parlak.us
Get started

Cloud Health Check for AWS and Microsoft Azure

Find the wasted spend and security gaps in your AWS and Azure accounts.

A self-service tool that scans your AWS accounts and Azure subscriptions with read-only access, ranks what to fix first, estimates what each fix saves per month, and rescans automatically every week.

Start your 7-day free trial Try the demo

Read-only accessFirst results in minutesCancel any time

checkup.parlak.us/report Report ready

Sample health check

Illustrative
Est. monthly savings
$1,032
Checks run
183 AWS
  • CriticalPublic S3 bucketsRisk
  • HighRDS and Aurora engines in paid Extended Support$468/mo
  • MediumOver-provisioned instances$412/mo
  • Lowgp2 volumes that should be gp3$152/mo

01 What the tool checks

291 checks. Five pillars. Two clouds.

183 checks for Amazon Web Services and 108 checks for Microsoft Azure, grouped by the Well-Architected Framework pillars both clouds share. Each finding includes a severity rating, an estimated monthly cost where applicable, and step-by-step remediation. You choose which checks run on each account, adjust their thresholds, and suppress findings you've decided to accept.

183Amazon Web Services checks

108Microsoft Azure checks

Showing 183 checks

Amazon Web Services · 183 checks

Security

69 checks
Identity and access 18
  • AWSCloudShellFullAccess in use
  • Console users without MFA
  • Customer-managed policies that allow everything
  • EC2 instances with administrator roles
  • IAM Access Analyzer turned off
  • IAM policies attached directly to users
  • IAM roles trusting other accounts without an External ID
  • No role for AWS Support
  • Old or unused access keys
  • Resources shared outside the account
  • Resources shared outside the organization (RAM)
  • Root user protection
  • Root user used recently
  • Secrets Manager secrets without rotation
  • Unused IAM roles
  • Users with full administrator access
  • Users with two active access keys
  • Weak IAM password policy
Network exposure 11
  • CloudFront serving HTTP or old TLS
  • Default security groups that allow traffic
  • EKS clusters with an open API endpoint
  • Instances allowing IMDSv1
  • Internet-facing load balancers without AWS WAF
  • Lambda functions anyone can invoke
  • Load balancers allowing old TLS versions
  • Load balancers serving plain HTTP
  • Network ACLs open to the internet on SSH or RDP
  • Security groups open to the internet
  • VPCs without flow logs
Data protection 27
  • AMIs shared with other accounts
  • CloudFront S3 origins without origin access control
  • CloudTrail logs not encrypted with KMS
  • CodeBuild projects with plain-text secrets or privileged mode
  • EBS encryption by default turned off
  • ECS task definitions with privileged containers or plain-text secrets
  • ElastiCache without encryption
  • Expired certificates stored in IAM
  • KMS keys open to everyone
  • KMS keys scheduled for deletion
  • KMS keys without automatic rotation
  • OpenSearch domains that are public or unencrypted
  • Parameter Store secrets saved as plain text
  • Public AMIs
  • Public EBS snapshots
  • Public RDS snapshots
  • Public S3 buckets
  • Publicly accessible RDS databases
  • RDS databases that accept unencrypted connections
  • S3 Block Public Access off for the account
  • S3 buckets that accept plain HTTP
  • S3 buckets without versioning
  • SQS queues and SNS topics without encryption
  • Secrets in Lambda environment variables
  • Unencrypted EBS volumes
  • Unencrypted EFS file systems
  • Unencrypted RDS databases
Logging and threat detection 13
  • API Gateway stages without logging or WAF
  • AWS Config recording
  • Amazon Inspector off where instances run
  • CloudTrail buckets without access logging
  • CloudTrail logging
  • Container images not scanned
  • DNS query logging off
  • EKS clusters without audit logs
  • GuardDuty threat detection
  • Missing CloudWatch alarms for security events
  • No CloudTrail logging of S3 object access
  • No security contact on the account
  • Security Hub turned off

