Practical AWS SDK for JavaScript Examples

Query Cost Explorer for last month’s unblended cost, grouped by service.

Pull a monthly cost and usage report grouped by service to see where spend goes.

Total the month-to-date unblended cost of CloudWatch alone.

Check 24 hours of CPU utilization for running instances and stop those under 20%.

List volumes with no attachments and tag them for review, without deleting anything.

Find Elastic IPs that aren’t attached to an instance and release them.

Deregister private AMIs older than 30 days and delete their snapshots.

Compare a table’s provisioned read and write capacity with last month’s consumption.

List active Reserved Instances ending in the next 30 days, before on-demand rates kick in.

Find log groups kept forever, ranked by stored GB, and set a retention period on them.

Report NAT gateways with no routes or no traffic in 14 days, and what each one costs.

Flag ALBs and NLBs with no targets, no healthy targets or no traffic, with their hourly cost.

List manual RDS and Aurora snapshots past an age limit; delete only with --delete --apply.

Flag RDS instances with zero DatabaseConnections in 14 days and estimate their monthly cost.

Find ECR repos without a lifecycle policy, estimate the savings and set one with --apply.

Find alarms stuck in INSUFFICIENT_DATA on deleted metrics; delete them with --apply.

List ENIs with status available, skip service-managed ones, delete yours with --apply.

Find interface VPC endpoints with zero BytesProcessed in 14 days and their hourly cost.

List resources missing required tag keys in each Region with GetResources, plus CSV export.

Create a monthly cost budget with ACTUAL/FORECASTED email or SNS alerts; safe to re-run.

Find EBS snapshots whose volume is gone and no AMI uses; archive or delete behind --apply.

Caches with zero GetTypeCmds/SetTypeCmds in 14 days, node-based and serverless.

Savings Plans coverage by month, uncovered On-Demand spend by service, utilization and AWS’s recommendation.

List secrets nobody retrieved in 90 days via LastAccessedDate; schedule deletion safely.

Average up to 90 days of Spot prices per Availability Zone and compare the cheapest zone with On-Demand.

Compare io1/io2 provisioned IOPS with 14-day peaks and price the cut.

Find EFS file systems with no lifecycle policy and set IA/Archive transitions.

Find tables with zero reads and writes in 30 days and price their storage and provisioned capacity.

List dashboards past the free tier, flag stale ones and delete them behind --apply.

Find real-time endpoints with no invocations in N days and delete them behind --apply.

Flag clusters with no connections in 14 days and compare pausing with a final snapshot.

Find domains with no search or indexing traffic in 14 days and what they cost to keep.

Size the hidden parts of abandoned multipart uploads per bucket and abort old ones with --apply.

Find log groups with no data or no recent events, including ones left by deleted Lambda functions.

Flag clusters idle for hours and set an auto-termination policy with --apply.

Find WorkSpaces with no recent logins and switch them to AutoStop with --apply.

List clusters past standard support, their end dates and the extra hourly cost until you upgrade.

Find instances and clusters on engine versions that incur Extended Support charges, with their dates.

Find attachments with no traffic in 30 days and what each one costs per month.

Find replication instances with no running tasks and delete empty ones with --apply.

Find repositories with no pulls or pushes in N days, size their storage and delete them with --apply.

Find streams with no records in or out for 14 days and what their shards and retention cost.

Flag Kafka clusters with no traffic in 14 days and price their brokers and storage.

Find FSx file systems with no reads or writes in 14 days and what they cost to keep.

Find old snapshots worth archiving, estimate the saving and move them with --apply.

Find proxies with no client connections in 14 days and delete them with --apply.

Find environments with no traffic, list what they run and terminate them with --apply.

Pull Compute Optimizer findings and estimated monthly savings for every EC2 instance.

Find notebook instances left running and stop them with --apply.

List Fargate services on on-demand capacity and estimate what Fargate Spot would save.

Find capacity reservations with unused slots and what they cost, and cancel them with --apply.

Find Dedicated Hosts running no instances and release empty ones with --apply.

Measure how much of each versioned bucket is old versions and delete markers, and the lifecycle fix.

