What 32 AWS account reviews turned up
Across 32 accounts at 11 organisations, 78% had not restored a backup in a year and 61% could not attribute a fifth of their spend to a team. The findings repeat, and they are not the exotic ones.
We reviewed 32 AWS accounts across 11 organisations between January 2023 and June 2026. The same problems appear in almost all of them, and they are not the exotic ones. Here are the numbers.
How this was counted
Each review is a two-day read of a live account against the AWS Well-Architected framework, done with the team that built it. The findings below come from our own review notes, counted once per account. An account appears in a percentage only if we checked that specific thing, so the denominators differ slightly between rows.
The sample skews towards mid-sized companies in regulated industries, mostly insurance, fintech and e-commerce, because that is who hires us. A startup with one account and four engineers will not look like this. A bank with 400 accounts will look worse in different places.
Cost attribution
In 61% of accounts, more than a fifth of monthly spend could not be attributed to a team or a product. Tags existed. They were inconsistent, applied by hand, and missing entirely on anything created before the standard was written.
The median amount sitting in idle or oversized resources was 23% of the monthly bill. That figure is dominated by three things every time: instances sized for a launch that happened years ago, non-production environments running through nights and weekends, and storage that was never moved to a cheaper tier.
Recovery
In 78% of accounts, no backup had been restored into a working environment in the previous twelve months. Backups were scheduled and retention was set in nearly all of them. The restore was the untested half.
47% were running at least one production database in a single Availability Zone. In most cases the team knew, and the Multi-AZ upgrade had been on a backlog since the workload was smaller.
Access
66% had at least one human IAM user holding AdministratorAccess, usually granted during an incident and never removed. 22% had no MFA on the root account.
19% had at least one S3 bucket reachable from the internet. Roughly half of those were intentional, hosting static assets. The other half were not.
Operations
84% had CloudWatch alarms that had fired repeatedly in the previous 90 days with no corresponding action. An alarm that nobody responds to is not monitoring, it is noise that trains people to ignore the channel the real alert will arrive on.
53% had exactly one person who could perform a production deploy end to end. This finding gets the least attention in the report and causes the most damage when it lands.
What the pattern says
None of this is a knowledge problem. Every team we reviewed knew that root should have MFA and that restores should be tested. The findings cluster around work that is unglamorous, has no deadline attached, and competes with shipping features, which is exactly the work that a review with an outside party finally gets scheduled.
The two with the best return, on this sample, are cost attribution and restore testing. Attribution because you cannot cut a bill you cannot break down, and restore testing because it converts an assumption into a measured number you can put in front of the business.
Method notes and limits
These are counts from a consulting practice, not a random sample of AWS accounts. Selection bias runs in one direction: organisations that commission a review usually suspect something is wrong. Read the percentages as "what tends to be true in an account someone is worried about", not as a population estimate.
We update this page when the sample grows enough to move a figure. Last recount: June 2026.
How many AWS accounts does this cover?
32 accounts across 11 organisations, reviewed between January 2023 and June 2026. Each review is a two-day read of a live account against the Well-Architected framework, done with the team that built it.
What is the most common finding?
Untested restores. In 78% of accounts, no backup had been restored into a working environment in the previous twelve months, even though backups were scheduled and retained in nearly all of them.
How much of an AWS bill is usually waste?
The median in this sample was 23% of the monthly bill sitting in idle or oversized resources: instances sized for an old launch, non-production running overnight, and storage never moved to a cheaper tier.
Is this a representative sample of AWS accounts?
No. Organisations that commission a review usually already suspect something is wrong, so the selection bias runs in one direction. Read the percentages as what tends to be true in an account someone is worried about.
More notes
What a Well-Architected review actually finds
Two weeks of reading someone else's AWS account, and the same handful of problems keep showing up: single-AZ databases, IAM nobody has audited since 2021, and instances paid for at on-demand rates for three years.
Writing a cloud roadmap people will actually follow
Most cloud roadmaps are a list of technologies with quarters next to them. A useful one names the constraint you are working against, what you will not do, and who owns each piece.
Send us your AWS bill
Thirty minutes with an engineer, no slide deck. We will tell you what we would change first and what it would cost to have us do it.