Reliability

34 checks
Backups and recovery 11
  • Backup vaults without Vault Lock
  • Backups kept in one region only
  • Databases, file systems and instances AWS Backup never backed up
  • DynamoDB tables without deletion protection
  • DynamoDB tables without point-in-time recovery
  • RDS backups kept less than a week
  • RDS backups not copied to another region
  • RDS databases without automated backups
  • RDS databases without deletion protection
  • Regions without an AWS Backup plan
  • Versioned S3 buckets without replication
High availability 19
  • Aurora clusters with a single instance
  • Auto Scaling groups ignoring load balancer health
  • Auto Scaling groups in one Availability Zone
  • Dedicated Hosts without host recovery
  • Direct Connect without a backup path
  • ECS services running a single task
  • ECS services running fewer tasks than they should
  • EKS node groups in one Availability Zone
  • EKS node groups with health issues
  • ElastiCache without Multi-AZ failover
  • Event-driven Lambda functions that drop failed events
  • Load balancer targets failing health checks
  • Load balancers in one Availability Zone
  • One NAT gateway serving several Availability Zones
  • Route 53 failover records without health checks
  • SQS queues that hide messages for less time than their Lambda runs
  • SQS queues without a dead-letter queue
  • Single-AZ RDS databases
  • Site-to-Site VPNs running on one tunnel
Capacity and limits 4
  • Auto Scaling groups that never scale
  • RDS databases running out of storage
  • Service quotas close to their limit
  • Subnets running out of IP addresses

Cost optimization

40 checks
Storage costs 9
  • CloudWatch log groups that never expire
  • ECR repositories without a lifecycle policy
  • EFS file systems without a lifecycle policy
  • Old AMIs nobody launches
  • Old EBS snapshots
  • Old manual RDS snapshots
  • S3 buckets without lifecycle rules
  • Unattached EBS volumes
  • gp2 volumes that should be gp3
Unused resources 15
  • DMS replication instances with no running task
  • Dedicated Hosts with no or few instances
  • DynamoDB tables paying for unused capacity
  • Empty Route 53 hosted zones
  • Idle ElastiCache clusters
  • Idle NAT gateways
  • Idle RDS databases
  • Idle Redshift clusters
  • Idle Transit Gateway attachments
  • Idle instances, Auto Scaling groups and ECS services
  • Load balancers without targets
  • Stopped instances still paying for storage
  • Unassociated Elastic IPs
  • Unused On-Demand Capacity Reservations
  • VPCs sending S3 or DynamoDB traffic through NAT
Compute and commitments 7
  • Lambda functions with more memory than they use
  • Low Savings Plans coverage
  • Over-provisioned instances
  • Previous-generation instances
  • RDS databases on previous-generation classes
  • Under-used Reserved Instances and Savings Plans
  • VPCs and instances on dedicated tenancy
Spend visibility 9
  • EC2 - Other cost breakdown
  • High data transfer between Availability Zones
  • Missing budgets
  • Month-over-month spend increases
  • No Cost and Usage Report or data export
  • No active cost allocation tags
  • Public IPv4 address charges
  • Spend by service
  • Unusual charges

Operational excellence

35 checks
Accounts and governance 11
  • AWS Organizations and single sign-on
  • Accounts outside any organizational unit
  • Instances in unexpected regions
  • No organization-wide AWS Config aggregator
  • No organization-wide CloudTrail
  • No service control policies
  • No tag policies
  • Root access of member accounts not centralized
  • Security services not managed centrally
  • Service control policies missing key guardrails
  • Workloads running in the default VPC
Network design 2
  • Overlapping VPC address ranges
  • Route tables with blackhole routes
Lifecycle and modernization 5
  • EKS clusters in paid extended support
  • Instances on end-of-life operating systems
  • Instances running on old AMIs
  • Lambda functions on retired runtimes
  • RDS and Aurora engines in paid Extended Support
Patching and automation 5
  • CloudFormation stacks changed outside CloudFormation
  • CloudFormation stacks in a failed state
  • Instances Systems Manager cannot reach
  • Instances missing patches
  • RDS databases without automatic minor upgrades
Monitoring and tagging 12
  • ACM certificates expiring or not renewing
  • AWS Config rules with non-compliant resources
  • CloudFront distributions without logging
  • CloudTrail log file validation off
  • CloudWatch alarms nobody acts on
  • Instances failing status checks or due for maintenance
  • Instances without the CloudWatch agent
  • Load balancers without access logs
  • Public hosted zones without DNS query logging
  • Regions with workloads but no CloudWatch alarms
  • Resources without owner tags
  • Step Functions state machines without logging

