Cloud Security AI Scan: Quick AWS security & billing scan from the CLI

One prompt, not a runbook

I am getting lazy. I wanted a fast read-only sanity-check on my old AWS account. I didn’t sit there typing aws commands. I gave Claude Code one prompt and let it run the read-only calls itself.

Note that awscli was preauthenticated with a short token token.

Do a read-only security and billing sanity-check on my AWS account using awscli.

Only read state — do not change anything.

Then triage: what must I fix now vs. configure later.

That’s the whole scan. Everything below is what came back, not commands I ran.

Triage findings from the AI Agent

Fix now — anything that lets an attacker in or blinds you:

• Root has access keys → delete them; operate via IAM users/roles.
• No CloudTrail → create a multi-region trail so you have an audit log.
• GuardDuty off → enable it (30-day free trial, then cheap at low usage).
• Admin/privileged IAM user without MFA → enforce MFA.
• A sensitive bucket missing its public-access block → set one.

Configure later — hygiene that lowers risk over time:

• Set an account password policy (length, complexity, rotation).
• Enable MFA on all IAM users, not just the admins.
• Set the account-level S3 public-access block as a blanket safety net.
• Deactivate and delete never-used or stale access keys.
• Add a forecasted-spend budget alert and a low cost-anomaly monitor — at a near-zero baseline, even a small spike (e.g. crypto-mining) is a strong signal.

Basically all of them are correct. I am such a lousy developer.

Gotchas

• CloudTrail and GuardDuty are per-region. A clean result in one region says nothing about the others — tell the agent to include us-east-1, where many global events land.
• Cost Explorer isn’t free-free. Its API calls cost a small per-request fee. Negligible for a one-off scan, worth knowing before you loop it.
• Run it as an IAM user, not root. If your only working credential is a root access key, that itself is the first thing to fix.