Halcyon Pay: multi-cloud estate
AWS (9 accounts) · Azure (2 subscriptions) · GCP (1 project) · scanned read-only
1 · Summary
Only 58% of Halcyon Pay's estate is managed in code. Azure and GCP, which came with an acquired team, are mostly unmanaged. Three critical findings need action this week: a production database reachable from the internet, public blob access on a storage account, and an admin access key over 400 days old. About $6,850/month goes to idle or orphaned resources.
2 · Findings by severity
3 · IaC coverage by cloud
4 · Top findings
Production Postgres reachable from 0.0.0.0/0 on port 5432
The rule was added in the console during an incident and never removed. It is not in Terraform.
aws · ap-south-1 · sg-0a71…payments-dbStorage account allows public blob access
The container holds exported reports. The account was created outside IaC by the acquired team.
azure · centralindia · halcyonexportsAccess key 412 days old on a user with AdministratorAccess
The key was last used 3 days ago from a CI runner. Rotate it and move the runner to a role.
aws · iam · user/ci-deploy-legacyRDS backup retention cut from 14 days to 1 in the console
Field-level drift from code. Point-in-time recovery is now limited to 24 hours.
aws · rds · ledger-prod46 resources created by a deleted IAM user, no owner tag
Probably a former contractor's work. These need an owner before anything else is decided.
aws · 3 accounts · creator: user/deletedGKE control plane has a public endpoint with no authorised networks
Fails the CIS GKE benchmark. The cluster is not managed in Terraform.
gcp · asia-south1 · gke/analytics+ 129 more findings in the full report, each with resource, rule, evidence and fix.
5 · Waste
| Category | Resources | Est. / month |
|---|---|---|
| Idle EC2 instances (CPU < 2% for 30 days) | 18 | $2,960 |
| Idle Azure VMs | 7 | $1,500 |
| Unattached EBS volumes | 61 | $1,420 |
| Snapshots older than 180 days | 104 | $890 |
| Unused public IPs | 22 | $80 |
| Total | 212 | $6,850 |
6 · Recommended next 30 days
- This week: merge the 3 drafted PRs for the critical findings, and rotate the legacy CI key.
- Weeks 2–3: codify the 340 unmanaged Azure resources into Terraform, starting with networking and storage.
- Week 3: assign owners to the 46 orphaned resources, then decide whether to keep or delete each one.
- Week 4: turn on continuous drift detection and PR policy gates, so the same problems don't come back.