Performance and sustainability

5 checks
Right-sizing and efficiency 5
  • Burstable instances out of CPU credits
  • DynamoDB tables throttling requests
  • Instances that could run on Graviton
  • RDS databases on gp2 storage
  • Under-provisioned instances and Lambda functions

Microsoft Azure · 108 checks

Security

43 checks
Identity and access 14
  • AKS clusters with local accounts on
  • AKS clusters without Kubernetes RBAC
  • Container registries with the admin user on
  • Cosmos DB accounts that accept account keys
  • Custom roles that allow every action
  • Key vaults on access policies instead of Azure RBAC
  • Linux VMs that allow password sign-in
  • More subscription Owners than needed
  • SQL servers without a Microsoft Entra administrator
  • Service Bus and Event Hubs namespaces that accept SAS keys
  • Storage account keys not rotated
  • Storage accounts that accept account keys
  • Storage accounts without a SAS expiry policy
  • Web apps without a managed identity
Network exposure 10
  • AKS API servers open to the internet
  • Cosmos DB accounts reachable from every network
  • Database servers open to the internet or to all of Azure
  • Internet-facing application gateways without WAF
  • Key vaults reachable from every network
  • Network security groups open to the internet
  • Premium container registries reachable from every network
  • Storage accounts reachable from every network
  • VMs with a public IP and SSH or RDP open to the internet
  • Web apps with remote debugging on
Data protection 15
  • Container apps that accept HTTP
  • Container registries anyone can pull from
  • Disks that can be exported from any network
  • Key Vault secrets, keys and certificates without expiry or expiring soon
  • PostgreSQL and MySQL servers that accept unencrypted connections
  • Redis caches that accept unencrypted connections
  • SQL databases without transparent data encryption
  • Service Bus and Event Hubs namespaces that accept TLS older than 1.2
  • Storage accounts that accept HTTP
  • Storage accounts that allow public blob access
  • Storage accounts that allow replication to other tenants
  • VMs without Trusted Launch
  • Web apps that accept HTTP
  • Web apps that accept TLS older than 1.2
  • Web apps that allow plain FTP
Logging and threat detection 4
  • Defender for Cloud off for resources you run
  • Defender for Cloud recommendations
  • No one gets Defender for Cloud alert emails
  • SQL servers without auditing

Reliability

16 checks
Backups and recovery 6
  • Backup vaults kept in one datacenter or region
  • Critical resources without a delete lock
  • Key vaults without purge protection
  • SQL databases without long-term backup retention
  • Storage accounts without soft delete or versioning
  • Virtual machines without backup
High availability 9
  • AKS node pools in one availability zone
  • App Service plans on one instance
  • Azure Advisor reliability recommendations
  • Cosmos DB accounts in one region or without point-in-time restore
  • PostgreSQL and MySQL servers without high availability or geo-redundant backups
  • Premium and Business Critical SQL databases without zone redundancy
  • SQL databases without a geo-replica
  • Storage accounts kept in one datacenter
  • VMs outside availability zones and sets
Capacity and limits 1
  • Scale sets without autoscale

Cost optimization

28 checks
Storage costs 5
  • Log Analytics workspaces with long paid retention
  • Old disk snapshots
  • Premium disks on deallocated VMs
  • Storage accounts without lifecycle management
  • Unattached managed disks
Unused resources 15
  • App Service Environments with no apps
  • App Service plans whose apps are all stopped
  • App Service plans with no apps
  • Application gateways with nothing behind them
  • Bastion hosts in networks with no VMs
  • Dedicated hosts with no VMs
  • ExpressRoute circuits with no peerings
  • Idle virtual machines
  • Load balancers with nothing behind them
  • NAT gateways on no subnet
  • Public IP prefixes with unused addresses
  • SQL elastic pools with no databases
  • Unused capacity reservations
  • Unused public IP addresses
  • VPN gateways with no connections
Compute and commitments 4
  • Azure Advisor cost recommendations
  • Stopped virtual machines still billed
  • VMs on older generations
  • Windows Server and SQL Server without Azure Hybrid Benefit
Spend visibility 4
  • Budgets that alert nobody
  • Month-over-month spend increases
  • Spend by service
  • Subscriptions without a budget