Upload content with PutObjectCommand from @aws-sdk/client-s3.

Generate a time-limited upload URL with getSignedUrl, so clients can upload without AWS keys.

Use headObject to test for an object without downloading it, and handle NotFound.

Read the free daily BucketSizeBytes metric for every bucket and find the largest.

Check the versioning status of every bucket and return the ones that aren’t versioned.

Multipart uploads with Upload from @aws-sdk/lib-storage: part size, progress and aborts.

List S3 buckets with no lifecycle rules, sized from CloudWatch, and add a multipart cleanup rule.

Check each bucket policy for an aws:SecureTransport deny; add it with --apply.

Find buckets with ACLs still on and switch them to Bucket owner enforced where it’s safe.

Inspect each bucket’s ACL for grants to all users or all authenticated users.

Flag security group rules that allow overly broad access to a list of common ports.

Use STS GetCallerIdentity to find the assumed role, then read its policy from IAM.

Flag console IAM users with no MFA device using ListUsers, GetLoginProfile and ListMFADevices.

Find access keys older than 90 days or unused for 45, with a dry-run --deactivate flag.

Find unencrypted EBS volumes in every Region and turn on EnableEbsEncryptionByDefault.

Find EBS, RDS and Aurora snapshots shared with everyone and make them private.

List IAM roles unused for 90 days with RoleLastUsed, skipping service-linked roles.

Find security groups no network interface or rule uses; delete them only with --apply.

Report customer managed KMS keys with no recent use via GetKeyLastUsage and CloudTrail.

Find DynamoDB tables without point-in-time recovery, see the cost, and enable PITR with --apply.

Find instances that still accept IMDSv1, count their MetadataNoToken calls and require IMDSv2.

Find ACM certificates expiring soon and why they won’t auto-renew (imported, unused, CNAME gone).

Check every enabled Region for a logging CloudTrail trail with read and write management events.

Find Regions with no GuardDuty detector or a suspended one; create missing ones with --apply.

Flag ALB HTTP listeners that don’t redirect to HTTPS and TLS policies still allowing TLS 1.0/1.1.

Flag SQS queues with no RedrivePolicy, broken DLQ targets and DLQs filling up.

Find RDS and Aurora instances with PubliclyAccessible, IGW routes and open security groups.

Find RDS databases with backups off, no encryption or no deletion protection; enable backups with --apply.

Find managed and inline IAM policies with Action "*", NotAction or iam:*.

Check the AWS Config recorder, its scope and delivery channel in every Region.

Find plaintext passwords in ECS task definition environment and map secrets to execution roles.

List EKS clusters whose API endpoint is public to 0.0.0.0/0, with CIDRs and auth mode.

Instances with public IPv4 or IPv6, Elastic IP vs auto-assigned, subnet auto-assign and world-open ports.

Audit every IAM role trust policy for other accounts, Principal * and missing sts:ExternalId.

Find KMS keys with rotation off and turn it on with EnableKeyRotation behind --apply.

Flag SNS topic and SQS queue policies with Principal * and no source or org condition.

Find AMIs shared with all, check block public access per Region, make them private.

Report flow log coverage for VPCs in each Region and create S3 flow logs for gaps behind --apply.

Find default VPCs in every Region, see what still uses them and delete empty ones behind --apply.

Check root MFA, active root access keys, signing certs and recent root sign-ins from one script.

List IAM users with managed or inline policies attached directly, plus groups to move them into.

Flag REST methods and HTTP routes with NONE auth, weighed against API keys and resource policies.

Audit access logs, execution logs and X-Ray per API stage; turn on access logs with --apply.

Find ECR repos without automatic scanning and CRITICAL findings; add a scan rule with --apply.

Run drift detection on every CloudFormation stack and list changed properties.

Check Security Hub, enabled standards and cross-Region aggregation per Region; enable it with --apply.

Find Regions with no Access Analyzer, summarise active public and cross-account findings, create one with --apply.

List key pairs no instance or launch template references and delete them behind --apply.

