Audit AWS EC2 and S3 with a PowerShell Workflow
Inventory EC2, audit S3 bucket policies, rotate IAM keys, and surface idle AWS resources with a single repeatable PowerShell workflow.
AWS environments grow fast. New EC2 instances get spun up for a project, an S3 bucket gets created for a one-off file drop, an IAM key gets generated for a script that nobody documented, and the bill quietly climbs.
PowerShell is a first-class option for managing AWS. The AWS.Tools modules expose almost every API surface, but writing a clean audit script from scratch each time is the part that slows teams down. PSForge gives you the tasks ready to assemble.
What an AWS audit workflow needs to cover
- Every running EC2 instance, its size, region, owner tag, and uptime
- S3 buckets with public access, missing encryption, or no lifecycle rules
- IAM users with old access keys or no MFA
- Unattached EBS volumes and unused Elastic IPs that still cost money
- Security groups that allow 0.0.0.0/0 on sensitive ports
Why this becomes a workflow
Each of these checks is straightforward in isolation. The value is in running them together on a schedule and producing one report that ops, security, and finance can all act on.
PSForge lets you assemble the AWS tasks into a single workflow, generate the PowerShell, and then schedule it from a runbook server, a Lambda using the PowerShell runtime, or a CI pipeline.
Example AWS audit workflow
- Authenticate with Set-AWSCredential or an instance profile
- Enumerate EC2 instances across every active region
- List S3 buckets and check public access, encryption, and lifecycle rules
- Flag IAM access keys older than 90 days and users without MFA
- Identify unattached EBS volumes and orphaned Elastic IPs
- Audit security groups for permissive inbound rules
- Export the consolidated findings to CSV or send to an S3 bucket
Final thoughts
An AWS account that is never audited is an AWS account that is overspending and underprotected.
PSForge makes it easy to build a single PowerShell workflow that covers cost hygiene and security posture in one pass, and to run it on a schedule so the answers stay current.