08-tooling

aws audit 2026 04 19

2026-04-19·tooling-audit·status: read-only-snapshot·! high

AWS Cost & Resource Audit — 2026-04-19

Phase 7 partial — Cloudflare zone import (BLOCKED 2026-04-19 22:31 EDT)

Phase 5 — measured-improvement S3 (DONE 2026-04-20)

Phase 6 — Route 53 stale records purge (DONE 2026-04-20)

Phase 8 — EC2 terminations + IGW cleanup (DONE 2026-04-20)

Phase 9 — IAM aws-baw user deletion (DONE 2026-04-20)

Phase 10 — Lambda AWSIOTButton deletion (DONE 2026-04-20)

Phase 4 — raydataco → Cloudflare R2 (PARTIAL 2026-04-20)

Phase 2 — SimpleAD chain destruction (DONE 2026-04-20)

Phase 3 — Quick S3 deletes (DONE 2026-04-20)

2026-04-19 — Phase 1 deletes

CloudFront benjaminandrewwilson.com (DONE)

Headline

Ray Data Co's AWS spend ($71/mo) is 96% pure waste: a forgotten SimpleAD Directory Service from a 2021 Amazon WorkSpaces experiment ($37/mo), and the NAT Gateway + EIP that supports its VPC ($33/mo). No WorkSpaces are deployed. No EC2 is running (4 instances are all stopped t1.micro from 2014-2015). Everything else — Route 53 ($0.54/mo), S3 ($0.01/mo), CloudFront ($0), Lambda ($0), SES (idle) — is rounding error. Kill the Directory Service and the NAT Gateway today and the bill drops to ~$1/mo. The Cloudflare migration is then trivial: 1 Route 53 zone (26 records) → Cloudflare DNS, ~600MB across 8 S3 buckets → R2 (or just download to local archive), 1 CloudFront distribution serving an old benjaminandrewwilson.com asset domain → likely just delete. Total post-migration AWS dependency: zero.

Account: 091141868335. Authenticated as root (short-term, per founder).

Cost Explorer breakdown

Last 3 months by service (USD):

Service Jan 19 – Feb 1 (partial) Feb 2026 Mar 2026 Apr 1-19 (est) % of monthly
AWS Directory Service (SimpleAD) $15.52 $33.61 $37.24 $23.50 52%
EC2 - Other (NAT Gateway hours + data) $14.04 $30.24 $33.48 $20.52 47%
Amazon VPC (EIP charges) $1.56 $3.36 $3.72 $2.28 (rolled into EC2-Other category by AWS)
Amazon Route 53 $0.02 $0.54 $0.54 $0.34 <1%
Amazon S3 $0.006 $0.014 $0.014 $0.009 ~0%
Amazon CloudFront $0 $0 $0 $0 0%
AmazonCloudWatch $0 $0 $0 $0 0%
EC2 Compute $0 $0 $0 $0 0%
Total $31.15 $67.76 $74.99 $46.65 (on pace ~$73/mo) 100%

Notes:

Daily run rate (Apr 14-18, post-estimate window):

Top 5 cost drivers, monthly:

  1. AWS Directory Service (SimpleAD corp.amazonworkspaces.com) — $37.24/mo
  2. EC2 NAT Gateway in vpc-08e94e731c29d150b — $33.48/mo
  3. Amazon VPC EIP 44.211.106.158 — $3.72/mo
  4. Amazon Route 53 (raydata.co. zone) — $0.54/mo
  5. Amazon S3 (8 buckets) — $0.014/mo

Resource inventory

Directory Service — THE cost driver

Field Value
Directory ID d-906765a3e9
Name corp.amazonworkspaces.com
Type SimpleAD
Size Small ($0.05/hr = ~$36/mo)
Launched 2021-01-18
Last stage update 2025-10-05
VPC vpc-08e94e731c29d150b (172.16.0.0/16)
Subnets subnet-01173553e43992810 (us-east-1a), subnet-023cbaf778eaf0573 (us-east-1b)
Active WorkSpaces 0 (aws workspaces describe-workspaces returns empty)

This is leftover from an Amazon WorkSpaces experiment in 2021. No WorkSpaces are deployed. Nothing depends on it. Pure waste at $37/mo, $444/yr.

