Post-launch configuration audit for EC2 instances

A developer launches an AMI from AWS Marketplace assuming it's production-ready. Three days later, they realize there's no backup configured, the AWS CLI isn't installed, the EC2-user permissions are awkwardly structured, and their non-containerized app is fighting the ECS agent. None of these are discovered at launch — they surface under load or during an incident.

The reason this keeps happening is that Marketplace AMIs are sold on features ('EKS-optimized', 'Inspector agent included') but not validated against what a team's specific workload actually requires. The buyer reads a feature list; the user discovers gaps in production. That mismatch between buyer and user is the structural reason nobody fixes it — the person who bought the AMI isn't the one debugging at 2am.

What doesn't exist is anything that looks at a freshly launched instance, compares its actual state against a team-defined baseline — packages present, backup agent running, SSH access method, IAM role attached, ECS task definition compatibility — and tells you exactly what's missing before it matters. The complaints here are all discoverable things: missing packages, missing backup config, PuTTY dependency for SSH, CloudFormation extra steps for Windows. These aren't mysteries; they're checkable.

Without a systematic post-launch check, every team builds tribal knowledge about which AMI quirks to patch, documented in a Confluence page nobody updates. New engineers repeat the same mistakes. The need recurs every time a new instance type or AMI is adopted.

What to build

Build an agent that runs once on instance launch, checks the live system state against a team-defined YAML baseline (required packages, backup agent status, SSH config, IAM role, ECS compatibility flags), and posts a structured gap report to Slack or email before the instance is marked ready — with one-click remediation scripts for each detected gap.

Where to start

Offer a free GitHub Action that injects the audit agent via user-data into any EC2 launch step in a CI/CD pipeline — teams already doing infrastructure-as-code can adopt it without changing their AMI, and the first gap report sells the paid baseline configuration feature.

The hard part

The value is highest at the moment of launch, which means the agent has to be pre-installed or injected via user-data — that's a chicken-and-egg problem where adoption requires a change to the launch process before the user has seen any value.

How it makes money

Free for single-account use with up to 10 instances; paid plans at $79/month per AWS account for team baselines, Slack integration, and historical gap tracking across AMI versions.