Cost waste
Unattached volumes, unused Elastic IPs, orphaned load balancers, stale snapshots, stopped instances still costing you storage.
Most AWS accounts leak 20-40% on waste — find yours in minutes
Security risk
Open security groups, public S3 buckets, missing MFA, unencrypted storage/databases, stale IAM access keys, weak CloudTrail coverage.
Read-only, always
The scan role can only read configuration — it cannot modify, delete, or access data in any resource.
Step 1 — Create your read-only scan role (about 3 minutes)
You'll need this role's ARN at checkout, so set it up first. Nothing to install — just two copy-paste policies in your own AWS Console.
1. Sign in to your AWS account → IAM → Roles → Create role.
2. Choose Custom trust policy and paste this in:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam::248568276047:root" },
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": { "sts:ExternalId": "uai-aws-health-check" }
}
}
]
}
3. Skip attaching any AWS-managed policies on this screen. Name the role exactly HealthCheckScanRole and create it.
4. Open the new role → Add permissions → Create inline policy → JSON → paste this in, then save:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSHealthCheckReadOnly",
"Effect": "Allow",
"Action": [
"ec2:DescribeVolumes", "ec2:DescribeAddresses", "ec2:DescribeInstances",
"ec2:DescribeSnapshots", "ec2:DescribeSecurityGroups",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"s3:ListAllMyBuckets", "s3:GetBucketPublicAccessBlock",
"s3:GetEncryptionConfiguration", "rds:DescribeDBInstances",
"iam:GetAccountSummary", "iam:ListUsers", "iam:ListMFADevices",
"iam:GetLoginProfile", "iam:ListAccessKeys", "cloudtrail:DescribeTrails"
],
"Resource": "*"
}
]
}
5. Copy the Role ARN from the top of the role's summary page — it looks like arn:aws:iam::YOUR_ACCOUNT_ID:role/HealthCheckScanRole. You'll paste this at checkout.
Every permission above starts with Describe, List, or Get — this role cannot create, modify, or delete anything, and cannot read the contents of any file, database, or secret. You can delete it any time after your report arrives.
STEP 2Pay and paste your Role ARN
At checkout you'll see a required "AWS Role ARN" field — paste the ARN you just copied, then complete payment.
I have my Role ARN — run my scan ($49)How it works
Create your read-only scan role using the copy-paste policies above — takes about 3 minutes, nothing to install.
Paste your Role ARN into the "AWS Role ARN" field at checkout and pay.
Your scan kicks off automatically the moment payment clears. A scored report — cost waste and security findings, prioritized by severity — lands in your inbox, typically within minutes.
FAQ
Do I need to set anything up before I pay?
Yes — one IAM role in your own AWS account, using the copy-paste policies above. It takes about 3 minutes and there's nothing to install. You'll need the role's ARN at checkout.
Is this safe to run on a production account?
Yes. The scan role is strictly read-only — it can only call Describe/List/Get API actions. It cannot change, delete, or create anything.
What if I don't want to give any access at all?
The IAM role can be deleted immediately after your report is generated — access is entirely temporary and under your control the whole time.
How long does it actually take?
The scan is fully automated and runs the moment your payment is confirmed — most reports are delivered within minutes. If anything about your role setup needs fixing, we'll email you directly instead of leaving you guessing.
Do you store my AWS data?
No. Findings are used only to generate your report and are not retained beyond that.
See also: Home · All products · [email protected]