Flag distributions with no web ACL and show the managed rule groups on the ones that have one.

Find groups still on launch configurations and the steps to move each one to a launch template.

Find in-use volumes with no snapshot in N days, checked against AWS Backup and DLM coverage.

List databases with StorageEncrypted off and the snapshot-copy steps to encrypt them.

Flag instances and Aurora clusters without deletion protection and turn it on with --apply.

Find buckets with access logging off and enable it to a target bucket with --apply.

Compare the account password policy with CIS recommendations and update it with --apply.

Flag task definitions with privileged containers, root users, added capabilities or host networking.

List queues and topics with no server-side encryption and turn on SSE-SQS with --apply.

Check at-rest and in-transit encryption and AUTH/RBAC on every cache, with the fix for each gap.

Flag secrets with rotation off, overdue or failing, and trigger rotation with --apply.

Find String parameters that look like secrets and convert them to SecureString.

Check Inspector scan types, coverage and critical findings per Region; enable it with --apply.

Flag ALBs, NLBs and Classic ELBs with access logging off and enable it to a bucket with --apply.

Find Systems Manager documents shared with all accounts and make them private with --apply.

List certificates nothing uses, plus expired and stuck ones, and delete unused ones with --apply.

Check Macie status and automated sensitive data discovery per Region; enable it with --apply.

Compare RDS, DynamoDB, EFS, EBS and EC2 inventory with AWS Backup protected resources and recovery points.

Flag state machines with logging off or X-Ray disabled and turn on logging with --apply.

List user pools with MFA off, their password policy and threat protection, and set MFA to optional.

List log groups with no customer managed KMS key and associate one with --apply.

Find VPCs with no DNS query logging and associate a query log config with --apply.

Flag distributions with neither legacy standard logging nor CloudWatch Logs delivery configured.

List peerings, cross-account peers, peerings with no routes and routes that point nowhere.

List SAML and OIDC providers, the roles that trust them and trust policies missing audience or subject conditions.

Find IAM server certificates that expired or nothing uses, and delete safe ones with --apply.

Report each vault’s lock mode, retention limits and whether its access policy blocks deletes.

List root stacks that can be deleted in one call and turn protection on with --apply.

Call a function with LambdaClient and InvokeCommand, synchronously or as an event.

Use CloudWatch GetMetricData to count invocations per function and rank the busiest.

Remove every published version of a function except $LATEST.

Every function on a deprecated runtime across all regions, with the dates updates get blocked.

List Lambda function URLs with AuthType NONE and a public resource policy, plus CORS.

Compare each function’s peak memory with its setting and estimate the GB-second savings.

Scan every Lambda function’s env vars for keys and tokens; prints names and masked hints, never values.

Find functions with no on-failure destination or DLQ and add an SQS destination with --apply.

Flag execution roles with admin access or wildcard actions and roles shared across many functions.

List x86_64 functions, check layers and runtimes for arm64 readiness and estimate the saving.

Find provisioned concurrency with low utilization and remove it with --apply.

Find SQS event source mappings without ReportBatchItemFailures and check visibility timeouts.

Find layer versions no function uses, see code-storage usage and delete them with --apply.

Compare each function’s timeout with its p99 and maximum duration and suggest a tighter value.

Build an inventory of instance IDs, types and launch times with describeInstances.

Check which instances aren’t running as a first step, with notes on security groups and network ACLs.

Look up addresses in an availability zone with the EC2 API to find one you can use.

Move gp2 volumes to gp3 with matched IOPS and throughput, per-volume savings and a dry run first.

List EC2 instances stopped for weeks with the EBS and Elastic IP charges they still run up.

List running EC2 instances Systems Manager can’t reach, with the likely cause for each.

List EC2 instances on previous-generation types, with same-size m7i/m7g picks and prices.

Create an alias A record for the www subdomain that targets your CloudFront distribution.

List hosted zones and distributions and find the one that should be serving your domain.

Flag CloudFront distributions that still allow TLS 1.0/1.1, default certs or weak origin TLS.

Flag hosted zones with only SOA/NS records, no delegation or zero DNSQueries.