pip install kosty

# Full audit — cost + security across 30 services
kosty audit --output all

# External attack surface mapping
kosty public-exposure --output console

# IAM privilege escalation detection (21 patterns)
kosty iam check-privilege-escalation --deep

# Organization-wide scan
kosty audit --organization --max-workers 20 --output all

💡 Need expert help? Professional consulting available →

Upload your JSON report to the built-in dashboard for interactive charts, filtering, and cost breakdowns.

Map everything publicly exposed and evaluate protections — ALB, EC2, S3, RDS, API Gateway, Lambda URLs, CloudFront, OpenSearch, Redshift, EKS, ECR, SNS, SQS, and snapshots.

kosty public-exposure --output console

Each finding is classified:

• 🔴 Exposed & Unprotected — no protections, immediate action
• 🟡 Exposed & Partially Protected — gaps remain
• 🟢 Exposed & Protected — all protections verified

180+ checks across 30 services. Highlights:

• IAM Privilege Escalation — detects 21 known escalation patterns with optional --deep confirmation via SimulatePrincipalPolicy
• WAF Hardening — managed rules, rate limiting, bot control, logging, action mode
• API Gateway — WAF association, authorization, throttling, TLS 1.2, CloudFront bypass detection, request validation
• Foundational — CloudTrail, VPC Flow Logs, GuardDuty, AWS Config, KMS key rotation
• Data Protection — S3 encryption, RDS encryption, ElastiCache encryption, Secrets Manager rotation

kosty iam security-audit --deep
kosty waf audit
kosty apigateway security-audit

Real dollar savings for 11 services — not just recommendations, actual monthly amounts:

kosty audit --output json   # generates report with $ amounts
open dashboard/index.html   # visualize savings

30 services, organized by category:

Full check list per service → docs/SERVICES.md

# PyPI (recommended)
pip install kosty

# Docker
docker run --rm -v ~/.aws:/home/nonroot/.aws:ro ghcr.io/kosty-cloud/kosty:latest audit

# From source
git clone https://github.com/kosty-cloud/kosty.git && cd kosty && pip install -e .

# kosty.yaml
default:
  regions: [us-east-1, eu-west-1]
  max_workers: 20

exclude:
  services: [route53]
  tags:
    - key: "kosty_ignore"
      value: "true"

profiles:
  production:
    role_arn: "arn:aws:iam::123456789012:role/AuditRole"
    regions: [us-east-1]
  staging:
    aws_profile: "staging-profile"
    regions: [eu-west-1]

kosty audit --profile production
kosty audit --profiles --output all    # all profiles in parallel

Full configuration guide → docs/CONFIGURATION.md

1. Report Issues — Open an issue
2. Add Services — Follow the pattern in kosty/services/
3. Star the Repo — Show your support

Free 30-minute assessment to discuss your AWS setup.

📅 Book a call · 📧 [email protected] · 🌐 kosty.cloud

MIT License — see LICENSE