The scan forgot the volume we deleted

The second audit was always the awkward one.

I would come back a month later. The volumes were gone. The new sheet was shorter. Finance would ask what we had actually saved. I had last month's spreadsheet if I had remembered to save it, and a Slack thread if I had not. The resource id was the only way to know it was the same volume. Once it left AWS, a fresh export could not see it.

A scan is a photograph. It shows what is unused today. It does not remember March.

What we keep

We keep a ledger of the findings, not a second copy of the account. For each one: the resource id, the ARN, the account, the region, the monthly estimate, and whether it is still open.

The next complete scan looks that row up. If the resource is no longer a finding, it cleared. You deleted it, you attached it, or you whitelisted it. Same signal. You decided. We record that the finding closed.

If a scan does not finish a region, we do not mark the missing ones cleared. A failed pass is not a cleanup. A spreadsheet used to do the same trick: the rows that never loaded looked like savings.

What you can tell finance

The first email is potential. Realized savings are the findings that cleared.

Slack and Teams say how many cleared since the last complete scan. In the app, the trend stays on that resource, so the volume from March is still a line you can point at after it is gone. Cost Explorer may show the bill dipping. It will not name the volume.

We do not store your inventory. No user-data, no bucket contents, no second CMDB. The ledger is the identity of the finding, so the story survives the next Monday.

Related: the bill that grew while nobody was looking.

Run a scan, delete one thing you already meant to delete, and look at the next report. That is the whole demo.