Skip to content

AWS Updated 2026-07-04

The monthly AWS operations checklist: what disciplined accounts review every 30 days

A monthly AWS operations checklist covering cost anomalies, rightsizing, orphaned resources, IAM hygiene, backup verification, Health events, and patching — the 90-minute review that keeps accounts from drifting.

AWS accounts do not fail suddenly; they drift. A credential nobody rotated, a snapshot pile nobody pruned, a backup job that started failing in March and got noticed in June, a bill that crept 8% a month until finance asked questions. The monthly operations checklist is the counterweight: roughly ninety minutes, once every 30 days, walking the same list in the same order and ticketing what it finds. The value is not any single check — it is that drift gets caught at one month old instead of one year old, when everything is still cheap to fix.

What you are deciding

The real decision is what “reviewed monthly” means for your account, because an unbounded review never happens twice. The disciplined version covers seven surfaces, each with a concrete question:

  • Cost: did spend move more than expected, and can every significant mover be named?
  • Capacity and sizing: what is oversized, undersized, or orphaned?
  • Identity: whose access should not exist anymore, and which keys are old enough to walk?
  • Backups: did the jobs run, and — quarterly — does a restore actually work?
  • AWS-side events: what is AWS planning to do to your resources in the next 30 days?
  • Patching: what fleet percentage is behind, and is anything behind on a critical?
  • Alarms: what fired, what was noise, and what silently stopped reporting?

Deliberately excluded: architecture reviews, DR exercises, and security audits. Those are quarterly or annual work; stuffing them into the monthly pass is how the monthly pass dies.

What to check first

If you only have twenty minutes this month, these four catch the most damage:

  • Cost Explorer month-over-month, grouped by service — anomalies announce most classes of trouble, from runaway jobs to compromise.
  • Backup job failures — the finding whose cost compounds silently every day it goes unseen.
  • The AWS Health dashboard for scheduled changes — deadlines you did not set, and the only party who moves them is you.
  • IAM credential ages — old keys are standing risk, and the report takes two minutes.

How to verify

The checklist runs mostly from the CLI, which makes it scriptable into a monthly report:

# 1. Cost: this month vs last, by service
aws ce get-cost-and-usage \
  --time-period Start=2026-06-01,End=2026-07-01 \
  --granularity MONTHLY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

# 2. Orphans: unattached volumes and unassociated Elastic IPs
aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].[VolumeId,Size,CreateTime]'
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId]'

# 3. Identity: full credential report (key ages, last-used, MFA)
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d > creds.csv

# 4. Backups: anything failing?
aws backup list-backup-jobs --by-state FAILED \
  --by-created-after 2026-06-01T00:00:00Z \
  --query 'BackupJobs[].[ResourceArn,CompletionDate,StatusMessage]'

# 5. AWS-side: pending maintenance on databases
aws rds describe-pending-maintenance-actions

# 6. Patching: SSM compliance summary
aws ssm list-compliance-summaries \
  --query 'ComplianceSummaryItems[?ComplianceType==`Patch`]'

Console equivalents where the visual is faster: Billing and Cost Management > Cost Explorer for the trend line, AWS Backup > Jobs for failures, Systems Manager > Patch Manager > Compliance reporting for the fleet view. Trusted Advisor adds automated checks across these categories — the full set requires a Business or Enterprise support plan, the core security checks come free.

The runbook

  1. Cost pass (20 min). Month-over-month by service; name every mover over a threshold you set (5% or a fixed dollar figure). Unexplained movers become tickets, not shrugs. Check Savings Plan and RI coverage while you are in there — expiring commitments are next month’s surprise.
  2. Orphan sweep (10 min). Unattached volumes, unassociated Elastic IPs, aged manual snapshots, stopped instances past 30 days, empty load balancers. Terminate what has no owner; ticket what might.
  3. Rightsizing glance (10 min). Skim Compute Optimizer’s recommendations for the top five over- and under-provisioned findings. Action the obvious ones; the marginal ones can wait for quarter-end.
  4. Identity hygiene (15 min). Credential report: access keys over 90 days, users with no activity in 90 days, console users without MFA. Every finding is either rotated, removed, or has a written exception.
  5. Backup verification (10 min). Zero failed jobs is the pass bar; any failure is a same-day ticket. Once a quarter, this step expands into an actual restore test — cross-region backup strategy covers what the plan should look like.
  6. Health and maintenance (10 min). Open Health events, scheduled changes, pending RDS maintenance, and certificate expiries inside 45 days. Anything with a deadline gets an owner and a calendar entry now.
  7. Alarm and patching review (15 min). What alarmed this month and was it actionable; what is in INSUFFICIENT_DATA that used to report; what percentage of the fleet is patch-compliant. Noise gets tuned, gaps get ticketed.

Close by writing five lines: date, findings count, tickets opened, anything deferred, and the one number you are watching next month. That log is what makes month thirteen easier than month one — and it is the evidence file when a customer or auditor asks how the account is operated.

When this is the wrong move

A monthly cadence is wrong at both extremes. A single low-change workload with two engineers can run this quarterly without much added risk — the drift rate is lower. A regulated or high-change environment needs several items (backup failures, credential anomalies, patch criticals) as continuous alerts, not monthly discoveries; the checklist then becomes verification that the automation still works, not the primary detection. And if the last three reviews produced zero findings, do not celebrate — the checks have probably gone stale relative to how the account has evolved.

Common mistakes

  • Running the review only when things feel wrong, which selects precisely for the months drift accumulates unseen.
  • Reviewing without ticketing — findings noted in a doc and fixed never. The review’s output is tickets, or it is theatre.
  • Letting the checklist grow until it takes half a day, after which it quietly stops happening at all.
  • One person owning it forever: the review dies with their departure, and their blind spots become the account’s blind spots.

Keeping it under control

  • A recurring calendar block, first week of the month, treated like a customer meeting.
  • Script the data collection so the ninety minutes go to judgment, not copy-pasting into a spreadsheet.
  • Rotate the reviewer every few months; fresh eyes find what the regular ones have normalized.
  • Track findings-per-month as a trend — rising means the account needs more automation, falling toward zero means the checks need refreshing.

The checklist is simple; the discipline of doing it every 30 days is the part organizations reliably fail. If nobody on your team truly owns the AWS environment end to end, that is the root of most of these problems — Stack Harbor runs AWS accounts daily under AWS Operations, and you can book an AWS review.