Your complete AWS audit — cost savings and security posture in minutes
Runs on your machine in under 5 minutes. Connects with read-only credentials, scans for cost waste and security gaps, opens a full HTML report in your browser — nothing leaves your machine.
- Free — top 50 findings, no sign-up
- Runs locally, nothing shared
- Works with any AWS profile or SSO
- Cost + security posture in one report
- HTML + JSON/CSV outputs
40+ checks across 13 AWS services. Cost savings + security posture in one audit.
Every run produces a full audit: cost findings with savings estimates, security posture signals, and remediation commands — summary, HTML, and JSON/CSV artifacts.
EC2 Savings
Security Posture
EBS + Snapshots
RDS Signals
Network Waste
Custom Configuration
CloudWatch (Optional)
Privacy-First
Workflow Outputs
Technical details (permissions, outputs, trust model)
- • Runs on your machine or in CI/CD — no SaaS ingestion of AWS credentials, ever.
- • Uses a customer-controlled read-only role (AssumeRole) and reads only metadata + aggregate metrics.
- • Outputs a summary + HTML report + JSON/CSV findings, with copyable verification commands.
- • Optional CloudWatch enrichments use a bounded query budget and include provenance.
How it works
- 1
pip install stacksage
One command. No containers, no CI setup. Python 3.10+ required.
- 2
Configure AWS access
Works with any credential method: ~/.aws/credentials, env vars, SSO profiles, or a read-only IAM role ARN.
- 3
stacksage scan
Scans EC2, RDS, EBS, Lambda, S3, IAM, networking, and more. Completes in 2–5 minutes.
- 4
Get your audit report
HTML report opens in your browser automatically. JSON/CSV for automation. Markdown summary ready to paste into Slack or an exec email.
First look: what you get after one run
Before you wire anything up, here's the proof: a real audit pack output (summary + HTML + JSON/CSV) from an actual StackSage run.
Summary (human-readable)
A one-page markdown summary you can paste into Slack, Jira, or an exec email.
# StackSage Audit Summary
- Findings: 17
- Est. monthly savings: $312.40
- CloudWatch metrics: enabled (14d lookback)
Top 3 actions:
1) Delete unused EBS volumes (~$84/mo)
2) Migrate gp2 → gp3 (~$51/mo)
3) Fix open security groups (posture)
Findings (machine-readable)
JSON + CSV outputs for automation, dashboards, and internal reporting.
[{
"type": "ec2_idle_instances",
"resource_type": "ec2",
"id": "i-0abc123...",
"severity": "high",
"confidence": 0.9,
"estimated_monthly_savings_usd": 74.12,
"verification_commands": ["aws ec2 describe-instances ..."]
}]
Report (shareable HTML)
An HTML report your team can open without needing the CLI installed.
audit_report.html
- Executive summary
- Evidence & metrics
- Remediation commands
- Provenance (budget + errors)
See exactly how it works
Step-by-step walkthrough: install → scan → report. What each output looks like and what to do next.
Open the full sample report
The embedded report includes concrete savings estimates, confidence scores, and copyable verification commands.
What you need to run it
- • Python 3.10+
- • AWS credentials (any method: env vars, ~/.aws/credentials, SSO, or IAM role)
- • 2–5 minutes for a full scan
StackSage reads only metadata and aggregate metrics. Nothing leaves your machine — no SaaS ingestion.
Paid GitHub Workflow ($99/mo)
Request access to the private image + workflow for full coverage. Trial is self-serve; paid access is approved via this form.
- • Private GHCR image + time-limited license
- • Deeper coverage and richer evidence
- • Designed for recurring weekly/daily runs
Questions? Email us at [email protected].
Simple, Transparent Pricing
Free: pip install stacksage and scan immediately — no sign-up. Pro unlocks all findings, remediation plans, and CI scheduling.
Free
pip install stacksage — runs on your machine, nothing shared
Free
- • pip install stacksage (no sign-up)
- • Full infrastructure scan
- • Top 50 findings by estimated savings
- • Security & posture checks (always full)
- • HTML report + JSON/CSV output
- • No remediation plan
Pro
All findings, remediation plan, and scheduled CI audits
$99/mo+ taxes
- • All findings — no cap
- • Full remediation plan with fix commands
- • Schedule via GitHub Actions (pip-based, 2 secrets)
- • stacksage audit for CI/CD pipelines
- • Email support — 48h response
- • Cancel anytime
Free tier needs no sign-up — just pip install stacksage and your AWS credentials.
To cancel your subscription, use the Paddle customer portal link in your receipt email or contact [email protected].
FAQ
Where does StackSage run?
Inside your GitHub Actions runner (in your repo).
Can I run the Trial without contacting you?
Yes. Trial is self-serve: create a read-only IAM role, add GitHub secrets, copy the workflow, and run it. Full steps are on /docs.
How is Trial delivered?
As a public Docker image pulled from GHCR and run by your workflow (no license required).
How is the paid GitHub Workflow delivered?
As a private Docker image pulled from GHCR, run by your workflow, with a time-limited license secret.
Do you ingest AWS credentials?
No. AWS access is via a customer-controlled read-only IAM role used by your workflow.
What do I get as output?
A full audit pack: a one-page summary, an HTML report, and machine-readable findings (JSON/CSV) as workflow artifacts.
Is this just a cost tool?
No. StackSage combines cost savings, guardrails, and security posture signals so teams get a complete audit view in one report.
Does Trial include savings ($) estimates?
Trial includes a limited cost/waste preview but does not compute exact savings. The paid workflow unlocks deeper coverage and quantification.
Findings are based on what the workflow can read with the permissions you grant; outcomes vary by account and usage.