DEV Community

Cover image for I Built an AI That Scans My AWS Account for Zombie Resources Every Week
Utkarsh Rastogi
Utkarsh Rastogi

Posted on

I Built an AI That Scans My AWS Account for Zombie Resources Every Week

#python #serverless #aws #devops

Last week I decided to actually look at what's in my AWS account. Not the bill — the resources.

My guess was maybe 20 active things. The scan found 153 idle resources. Lambda functions I made for a hackathon six months ago. IAM roles from a POC that never went anywhere. Security groups attached to literally nothing. Empty S3 buckets I probably named "test-bucket-final-v2" at 2am.

The part that worried me? Nine of those IAM roles had broad permissions and hadn't been used in over 90 days. That's basically nine unlocked doors sitting open in my account.

So I built something to catch this automatically.

Why I couldn't just ignore it

You might think — okay, those Lambda functions aren't costing me anything. Why bother cleaning them?

Here's what I realized after thinking about it:

Those unused IAM roles are a real security risk. If anything in my account gets compromised, an attacker can assume those roles. They have AdminAccess. Nobody's watching them because nobody remembers they exist.

Beyond security — I hit my Lambda function quota last month. Turns out 47 of my functions hadn't been invoked in 30+ days. They were eating into my limit and I was paying for it with wasted quota, not money.

And when I tried to clean up manually, I got stuck. Some resources were created via CloudFormation. If I delete them directly, my stack breaks. Some were made in the console. Some via CLI. I had no idea which was which.

I spent two hours going through my account. Got through maybe 30 resources. Gave up.

That's when I decided to automate it.

What I built

I call it AI Cloud Waste Detective. It runs every Sunday morning and sends me an email telling me:

  • What's idle in my account (across 15 different services)
  • Who created each resource (CloudTrail lookup)
  • How it was created — Console, CLI, CloudFormation, CDK, or SAM
  • Whether I can safely delete it directly or need to delete the whole stack
  • An AI summary with prioritized recommendations

The email comes with a CSV attachment listing every single idle resource. I can forward it to my team or just review it over coffee.

Costs me 56 cents a month to run. The whole thing is serverless — Step Functions orchestrating 7 Lambda scanners in parallel, Bedrock for the AI analysis, SES for the email.

Weekly Report Email

The thing that makes it actually useful

Every cleanup tool I've seen tells you "this resource is idle." Great. But then what?

If that Lambda was deployed via CloudFormation and I delete it directly — my stack drifts. Next deploy fails. I've been burned by this before.

So the tool checks every CloudFormation stack in my account, maps which resources belong to which stack, and tells me the right way to clean up:

Resource Name    | Created Via    | Stack Name           | Safe to Delete
test-handler     | CloudFormation | riddle-core-lambdas  | No - Delete Stack Instead
my-temp-role     | CLI            |                      | Yes - Delete Directly
old-bucket       | Console        |                      | Yes - Delete Directly
Enter fullscreen mode Exit fullscreen mode

It also detects if the person who created a resource no longer exists in IAM. If their user was deleted — that resource is truly orphaned. Nobody to even ask "do we still need this?"

How it works under the hood

Architecture

EventBridge (Sunday 8 AM)
    |
Step Functions
    |-- 7 scanners run in parallel
    |     Lambda, EBS, S3, ECR, DynamoDB, SQS, SNS,
    |     EIP, Security Groups, API Gateway, IAM Roles,
    |     IAM Users, Secrets Manager, CloudFormation, Log Groups
    |
    |-- Enrichment step
    |     CloudTrail lookup, creation method detection,
    |     orphan check, confidence scoring
    |
    |-- AI analysis (Bedrock Nova Lite)
    |     Summary, priorities, stack grouping
    |
    +-- Report (HTML email + CSV attachment)
Enter fullscreen mode Exit fullscreen mode

Each scanner is its own Lambda function. If the IAM scan takes longer or fails, the others still complete. Step Functions handles the orchestration and retries.

All the thresholds live in one config file. Want Lambda idle detection to be 60 days instead of 30? Change one number. Want to skip certain resources? Add a pattern to the skip list.

# src/config.py — all thresholds in one place

THRESHOLDS = {
    "lambda_idle_days": 30,
    "iam_role_idle_days": 90,
    "dynamodb_idle_days": 30,
    "sqs_idle_days": 30,
}

SKIP_PATTERNS = {
    "lambda_skip": ["waste-detective", "aws-controltower"],
    "iam_role_skip_prefixes": ["AWS", "aws-"],
}
Enter fullscreen mode Exit fullscreen mode

What it actually found in my account

First scan results (us-east-1):

Total idle resources: 153
High confidence (safe to delete): 46
Medium confidence (investigate first): 107
Monthly cost waste: $0
Enter fullscreen mode Exit fullscreen mode

All hygiene issues — nothing costing money, but 153 things making my account harder to work with, harder to audit, and less secure.

The AI grouped a bunch of them by CloudFormation stack. Turns out three old stacks from projects I finished months ago were responsible for about 35 idle resources. Three delete commands cleaned them all.

Who actually needs this

I initially built it for myself. But talking to other developers, turns out this problem is everywhere:

If you're learning AWS on a personal account — you experiment, you forget, then you get confused about what's real vs leftover. Or worse, you get an unexpected bill from an EBS volume you forgot to detach.

If you're on a small team — everyone creates stuff, nobody cleans up. A new person joins and has no idea what's active. Resources pile up quarter after quarter.

If you're in an enterprise — people leave the company, their resources stay. Compliance audits ask "who owns this?" and nobody knows. Security scanners flag everything because there's so much noise from dead resources.

If you've been using AWS for more than 3 months, you have zombie resources. I'd bet on it.

How it compares to Trusted Advisor

Trusted Advisor This Tool
Cost $100/month (Business plan) $0.56/month
Shows who created it No Yes
Shows how it was created No Yes (Console/CLI/CFN/CDK/SAM)
Warns about breaking stacks No Yes
Covers IAM roles/users No Yes
Covers idle Lambda No Yes
Covers empty S3/SQS/SNS No Yes
Delivery Dashboard you have to check Email arrives automatically
Exportable for team review No Yes (CSV attached)

Not saying Trusted Advisor is bad — it covers performance, fault tolerance, and other things this tool doesn't. But for account hygiene specifically, it misses a lot.

Setting it up

Three commands:

git clone https://github.com/Utkarshlearner/ai-cloud-waste-detective.git
cd ai-cloud-waste-detective
cp .env.example .env
Enter fullscreen mode Exit fullscreen mode

Edit .env with your email and region. Then:

./deploy.sh all    # deploys 6 CloudFormation stacks, takes ~3 minutes
./test.sh          # triggers a scan immediately
Enter fullscreen mode Exit fullscreen mode

Check your email. You'll have a full report within a minute.

The deploy creates 10 Lambda functions, a Step Functions state machine, an EventBridge schedule, an S3 bucket for report history, and the IAM roles needed. Everything is tagged with Project: ai-cloud-waste-detective so the tool won't flag its own resources as idle.

To tear it all down:

./destroy.sh    # removes everything cleanly
Enter fullscreen mode Exit fullscreen mode

Try it

I'm genuinely curious what it'll find in your account.

Deploy it, run one scan, and let me know in the comments:

  • How many idle resources did it find?
  • What was the biggest surprise?

For me it was those 9 IAM roles with AdminAccess that hadn't been touched in months. That's the kind of thing that keeps security people up at night.

GitHub: https://github.com/Utkarshlearner/ai-cloud-waste-detective

I write about building practical AI tools on AWS. If this was useful, follow me here or connect on LinkedIn.

Top comments (0)