# AWS cost and security review: find the waste and the risky settings.

> A read-only AWS cost and security review for UK businesses, £665 fixed price: you give us a read-only role in your own AWS account, we go through the bill and the configuration, then hand you a report with savings and security fixes in order of impact. We cannot change anything, and we do not resell AWS, so we have no reason to grow your bill.

Source: https://wharfcloud.co.uk/aws-cost-security-review · Last updated 21 October 2026 · WharfCloud

## At a glance

- **Price:** £665 one-off (list £950)
- **Access:** Read-only IAM role, removed afterwards
- **What you get:** Written report and walkthrough call
- **Your account:** Stays yours; AWS keeps billing you
- **Try first:** Free AWS bill X-ray tool

## Where we look for savings

- **Idle and forgotten resources.** Stopped instances with attached disks, unattached EBS volumes, old snapshots, unused load balancers and Elastic IP addresses.
- **Right-sizing.** Instances and databases sized for a peak that never comes, and older instance families with cheaper current equivalents.
- **Commitments.** Whether Savings Plans or Reserved Instances fit your steady usage, and how much of the commitment you would actually use.
- **Storage.** gp2 volumes that could move to gp3, S3 data that belongs in a cheaper storage class, and log groups kept forever.
- **Networking.** NAT Gateway processing charges, cross-zone and internet data transfer, and public IPv4 addresses, which AWS has charged for since February 2024.

Want a first look on your own? Upload your Cost Explorer export to our free [AWS bill X-ray](https://wharfcloud.co.uk/tools/aws-bill-xray). It runs in your browser and the file never leaves your device.

## What we check on security

- Root account use, root access keys and multi-factor authentication.
- IAM users with old access keys, broad permissions or no MFA.
- Publicly accessible S3 buckets, snapshots and databases.
- Security groups open to the whole internet on SSH, RDP and database ports.
- CloudTrail logging, and whether GuardDuty or Security Hub findings are being read by anyone.
- Encryption defaults, backup coverage and retention for the data that matters.

We use AWS's own published best practice, such as the [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html), and explain each finding in plain English with the fix.

## How the read-only access works

1. **Book online.** Pay by card. A person checks every first order before work starts.
2. **Create a role.** We send you a short template that creates an IAM role in your account with AWS-managed read-only and security-audit policies, plus billing read access, limited to our account and an external ID.
3. **Review.** We read your bill and configuration. The role cannot create, change or delete anything.
4. **Report and remove.** You get the report and a walkthrough call, then you delete the role. We remind you to.

## Price

- **Review:** £665 intro price (first 50 customers), £950 list price (one-off). Read-only access, written report. Includes: Cost breakdown and savings list; Security configuration check; Read-only access only.

Prices in GBP. No VAT is added: we are not VAT registered. Order online: https://wharfcloud.co.uk/app/order/aws-cost-security-review?plan=standard

## Questions we get asked

### Can you change anything in our account?

No. The role uses read-only and security-audit permissions only. You can see exactly what it allows before you create it, and delete it at any time.

### Do you resell AWS or take a cut of our bill?

No. AWS keeps billing you directly. Our only fee for the review is the fixed price on this page.

### Will you promise a percentage saving?

No. Every account is different and we will not invent a figure. The report lists each saving we find with our estimate of its size, so you can decide which ones are worth doing.

### Can you implement the fixes?

Yes, if you want. You can do them yourselves from the report, or move to [Managed AWS](https://wharfcloud.co.uk/managed-aws) where we run the account day to day.

---

WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered.
Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends.
Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact