CloudSentry: A Zero-Cost AWS Security Watchdog I Built in a Weekend

Every weekend I used to spend 30-45 minutes clicking through the AWS console, checking security groups across regions, verifying IAM access keys weren't stale, making sure nobody had opened port 22 to the world again. Three accounts. Every single week.

That's a Cloud Operations problem disguised as a routine. And routine is what automation eats for breakfast.

The Problem

If you manage AWS infrastructure, you know the drill: resources drift, people create things via the console and forget about them, security groups get opened "temporarily" and stay open forever, access keys age past 90 days, and S3 buckets lose their public access blocks during "quick fixes."

The AWS console is designed for interactive use, not periodic auditing. Security Hub exists but costs money and generates noise. Prowler is excellent but requires installation and manual runs. I wanted something that:

1. Runs automatically every week with zero intervention
2. Costs nothing (or near-nothing)
3. Tells me exactly what to fix with copy-paste commands
4. Tracks improvement over time
5. Works across multiple accounts
6. Deploys and destroys with a single command

What I Built

CloudSentry is a serverless Lambda function that scans your entire AWS account and generates a prioritized security report. It checks 10+ AWS services across all active regions:

Security scanning:

• IAM: root MFA, access key age, password policy, users without MFA, over-privileged roles
• Networking: security groups open to 0.0.0.0/0 on risky ports, VPCs without flow logs, orphaned resources
• Compute: EC2 with IMDSv1, public IPs, no IAM roles, stopped instances burning EBS costs
• Storage: S3 without public access blocks, no encryption, no versioning
• Databases: RDS publicly accessible, unencrypted, no backups
• Logging: CloudTrail disabled, GuardDuty off, alarms in ALARM state
• DNS: expiring ACM certificates, dangling CNAME records
• Encryption: KMS keys with wildcard policies, unrotated secrets

Policy enforcement:

• Tag compliance (configurable required tags with valid values)
• Naming conventions (flags auto-generated "launch-wizard" names)
• Architecture standards (resources in unapproved regions)
• Cost thresholds (with exclusions for known expensive services like Bedrock)
• Infrastructure drift (resources created outside Terraform)

Scoring:

• 0-100 security score, weighted by severity
• Week-over-week trend tracking
• CIS Benchmark compliance mapping

Cost intelligence:

• Gross spend (usage + subscriptions, matching the billing dashboard)
• Service-by-service breakdown
• Credits tracking (applied, coverage percentage)
• Burn rate (daily, monthly, annual)

Architecture

The architecture is deliberately simple. No containers, no orchestration, no state machines:

EventBridge (weekly Sunday 7am UTC) + API Gateway (on-demand)
  -> Lambda (Python 3.12, 5min timeout)
      |-- STS AssumeRole (multi-account scanning)
      |-- Read-only describe/list calls across all active regions
      |-- Cost Explorer API (spend, forecast, credits)
      |-- DynamoDB (stores scan history for trends)
      |-- SES (styled HTML email) + SNS (fallback)
      |-- S3 + CloudFront (HTML dashboard with custom domain)

Total monthly cost: $0.21. The only non-free-tier charge is Cost Explorer at $0.01 per API request.

The Cloud Operations Angle

This is fundamentally a Cloud Operations tool. It answers the questions every CloudOps engineer asks weekly:

• Is anything exposed that shouldn't be? (Security posture)
• Is anything costing money that doesn't need to? (FinOps)
• Did anyone create resources outside our IaC pipeline? (Drift detection)
• Are we following our own tagging and naming standards? (Governance)
• Are credentials and certificates approaching expiry? (Operational hygiene)

The difference from existing tools: it's opinionated, self-hosted, zero-cost, and gives you the exact CLI command to fix every finding. No dashboards to monitor, no agents to install, no subscriptions to manage.

Key Technical Decisions

Why Lambda, not ECS or EC2? Lambda's free tier is 1M requests/month. A weekly scan is 4 invocations. That's effectively infinite free runway. Plus, no patching, no uptime concerns, and the function only exists when it's running.

Why Terraform, not SAM or CDK? terraform destroy removes everything cleanly. No orphaned CloudFormation stacks, no manual cleanup. And it's familiar to the DevOps audience who'll use this.

Why SES over SNS for email? SNS can't render HTML. If you want a styled report in Gmail, you need SES. The Lambda falls back to SNS (plain text with dashboard link) if SES isn't configured.

Why multi-account by default? Most production setups have at least 2 accounts. The tool assumes a read-only role in each target account. Single-account mode is just an empty accounts list in config.

What I Learned

1. Cost Explorer's UnblendedCost metric nets out credits. If credits cover your bill, it shows $0. You need to group by RECORD_TYPE and sum Usage + FlatRateSubscription to match what the billing dashboard shows.

2. AWS doesn't expose remaining credit balance via API. You can see credits applied but not what's left in the pool. I built around observable data instead: total applied, monthly trend, and coverage percentage.

3. Gmail strips <style> tags entirely. Email HTML must use table-based layouts with all styles inlined. Dark themes work if you put background-color on <td> elements, not on <body>.

4. Multi-region scanning is slow. 18+ regions at 5-10 API calls each adds up. The optimization: quick-check each region for any active resources before running the full scanner suite. Cut execution time by 60%.

Try It

CloudSentry is open source. Deploy it in your own account:

git clone https://github.com/durrello/cloudsentry.git
cd cloudsentry/terraform
cp terraform.tfvars.example terraform.tfvars
terraform init && terraform apply

One command up, one command down. See the live dashboard at cloudsentry.durrellgemuh.com or browse the source on GitHub.

If you're managing AWS infrastructure and spending time on manual audits, this eliminates that chore permanently for less than a quarter per month.