Operational excellence

17 checks
Accounts and governance 5
  • Azure Advisor operational excellence recommendations
  • Leftover network cards, NSGs, route tables and empty resource groups
  • No Azure Policy guardrails
  • Resources out of Azure Policy compliance
  • Subscriptions directly under the tenant root group
Lifecycle and modernization 3
  • AKS clusters on unsupported Kubernetes versions
  • Retired Azure services still in use
  • Web apps on runtimes past end of support
Patching and automation 1
  • VMs missing critical or security updates
Monitoring and tagging 8
  • Activity log not kept beyond 90 days
  • Key vaults without diagnostic logs
  • Missing activity-log alerts for risky changes
  • Networks without Network Watcher or flow logs
  • Resources without owner tags
  • VMs and scale sets with no alert rules in the subscription
  • VMs without boot diagnostics
  • VMs without the Azure Monitor agent

Performance and sustainability

4 checks
Right-sizing and efficiency 4
  • App Service plans running hot
  • Azure Advisor performance recommendations
  • B-series VMs out of CPU credits
  • Web apps without HTTP/2 or Always On

02 How it works

Three steps to your first findings.

You never share passwords, and our staff never see your data unless you buy our help and allow it.

1

Start your trial

Choose a plan and enter a card. You aren't charged until the 7-day trial ends, and you can cancel before then.

2

Connect read-only access

On AWS, deploy our one-click CloudFormation template to create a read-only IAM role; organizations onboard every account in one step. On Azure, paste one Cloud Shell script that creates a read-only managed identity, with no password or key anywhere. You can remove either at any time.

3

Review and fix

The first scan finishes in minutes. Work through the findings by priority, and the tool rescans weekly to track what you've fixed.

03 Pricing

Simple monthly pricing.

Every plan starts with a 7-day free trial. Pay by card, Apple Pay, Google Pay, or Amazon Pay. Prices are in US dollars; cancel any time.

Starter

$49/ month

  • 1 AWS account
  • Weekly automatic scans
  • All findings with fixes and savings
  • Alerts when each scan finishes
Start free trial

Team

Most popular

$149/ month

  • Up to 5 AWS accounts
  • Weekly automatic scans
  • REST API access
  • AWS Organizations import
Start free trial

Consultant

$299/ month

  • Up to 25 AWS accounts
  • Everything in Team
  • White-label PDF reports with your company name
  • Built for consultants managing many clients
Start free trial

Need an expert?

The tool is self-service. When you want hands-on help, buy professional-services hours at $150 an hour (blocks of 5, 10, or 20 hours) from your Billing page, or contact us about a TAM plan with a dedicated technical account manager. More than 25 accounts? Contact us for a quote.

$150per hour, in blocks of 5, 10, or 20

04 Questions

Frequently asked questions

Something else on your mind? Write to contact@parlak.us.

Is it safe to grant access?

Yes. On AWS the role, and on Azure the identity with the built-in Reader role, can read only configuration and billing data. They cannot create, change, or delete anything, and you can remove them at any time.

Does the tool connect into our network?

No. It never connects to your servers, opens a port in your network or installs an agent. It reads your cloud provider's own APIs, the same ones the AWS and Azure consoles use, through the read-only role or identity you create, and you can remove that access at any time. If your security team needs the findings to stay inside your own account, contact us.

Can your staff see my data?

No. Your plan is self-service, and our staff cannot see your accounts or findings. If you buy professional-services hours or a TAM plan, you can allow our engineers to see them while they help you, and revoke that at any time.

When am I charged?

When your 7-day trial ends, and then every month. Cancel before the trial ends and you pay nothing. You can change plans or cancel at any time from your Billing page.

We have several accounts or subscriptions.

Choose the Team or Consultant plan. If you use AWS Organizations, you can import every member account in one step; on Azure, one identity with Reader on a management group adds every subscription under it in one click.

Can I see an example first?

Yes. Create a free account to explore a complete sample report without entering a card.

05 Contact us

Talk to an engineer.

Tell us about your environment and what you want to achieve. An engineer from our team will reply within one business day.

  • A short call to understand your goals
  • A clear proposal with fixed pricing where possible
  • No obligation and no sales pressure

Prefer email? Write to contact@parlak.us.

We reply within one business day. No obligation and no sales pressure.