Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Footprint
Everything Firekeeper runs in your accounts, what it is for, and what it costs at list price.
$363 a month, estimated
$344 fixed, plus models at about $18.40 (the last 7 days ($4.29) projected over the month). Models today: $3.78 of $15; up to $30 a day while a case is active.
| What | Where | A month | Basis |
|---|---|---|---|
| Hub interface endpoints (16, two zones) Lets the scanner and the agents reach AWS APIs without the internet. | Hub account | $234 | 16 x 2 zones x $0.01 an hour |
| Console load balancer Serves this console behind your sign-in provider. | Console edge | $16.43 | $0.0225 an hour, plus capacity units |
| Console web firewall Rate-limits and filters the console's one public address. | Console edge | $8 | $5 a web ACL and $1 a rule, 3 rules |
| Dedicated node (one t3.medium) and its volume Runs the four Firekeeper workloads apart from yours. | Your cluster | $31.97 | $0.0416 an hour, 20 GB gp3 |
| KMS keys (2) and secrets (4) Encrypt the ledger and state, and hold the console's two settable secrets. | Hub account | $3.60 | $1 a key, $0.40 a secret |
| Event lane: rules, queue and forwarders Brings each account's management events to the hub within seconds. | Each member account | $1.20 | about 2 million events a month at $1 a million |
| Firekeeper's own logs and witness stream Every request, act and decision, append-only. | Hub account | $1.50 | about 3 GB at $0.50 a GB ingested |
| State and ledger buckets Run results and the signed ledger, the ledger under Object Lock. | Hub account | $0.70 | under 30 GB of S3 Standard |
| Defend NAT gateway Gives the verifier one owned address the countdown policy can name. | Defend | $32.85 | $0.045 an hour, plus $0.045 a GB |
| Defend STS endpoint (two zones) Lets the verifier take its act role without leaving the VPC. | Defend | $14.60 | 2 zones x $0.01 an hour |
| Agents on Bedrock Triage, investigation, hunting and chat; never more than the daily ceiling. | Bedrock models | usage | usage; see the model line |
Plus data through the endpoints ($0.01 a GB) and the agents' usage, which the daily ceilings bound. AWS list prices, us-east-1, read 2026-10-09; other regions differ, and your bill is the measure.
Make Firekeeper better
Turn these on in AWS so Firekeeper sees more. Firekeeper changes nothing here.
OffBedrock model access: hunt (Sonnet class)$3 to $12 a month
Looks across runs every hour for slow, multi-step activity no single finding shows, and drafts hardening proposals.
Details
Request access to a Sonnet-class model on the Bedrock model-access page, then sign the agents.models setting. Price: one hourly pass over the run deltas.
OffAn organisation trail$0 to $12 a month
Every account's events in one place, including accounts created after install, so a new account is never unwatched.
Details
Create it from the management account; Firekeeper finds it on the next full read. Price: the first copy of management events is free; $2 per 100,000 for a second copy.
OffVPC flow logs$10 to $45 a month
Shows where an isolated instance tried to connect, and which addresses talked to your workloads.
Details
Enable flow logs to S3 on the production VPCs; Firekeeper reads the bucket with its existing role. Price: $0.25 a GB delivered to S3.
Partly onCloudTrail data events on your sensitive buckets$4 to $30 a month
Shows who read which objects. On for 1 of your 3 sensitive buckets: Firekeeper cannot say what was read from the other two.
Details
Add the two buckets to the trail's data event selectors; Firekeeper reads them with its existing role. Price: $0.10 per 100,000 data events.
Partly onEKS audit logs on all clusters$15 to $60 a month
Shows who did what inside Kubernetes. On for 2 of your 3 clusters.
Details
Turn on the audit log type for the third cluster in the EKS console. Price: $0.50 a GB ingested into CloudWatch Logs.
OnBedrock model access: lead (Opus class)$4 to $25 a month
Investigates active cases, writes the checked narrative, explains plans and answers the chat.
Details
Enabled at install; the model is pinned at your first signature. Price: measured token profile for accounts of this size; hard ceiling $15 a day.
OnBedrock model access: triage (Haiku class)$1 to $6 a month
Triages every new finding and lane hit within seconds, so the lead model is spent only where it matters.
Details
Enabled at install. Price: about 1,500 short calls a month.
Every resource
Each resource Firekeeper runs, where it is, why it is there and what it costs. Names are Firekeeper's own.
No full sweep has written an inventory yet. The next one will.
Uninstall
Everything but the ledger: the dry run below is the run.
What Defend holds
Firekeeper could not read what Defend is holding. Nothing below starts until it can.
What goes and what stays
No full sweep has written an inventory yet, so there is no plan to show.
Sign the decommission
A keeper signs install.decommission with a passkey. With one keeper it waits a 72-hour lock with notices on every channel; with two, the second keeper signs. An uninstall that does not wait still works as the account owner's act, and is reported as tampering.
Nothing can be signed while the steps above refuse to start.
Progress
Firekeeper could not read the uninstall's progress.