An AWS account nobody was governing

01Where it started

Years with no governance: over 300 GB in buckets nobody used, stopped instances paying for their disks, and fifty users who had not logged in for months, with no second factor and too many permissions. No spending cap.

02What could not move

• Every permission is cut back to what the person uses.
• Nothing is deleted until someone on the client side confirms what it is.
• Whatever is put in order has to hold on its own.

03The decision

Access and spend as one problem: an unowned bucket and an inactive user are the same oversight. Sign-in moved to a central identity point with a second factor, instead of users holding long-lived keys. Permissions were cut back to what each person used, and the per-project instances and the bastion were sized to their real load. On top, budgets with alerts that warn before the month closes.

05The result

Fifty inactive accounts removed and unused storage freed: about $100 a month less. The figure is not the point: the account has a ceiling before the invoice arrives, every sign-in has a name and a second factor, and no permission exceeds what its owner uses.