Alerts and budgets

Open Settings in Strays

New risks

Between full scans, Strays checks each connected account every hour for new security risks: things like a security group opened to the internet, a public S3 bucket or snapshot, or a new access key without MFA. Waste isn't part of the hourly check; it waits for the next scan.

• Who hears about it: every admin by email, straight away. If Slack is connected, the owner (matched by email) also gets a Slack message with buttons, and if Teams is connected the new risk is posted to your Teams channel.
• What alerts admins: an admin chooses under Alert admins about in Settings: high risks (the default), high and medium risks, or nothing, which also stops the hourly check. It is one setting for the whole organisation: there are no personal alert settings, so changing it changes what every admin gets.
• Each risk once: you're alerted when a risk first appears. It then shows in Everything found like any other until it's fixed, kept or snoozed.

The hourly check only reads settings, the same as a scan, and finds owners from tags only; the next full scan adds owners from CloudTrail and marks fixed risks as fixed.

Budgets

Give an AWS account a monthly budget on its page under AWS accounts, and Strays checks its spend once a day with one Cost Explorer call (AWS charges $0.01 for it, to that account). Admins get an email, and a message in Slack and Teams if they are connected:

• when the month is on course to go over the budget (a straight line from the month so far),
• at 80% of the budget, and again at 100%,
• when a day costs more than twice the average of the week before (and at least $10 more).

Each alert is sent once a month (spikes once a day). Cost Explorer's figures lag by up to a day. Members can also Check spend now, at most once an hour. Roles created before budgets were added need the latest strays-audit template, which adds read access to Cost Explorer costs.

Enter a budget as a whole number of digits 0 to 9 (up to 10,000,000), or 0 for none. Decimals, commas and currency signs are refused with a message rather than rounded, so the figure you see is the figure you typed.

Alerts and budgets are on the Team plan and above, and during the trial.