EC2 / NAT Gateway / EIP — second cost driver

Resource ID State Cost contribution
NAT Gateway nat-029bb372328ed8249 available, in subnet-0ebc5a4151cfaafce $33.48/mo (hourly NAT charge $0.045 × 24 × 30)
Elastic IP 44.211.106.158 (eipalloc-09a8e2619dcf2ea44) associated to the NAT Gateway $3.72/mo (associated EIP on NAT)
EC2 instance i-4bc82865 t1.micro stopped since/before 2014-03-11 $0
EC2 instance i-c148c320 t1.micro stopped since/before 2014-11-18 $0
EC2 instance i-f03fe601 t1.micro stopped since/before 2015-01-21 $0
EC2 instance i-97838266 t1.micro stopped since/before 2015-02-18 $0
EBS volumes none across us-east-1, us-east-2, us-west-1, us-west-2 — $0

The NAT Gateway lives in vpc-08e94e731c29d150b — the same VPC as the Directory Service. There is no EC2, Lambda, or other compute in that VPC consuming NAT egress. It's running purely to support the Directory Service, which itself supports nothing.

The 4 stopped EC2 instances from 2014-2015 are zero-cost (stopped instances aren't billed for compute) but are vestigial — terminate them for cleanliness.

Route 53

S3

8 buckets, total ~603 MB across ~955 objects:

Bucket Created Objects Size Likely purpose
baw-east 2016-11-11 4 1.1 MB Probably benjaminandrewwilson.com East-region asset cache
baw-img 2019-07-27 102 196 MB benjaminandrewwilson.com images (CloudFront origin)
baw-site 2019-02-09 91 12 MB benjaminandrewwilson.com static site
baw-stitch-csv 2019-12-15 3 324 B Stitch ETL CSV staging — basically empty
db-749db465a3f4c8db38e23f436ba21692-s3-root-bucket 2023-02-13 0 0 DigitalOcean (?) backup bucket — empty
elasticbeanstalk-us-east-1-091141868335 2013-12-17 1 0 Elastic Beanstalk artifact store — basically empty
measured-improvement 2017-02-16 603 370 MB Old project assets
raydataco 2020-06-07 151 25 MB Ray Data Co assets — possibly load-bearing

Total: ~604 MB. Per S3 standard storage at $0.023/GB = $0.014/mo. Effectively free.

CloudFront

1 distribution:

Field Value
ID E3F713M5HGF09
Domain d2s4moqziz4u68.cloudfront.net
Alias assets.benjaminandrewwilson.com
Origin baw-img.s3.amazonaws.com
Status Deployed
Last modified 2019-07-27
Cost $0/mo (no traffic)

Serves benjaminandrewwilson.com assets. Not Ray Data Co. Disable + delete unless founder still wants benjaminandrewwilson.com images served.

Lambda

1 function in us-east-1:

Name Runtime Last modified
AWSIOTButton nodejs4.3 (deprecated since 2020) 2016-08-24

Zero-cost (no invocations), runtime is deprecated, function definitely not running. Delete.

SES

RDS

Directory Service / WorkSpaces

IAM users

User Created Likely purpose
aws-baw 2015-09-06 benjaminandrewwilson.com programmatic access
claude-rdco 2026-04-20 Today's IAM user for Claude (just created)
raydataco_s3 2020-06-07 raydataco bucket access
s3-baw 2016-11-12 baw-* bucket access
sendy 2015-06-10 Old Sendy newsletter app SES access

After migration, all of these except claude-rdco (and that one too, eventually) can be deleted.

VPCs

None contain billable resources. Delete after EC2 cleanup.

Migration plan

AWS resource Cloudflare equivalent Est. cost on CF Complexity Sequence
Route 53 zone raydata.co (26 records) Cloudflare DNS (free) $0/mo Low — 30 min: import zone via Cloudflare dashboard, change registrar nameservers 3 (do AFTER killing waste, before final account close)
S3 bucket raydataco (25 MB, 151 obj) R2 bucket OR local archive $0/mo if <10GB on R2 free tier Low — rclone sync or aws s3 sync to local then rclone sync up to R2 4
S3 buckets baw-* + measured-improvement (~580 MB) Local archive (probably not worth migrating) $0 Low — aws s3 sync to local backup drive 5
CloudFront assets.benjaminandrewwilson.com Cloudflare CDN OR delete $0/mo on CF free tier Low — only needed if benjaminandrewwilson.com still wants it 6 (or kill — see below)
SES sending Already migrated to Resend (per DKIM records) already on Resend Done n/a
Lambda AWSIOTButton n/a — delete $0 Low — delete kill list
Directory Service corp.amazonworkspaces.com n/a — no equivalent needed $0 Low — aws ds delete-directory --directory-id d-906765a3e9 1 — DO FIRST
NAT Gateway nat-029bb372328ed8249 + EIP 44.211.106.158 n/a — no equivalent needed $0 Low — delete NAT, release EIP 2 — DO SECOND (after Directory Service is gone, since killing the NAT could affect anything in that VPC)

