101,160

IAM wildcard exposure ledger

6 findings, 2 critical. Accounts and principals are anonymised aliases.

ID	Account	Principal	Finding	Severity
SEC-IAM-01	acct-prod-01	role/ci-deploy-legacy	Inline policy allows Action "" on Resource ""	CRITICAL
SEC-IAM-02	acct-prod-01	role/vendor-support-access	Trust policy allows an external account with no ExternalId condition	HIGH
SEC-IAM-03	acct-data-02	role/etl-runner	Action "s3:" on Resource "arn:aws:s3:::"	HIGH
SEC-IAM-04	acct-shared-01	role/platform-admin-poc	Action "iam:PassRole" on Resource "*" with ec2:RunInstances (privilege escalation path)	HIGH
SEC-IAM-05	acct-dev-03	user/build-bot	Long-lived access key, 412 days old, attached AdministratorAccess	CRITICAL
SEC-IAM-06	acct-dev-03	role/lambda-legacy	Action "dynamodb:" on Resource ""	MEDIUM

Deterministic remediation

Scripts reference the finding they fix. They run in your account with your credentials and default to a dry run. The Appware audit role is read-only and cannot execute them.

Snapshot and remove unattached EBS volumes FINOPS-W32

import boto3

REGION = "ap-southeast-2"
DRY_RUN = True  # review the printed list, then set to False

ec2 = boto3.client("ec2", region_name=REGION)
for page in ec2.get_paginator("describe_volumes").paginate(Filters=[{"Name": "status", "Values": ["available"]}]):
    for vol in page["Volumes"]:
        vid = vol["VolumeId"]
        print(f"{vid} {vol['VolumeType']} {vol['Size']} GiB unattached")
        if DRY_RUN:
            continue
        snap = ec2.create_snapshot(
            VolumeId=vid,
            Description="pre-delete safety snapshot",
            TagSpecifications=[{"ResourceType": "snapshot", "Tags": [{"Key": "reason", "Value": "unattached-ebs-cleanup"}]}],
        )
        ec2.get_waiter("snapshot_completed").wait(SnapshotIds=[snap["SnapshotId"]])
        ec2.delete_volume(VolumeId=vid)

Move attached gp2 volumes to gp3 in place FINOPS-W60

import boto3

ec2 = boto3.client("ec2", region_name="ap-southeast-2")
for page in ec2.get_paginator("describe_volumes").paginate(Filters=[{"Name": "volume-type", "Values": ["gp2"]}]):
    for vol in page["Volumes"]:
        print("modify", vol["VolumeId"], vol["Size"], "GiB")
        ec2.modify_volume(VolumeId=vol["VolumeId"], VolumeType="gp3")  # no detach, no downtime

Gateway endpoints that remove the NAT hairpin FINOPS-W57

variable "vpc_id" { type = string }
variable "private_route_table_ids" { type = list(string) }

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = var.vpc_id
  service_name      = "com.amazonaws.ap-southeast-2.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = var.private_route_table_ids
}

resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = var.vpc_id
  service_name      = "com.amazonaws.ap-southeast-2.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = var.private_route_table_ids
}

Replace the wildcard policy with a scoped one SEC-IAM-01

data "aws_iam_policy_document" "ci_deploy_scoped" {
  statement {
    sid       = "ReadWriteBuildArtifacts"
    actions   = ["s3:GetObject", "s3:PutObject"]
    resources = ["arn:aws:s3:::example-build-artifacts/*"]
  }
  statement {
    sid       = "DeployOneService"
    actions   = ["ecs:UpdateService", "ecs:DescribeServices"]
    resources = ["arn:aws:ecs:ap-southeast-2:*:service/example-cluster/example-service"]
  }
}

resource "aws_iam_role_policy" "ci_deploy" {
  name   = "ci-deploy-scoped"
  role   = aws_iam_role.ci_deploy.id
  policy = data.aws_iam_policy_document.ci_deploy_scoped.json
}

Your estate, itemised like this

The Executive Teardown delivers this format for your accounts. The Discovery Snapshot gives you the top findings at no cost.

See pricing