Built for teams running S3 at scale
Every finding arrives with a dollar figure, a health score and the exact remediation to apply. Sorted worst-first, because that's where the money is.
We translate bucket size, storage class mix and access patterns into an annual figure — then model what each remediation actually returns. Savings are capped conservatively and never double-counted across overlapping actions.
Incomplete multipart uploads bill silently and never appear in the object list. We count them, age them and tell you what an abort rule reclaims.
Tag coverage against your required schema, ownership gaps and drift — scored per bucket so you can chase the worst offenders first.
Public access block state, SSE mode, access logging and replication — rolled into a security score with the specific setting that failed.
Cross-account by design. Scan client estates that don't sit inside your AWS Organization — something native tooling can't reach.
Every service is a layer. Every layer hides waste. GhostTrace peels them apart and prices what's hiding inside — starting with S3 today, compute next.
We're building coverage for the rest of your estate — EBS, EC2, RDS and beyond. While that work is underway, every S3 scan is on us. Connect an account and keep the savings.
S3 is live today. The same read-only role and the same costed-findings model is being extended service by service — starting with the biggest silent spenders.
Want a service prioritised? Tell us what's costing you most
You create one read-only role scoped to metadata calls. We assume it with a per-tenant external ID and never touch object data.
Email and password via Cognito. We issue you a unique external ID that scopes the trust relationship to your tenant alone.
Paste the trust policy and the read-only permission set into IAM. Both are shown on the connect page, ready to copy.
We attempt a single ListBuckets call to confirm the trust and permissions resolve before anything else runs.
Metadata collection runs asynchronously. The dashboard populates as results land — typically a few minutes for several hundred buckets.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<ghosttrace>:root"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "gt-<your-id>"
}
}
}]
}
// metadata only — no s3:GetObject "s3:ListAllMyBuckets" "s3:GetBucketLocation" "s3:GetBucketVersioning" "s3:GetLifecycleConfiguration" "s3:GetEncryptionConfiguration" "s3:GetBucketPublicAccessBlock" "s3:GetBucketLogging" "s3:GetBucketReplication" "s3:GetBucketTagging" "s3:ListBucketMultipartUploads" "cloudwatch:GetMetricStatistics"
The permission set has no object-level read. Even if our account were compromised, an attacker could not retrieve a single object from your buckets.
Nothing to pay while S3 is our only live scanner. Paid tiers unlock as EBS, EC2 and RDS coverage ships — and beta users keep S3 free permanently.
Every S3 capability, unmetered, for as long as S3 is the only live scanner.
Start scanningAdds EBS, EC2 and Elastic IP coverage on top of everything in S3 Scanner.
Join the waitlistFor MSPs and consultancies reporting across many client estates.
Talk to usFirst in line. We'll email you once — no spam.
Connect a read-only role and get a costed action list in minutes. Free while S3 is our only live scanner — and free for good if you join now.
Two minutes to connect · Revoke any time by deleting the role