Is the Nuberio Audit really free?

Yes. The Audit is free forever. No credit card is required. Run it locally with your own AWS credentials, or connect a read-only role via CloudFormation in about 5 minutes.

What does the Nuberio Audit check?

The Audit checks your CloudWatch alarm coverage (returning a hygiene score out of 100), lists alarms classified as good, noisy, or suppressed-bad, identifies missing critical alarms across 18 services (RDS, Lambda, ECS, EKS, ALB, S3, EBS, NAT Gateway, API Gateway, CloudFront, Billing, and more), lists unmonitored production resources, and surfaces security findings from GuardDuty, Security Hub, CloudTrail, Secrets Manager, and AWS Config.

Does the Audit require write access to my AWS account?

No. The connected flow uses a read-only IAM role created via a CloudFormation template. The local flow never sends any AWS credentials anywhere. Nuberio never requests write access.

Nuberio Audit · Free AWS Health Check

No alarm means you find out from a customer, not from CloudWatch.

The free Nuberio Audit scans 18 AWS services in parallel, classifies every alarm as GOOD, NOISY, or SUPPRESSED-BAD, and surfaces missing coverage with copy-pasteable CLI to fix each gap. Under 5 minutes.

Run free audit →Run it locally →or see a real sample report →

Read-only if connected · Zero access if local · 5-minute scan · No credit card · what we check ↓

nuberio — audit statsLive

nuberio@audit ~ scanning cloudwatch alarms across all audited accounts

Three steps, five minutes

Enter your email

We send the report here when the scan finishes. No account required.

Deploy a read-only IAM role

One CloudFormation click. Pre-filled template. The role can only read — never write.

Get your report

Score, top fixes, missing alarms with CLI commands. Yours to keep for 30 days.

Step 2 is optional — prefer not to grant AWS access at all? Run a local script instead, paste the output →

Demo55s · real account

See it run.

nuberio.com/audit/report/…

What the audit checks

18 AWS services, parallel scanning, results in under 5 minutes.

Alarm classification
Every alarm scored GOOD, NOISY, or SUPPRESSED-BAD with specific reasons.
Missing coverage
18 services cross-referenced — missing criticals surfaced with copy-pasteable CLI.
Unmonitored resources
Resources with zero alarms attached, with production gaps flagged first.
Security findings
Active GuardDuty and Security Hub findings with severity context.
Quota warnings
Service limits over 75% surfaced before they cause a hard cap mid-incident.
Hygiene score
Single 0–100 score weighted by severity and environment — comparable across accounts.

Coverage scope

Every resource type scanned and the exact CloudWatch metrics checked for each.

RDSAWS/RDS

CPUUtilizationFreeableMemoryDatabaseConnectionsFreeStorageSpaceReadLatencyWriteLatency

LambdaAWS/Lambda

ErrorsDurationThrottlesConcurrentExecutionsDestinationDeliveryFailures

ECSAWS/ECS

CPUUtilizationMemoryUtilizationRunningTaskCount

ALBAWS/ApplicationELB

HTTPCode_ELB_5XX_CountTargetResponseTimeUnHealthyHostCountRejectedConnectionCountHTTPCode_ELB_4XX_Count

NLBAWS/NetworkELB

UnHealthyHostCountTCP_Target_Reset_Count

EC2AWS/EC2

CPUUtilizationStatusCheckFailedStatusCheckFailed_AttachedEBS

⚠ Memory and disk usage require the CloudWatch Agent installed on the instance — not covered by the metrics above

ElastiCacheAWS/ElastiCache

CPUUtilizationFreeableMemoryEvictionsEngineCPUUtilizationSwapUsageCurrConnectionsReplicationLag

DynamoDBAWS/DynamoDB

SystemErrorsReadThrottleEventsWriteThrottleEventsUserErrorsSuccessfulRequestLatencyConsumedReadCapacityUnitsConsumedWriteCapacityUnits

SQSAWS/SQS

ApproximateAgeOfOldestMessageApproximateNumberOfMessagesNotVisibleApproximateNumberOfMessagesVisible

S3AWS/S3

5xxErrors4xxErrors

⚠ Requires S3 request metrics enabled per bucket (FilterId: EntireBucket)

API Gateway (REST)AWS/ApiGateway

5XXErrorLatencyIntegrationLatency4XXError

API Gateway (HTTP)AWS/ApiGateway

5xxLatency

NAT GatewayAWS/NATGateway

ErrorPortAllocationPacketsDropCountBytesOutToDestination

CloudFrontAWS/CloudFront

5xxErrorRate4xxErrorRate

EKSContainerInsights

node_cpu_utilizationnode_memory_utilizationpod_restart_count

⚠ Requires CloudWatch Container Insights enabled on the cluster

EBSAWS/EBS

BurstBalance

⚠ gp2 volumes only — gp3 does not emit BurstBalance

BillingAWS/Billing

EstimatedCharges

⚠ Requires 'Receive Billing Alerts' enabled in AWS Billing preferences

Security & compliance

GuardDutyActive threat findings with severity

Security HubCompliance findings from active standards

AWS ConfigNON_COMPLIANT rule violations

CloudTrailTrail not enabled or not sending to CloudWatch Logs

Secrets ManagerRotation-enabled secrets not rotated in 90+ days

Service QuotasLimits over 75% usage

Sample output

This is a real, live audit — not a mockup.

Needs attention

13Total Alarms

7Healthy

6Noisy / Bad

195Missing

Priority fix #1

Fix 5 noisy alarms

+10 pts

Noisy alarms cause alert fatigue and mask real incidents — fix evaluation periods, thresholds, and TreatMissingData settings.

aws cloudwatch put-metric-alarm \
--alarm-name "convops-baseline-builder-errors" \
--metric-name Errors ...

200+ resources checked · rds, lambda, ec2, eks, alb, natgateway, dynamodb & moreOpen the full sample report→

Common questions about the audit.

Answers about permissions, scan time, data handling, and what happens after you get your report.

What comes next

The audit gives you a one-time snapshot. Here's how to keep it useful.

Run it again anytime →

No limit on reruns — check back after you've fixed something, or on a different AWS account.

See what's coming →

Scheduled audits, drift alerts, and remediation snippets are on the roadmap — get notified when they ship.

Ready to see your score?

5 minutes. No account, no credit card. Just your email and one CloudFormation click.

Run free audit →See pricing →

Read-only IAM role · No writes · Cancel any time

From the blog