Original Summary

I kept running into the same two small panics as a solo dev on AWS: unexpected cloud bills from forgotten test resources, and configuration gaps where I couldn't read an IAM policy with total confidence. Instead of dealing with generic cloud dashboards that either hide details or throw false positives, I built a tool to solve it for my own setup. Here is how it works under the hood. Why Read-Only by Architecture Matters The core design decision was making the permission model strictly read-only by architecture rather than just marketing promises. Spend tracking uses exactly one permission: ce:GetCostAndUsage . The security and waste scans run as separate, opt-in features built entirely out of Get , List , and Describe actions combined with an explicit deny on write and delete. There is one action whose name looks like a write: iam:GenerateCredentialReport . AWS classifies it as a write action, but all it does is ask IAM to compile its own status report, changing nothing in your environment. The system states that literal truth rather than faking a read-only label. The Cost-Waste Math To avoid false positives on low-traffic or staging environments, the waste checks use strict thresholds: The 14-Day Idle Window: Idle resources like unattached EBS volumes or unassigned Elastic IPs must show zero activity for a rolling 14-day window before triggering a finding. Under-Utilized Instances: Peak CPU utilization is tracked over multiple days; instances sitting under 1% or flatlining way below their tier are flagged. * Pricing Math: Monthly savings are derived by taking the exact instance type or storage class, looking up its standard hourly AWS list price, and multiplying it out to a 730-hour month. If the API doesn't expose the utilization metrics to price it accurately, it logs the config issue without a fake dollar amount. Current Status The product works end-to-end on my own account. Pricing is flat ($0 Free, $9 Starter, $29 Pro, $79 Scale), and the uptime monitoring half works with nothing connected. Because it's a fresh project, I built a mock-data demo page so people can inspect exactly what the security and waste findings look like without needing an account or connecting AWS keys. If you want to poke at the findings or see how it's laid out, you can check the demo here: nimbuswatch.com/demo . Curious how others here handle cloud waste tracking or monitor their side projects without getting buried in alert fatigue.   submitted by   /u/Icy-Fan2284 [link]   [comments]

  • 情报分类：硬件与数码
  • 分类依据：内容涉及硬件、数码产品或通信卡
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/10/13 04:02:45