Lesson Plan Builder · sample report
Your AWS, read out loud.
Generated from 3 CSVs, 18,816 rows, parsed locally in 11.3 seconds. Nothing here left your laptop.
01 · Where your money goes
Two services account for half the bill.
EC2 and RDS together are 53% of spend. Storage (S3 + EBS) is another 21%. Egress is louder than it looks.
Spend by service · last 30 days
$48,231 totalMonthly trend · 12 months
all accounts02 · Biggest opportunities
Six fixes. $11.6k/month back.
Ranked by monthly impact. Each links to the lesson that walks you through the fix.
Buy a 1-year Compute Savings Plan at $9/hr
Steady baseline on 4 prod accounts justifies a no-upfront commitment.
Right-size 31 over-provisioned EC2 instances
p99 CPU <12% for 30 days. Drop one size, save without risk.
Add S3 Lifecycle policy to logs-archive bucket
84TB of objects untouched >90 days, still Standard tier.
Migrate 218 gp2 volumes to gp3
Same performance, ~20% cheaper · online change.
Retire 4 idle RDS instances
Zero connections for 30+ days; running anyway.
Eliminate NAT Gateway egress for VPC endpoints
S3 + DynamoDB egress flowing through NAT instead of free VPC endpoints.
03 · Security posture
Two criticals to clear today.
Scored against the CIS AWS Foundations Benchmark plus SOC 2 control mapping. Critical items first.
Posture score
CIS · SOC 2Two critical findings drag the most. Clear them and you're back to 82 / 100.
Top risks · ranked by severity
7 findingsRoot account access keys exist
Account 938...: 2 active root keys, last rotated 491 days ago
Unencrypted RDS instances (3)
prod-db, prod-analytics, staging-search, no KMS encryption
Overly permissive IAM policies (12)
*:* policies attached to 12 roles, including 4 service accounts
Security groups allowing 0.0.0.0/0
8 SGs allow inbound from anywhere on non-public ports
04 · Your learning path
Three tracks built from your data.
These aren't generic playlists. The lessons here are queued up because your CSVs said so.
Cut your storage bill
Storage is your second-biggest line. Six steps to take it down ~26%.
Lock down access
Critical security findings first. The audit-readiness path.
Right-size your compute
Two-thirds of your bill is EC2 + RDS. Read the signals, propose changes, defend the savings.
emnode, the platform
Get this every day, across every account.
emnode tracks cost, savings and security posture continuously across every account, turning each finding into a guided fix. Same lessons, baked into the product.