Find the cracks in your AWS.
A read-only AWS scanner that shows where your account needs attention, which resources are affected, and how to fix them.
Posture score
60 / 100Security · 14 failed · 20 passed
Root account without MFAExplore a scan
Compare sample scans, filter findings by severity, and open any result to see the affected resource and the suggested fix.
Demo account. A fictional company’s account with saved results for Security, Reliability, and Cost. The sample runs against mocked AWS.
Security
61 / 100
14 failed, 20 passed
Reliability
60 / 100
7 failed, 12 passed
Cost
52 / 100
9 failed, 10 passed
- Passed
- Critical
- High
- Medium
- Low
- One block is one check on one resource. Select a block to open it.
Failed checks by
Failed checks by
Findings
| Critical | Account | Failed |
| High | Account | Failed |
| High | sg-c5f72f95eb2584380 | Failed |
| High | sg-f8974a65f5946516a | Failed |
| High | legacy-admin | Failed |
| High | contractor-temp | Failed |
| High | analytics-dev | Failed |
| High | analytics-dev | Failed |
| High | northwind-marketing-site | Failed |
| Medium | worker-asg | Failed |
| Medium | sessions | Failed |
| Medium | Account | Failed |
| Medium | vol-97ac3aa0d2e5bd551 | Failed |
| Medium | vol-9762f60bf54309c9d | Failed |
| Medium | api-v1-retired | Failed |
| Medium | Account | Failed |
| Medium | deploy-bot | Failed |
| Medium | metrics-exporter | Failed |
| Medium | reporting-eu | Failed |
| Medium | analytics-dev | Failed |
| Low | vol-1cdcdd5571ed0e8cc | Failed |
| Low | vol-97ac3aa0d2e5bd551 | Failed |
| Low | snap-eb087b1e80264f1f8 | Failed |
| Low | snap-ab52327ed7b81110e | Failed |
| Low | eipalloc-a88a0dfac7380c85d | Failed |
| Low | image-thumbnailer | Failed |
| Low | /aws/lambda/image-thumbnailer | Failed |
| Low | northwind-marketing-site | Failed |
Showing 30 of 72 findings, with repeats across regions shown as one row (28 rows)
From scan to fix.
Connect with a read-only role
Authorize a role for the account you want to review. LytaScan reads configuration and metrics using the permissions you grant.
Run a scoped scan
Choose a full, quick or single-pillar scan in the workspace. Track progress by check and region as evaluations finish.
Review and verify findings
Open a finding to see the affected resource and suggested fix. After a change, rerun the check to verify it.
python -m scanner --report-version 2 --regions us-east-1The CLI uses your configured AWS credentials and writes a JSON report. Use --catalog to browse the rules without connecting to AWS.
Six pillars. 61 checks.
See what the scanner looks for across the AWS Well-Architected Framework.
| Pillar | Checks | Example check |
|---|---|---|
| Security | 17 | Instance metadata endpoint allows IMDSv1 |
| Reliability | 12 | DynamoDB table lacks deletion protection |
| Cost | 7 | Unattached EBS volume |
| Operational Excellence | 13 | CloudWatch metric alarm actions disabled |
| Performance Efficiency | 10 | RDS instance has low observed free storage |
| Sustainability | 2 | S3 bucket lacks bucket-wide multipart upload cleanup |
Browse the full check catalog
Security
- CloudTrail delivery has no configured KMS key
- CloudTrail log integrity validation is disabled
- CloudTrail not enabled in all regions
- EBS default encryption off
- EBS volume is unencrypted
- Instance metadata endpoint allows IMDSv1
- Security group open to the internet on port 22 or 3389
- ECR repository allows image-tag overwrites
- GuardDuty not enabled
- Access key older than 90 days
- IAM policy granting * on *
- Root user has an access key
- Root account without MFA
- IAM user without MFA
- Publicly accessible RDS instance
- RDS instance storage is unencrypted
- S3 bucket without public access block
Reliability
- Auto scaling group in a single availability zone
- Auto Scaling group has unhealthy in-service instances
- DynamoDB table lacks deletion protection
- DynamoDB table without point-in-time recovery
- EFS automatic backups are not enabled
- Load balancer target group has unhealthy targets
- Lambda function without a dead-letter queue
- RDS automated backups disabled
- RDS instance lacks deletion protection
- RDS instance without Multi-AZ
- S3 bucket without versioning
- SQS queue marked for dead-letter handling has no redrive policy
Cost
- gp2 volume that could be gp3
- Paid gp3 throughput has low observed hourly utilization
- EBS snapshot older than 90 days
- Unattached EBS volume
- Unassociated Elastic IP
- Load balancer with no targets
- CloudWatch log group with no retention set
Operational Excellence
- HTTP API stage access logs not configured
- REST API stage access logs not configured
- Most recent AWS Backup job did not complete successfully
- CloudFormation stack rollback failed
- CloudWatch metric alarm actions disabled
- Latest CodePipeline execution failed
- AWS Config delivery failed
- AWS Config recorder stopped
- Opted-in EC2 instance is not online in Systems Manager
- Opted-in EC2 instance has pending or failed baseline patches
- ECS rolling service has no automatic deployment rollback
- Primary ECS rollout failed
- Step Functions Express workflow execution logs not configured
Performance Efficiency
- DynamoDB table read throttling exceeds the review threshold
- DynamoDB table write throttling exceeds the review threshold
- EC2 CPU utilization exceeds the review threshold
- Optional EBS optimization disabled
- ECS service CPU utilization exceeds the review threshold
- ECS service memory utilization exceeds the review threshold
- Lambda has low observed timeout headroom
- Lambda invocation throttling exceeds the review threshold
- RDS CPU utilization exceeds the review threshold
- RDS instance has low observed free storage
Sustainability
- S3 bucket lacks bucket-wide multipart upload cleanup
- Versioned S3 bucket lacks bucket-wide noncurrent lifecycle management
Built in the open.
LytaScan is an independent portfolio project by Asiwome Boateng. The scanner is written in Python and the infrastructure is managed with Terraform.
Hosted account connections are currently paused. The public demo runs on included sample data.
Explore the source on GitHub