KLOUDCARE
Free AWS Assessment

Free AWS assessment: check your account for waste and risk in about 10 minutes.

Find cost savings, backup gaps and security risks. The assessment runs inside your own AWS account, and the report is saved to a private S3 bucket that only you can access.

Get the assessment template View a sample report
Free Read-only Your report stays in your account

How to run it

The assessment is read-only. It cannot change, stop or delete anything, and it never reads your files, databases or secrets. Nothing is sent to KloudCare unless you choose to share the report.

Tell us who you are

We'll email you the download link too, and may get in touch once to offer a free review of your results.

By continuing you agree that KloudCare may contact you about the assessment. See our privacy policy.

  1. Get the assessment template using the form.
  2. Sign in to your AWS account as a user who can create IAM roles. Choose the region where you want the report stored.
  3. Open CloudFormation → Create stack → With new resources, choose Upload a template file, and select the file you downloaded.
  4. Name the stack KloudCareAssessment. Keep the default settings or choose the regions to assess.
  5. On the last page, tick I acknowledge that AWS CloudFormation might create IAM resources and click Submit.
  6. After about 5–10 minutes, open the stack's Outputs tab and click the Reports link. Open the newest folder and download the .html report.

What it checks

The report has a clear section for each area.

Cost

  • Unattached EBS volumes, unused Elastic IPs and load balancers with no targets
  • EC2, RDS and ECS capacity that is idle, underused or oversized
  • NAT Gateways with little traffic, S3 buckets without lifecycle rules and rarely used Lambda functions
  • Last month's spend by service, and estimated monthly savings

Backup

  • AWS Backup plans, and EBS volumes without a recent snapshot or backup
  • RDS automated backups, retention period and deletion protection
  • S3 bucket versioning

Security

  • Root user MFA and access keys, IAM users without MFA and old access keys
  • Security groups that open SSH, RDP or databases to the internet
  • Public S3 buckets and S3 Block Public Access
  • Encryption of EBS volumes and RDS databases, CloudTrail logging and GuardDuty

Governance and operations

  • Monitoring alarms
  • Required tags
  • Resources in unexpected regions

Each finding shows its evidence, severity, confidence and a recommended action, plus estimated savings for cost findings. Each section lists every check it ran. If something could not be checked, the report says so instead of guessing. View a sample report.

What gets created in your account

  • A read-only IAM role, used only by the assessment job
  • An AWS CodeBuild project that runs the assessment. Start a new build to run it again.
  • A private, encrypted S3 bucket for reports. Reports are deleted automatically after 30 days by default.
  • A small Lambda function that starts the first run and empties the bucket when you remove the stack

Cost and removal

A typical run costs a few cents in CodeBuild time, plus USD 0.01 for Cost Explorer. The template is plain text, so you can review every permission before you deploy it. The assessment code is verified with a SHA-256 checksum before it runs.

To remove it, delete the KloudCareAssessment stack in CloudFormation. This removes the role, the job, the function, the bucket and all reports.

Want help with the results?

AWS Health Check

From £395

An expert review of what an automated scan cannot see: architecture, disaster recovery, access design and cost strategy, with a prioritised roadmap and a fixed-price quote. If you go ahead with the fixes within 30 days, we deduct the Health Check fee. More about the Health Check.

AWS Cost Watch

£300 / month

Re-runs the assessment every month, reviews the changes with you and includes up to 2 hours of small fixes. How Cost Watch works.