Estimated post-migration AWS cost: $0/mo. Estimated savings from steps 1+2 alone: ~$70/mo, ~$840/yr.

Sequence rationale:

  1. Kill Directory Service first — biggest dollar item, nothing depends on it.
  2. Kill NAT Gateway + EIP second — they only existed to support Directory Service.
  3. Migrate DNS to Cloudflare — only thing actually serving Ray Data Co traffic.
  4. Sync raydataco bucket to R2 (or just download).
  5. Archive other S3 buckets to local backup, then delete buckets.
  6. Decide CloudFront/benjaminandrewwilson.com fate (separate decision — that's a personal site).
  7. Delete remaining EC2 (terminate the 4 stopped instances), VPCs, IAM users.
  8. Close AWS account.

Kill list (no migration needed, just delete)

These items are running and costing money (or cluttering the account) with no current value to Ray Data Co:

  1. AWS Directory Service d-906765a3e9 (corp.amazonworkspaces.com) — $37/mo. Created 2021-01-18 for an Amazon WorkSpaces experiment; no WorkSpaces exist. Pure waste.
  2. NAT Gateway nat-029bb372328ed8249 — $32/mo. Lives in the Directory Service VPC. Nothing else uses it. Delete after Directory Service.
  3. Elastic IP 44.211.106.158 (eipalloc-09a8e2619dcf2ea44) — $3.60/mo. Attached to the doomed NAT Gateway. Release after NAT delete.
  4. EC2 instances i-4bc82865, i-c148c320, i-f03fe601, i-97838266 — $0/mo (stopped) but vestigial t1.micro from 2014-2015. Terminate.
  5. Lambda AWSIOTButton — $0/mo. Node 4.3 (long-deprecated runtime), last modified 2016. Dead.
  6. S3 bucket db-749db465a3f4c8db38e23f436ba21692-s3-root-bucket — empty. Delete.
  7. S3 bucket elasticbeanstalk-us-east-1-091141868335 — basically empty (1 zero-byte object). Delete.
  8. S3 bucket baw-stitch-csv — 3 tiny CSVs from 2019 ETL. Almost certainly dead — confirm with founder, then delete.
  9. IAM user sendy — Sendy newsletter app from 2015, long since replaced by ConvertKit/Resend.
  10. VPCs vpc-d71520b2, vpc-032085b8f73ae1b51, vpc-57d5c635 — empty leftovers. Delete after EC2 cleanup.

Open questions for founder

  1. The raydataco S3 bucket has 151 objects (~25 MB) — do you know what's in it? Best guess: old marketing assets / brand files. If yes, migrate to R2 or download to local. If no idea, I can list the keys for you.
  2. The baw-* and measured-improvement S3 buckets are clearly from your benjaminandrewwilson.com / Measured Improvement era. Want them archived to local backup before deletion, or just nuke them?
  3. CloudFront assets.benjaminandrewwilson.com — is benjaminandrewwilson.com still a live site you want to keep serving? If yes, migrate to Cloudflare. If no, kill the CloudFront + the baw-* S3 buckets together.
  4. Confirmation on Directory Service — do you have any memory of why this exists? I'm 95% sure it's the leftover of a 2021 Amazon WorkSpaces trial (the directory is named corp.amazonworkspaces.com, the timing matches), and zero WorkSpaces are currently deployed against it. But if there's any chance you're using it for something I can't see, say so before I recommend you pull the trigger.
  5. IAM user aws-baw — created 2015, has long-lived access keys somewhere. If those keys are sitting in an old .env file or password manager from your benjaminandrewwilson.com days, rotate or delete them as part of the cleanup.

Migration log

baw-east → iCloud Drive (DONE 2026-04-20)