Jay Y. Lee

The AWS estate, as code

Zones, distributions, certificates, mail and cost reporting, defined in code rather than clicked. Audited now and then for things I stopped using.

RunningAWS / IaC

Log

Audit turned up things I had stopped using

Went looking for anything still billing that no longer earns it.

  • A hosted zone for a domain that moved to Wix in August 2025. The zone had been

dark and charging ever since, because nothing tells you when the registrar delegation changes out from under you.

  • Two orphaned buckets from projects that ended years ago.
  • An old family photo bucket with a public read policy gated on the HTTP referer

header. That is not protection. One extra header on the request defeats it, and I confirmed that before removing it.

Also deleted a former client's document archive. There was no reason to still be holding their records, and holding them is its own kind of risk.

One certificate for everything

Replaced a per-host approach with a single ACM wildcard covering the apex and every subdomain. It renews itself as long as the validation record stays in the zone, which is the part people delete by accident during a tidy-up.