The open port and the egress bill are one ticket, not two queues

Trace the upsizing path, because it is the one that never reaches the security queue at all. A database with a public endpoint and a permissive group absorbs continuous scan and connection-attempt traffic, which burns connections and CPU, and eventually produces the "we need a bigger instance" conversation that a private subnet would have made unnecessary ^[2]. What lands in the record is a larger instance class. Nothing in the billing data says why.

Now count the shared list against the bill. The dev.to write-up proposes four audit items: public databases, unrestricted security groups, wildcard IAM, and a tripwire test on cost alerting ^[12]. Only the first carries standing monthly charges, through egress rates on served bytes and through the instance size that scan load provoked ^[13]. Open security groups and wildcard roles price at zero until someone monetizes them, and the fourth item is a detection check, not a spend item ^[13].

That asymmetry is where the joint-label pitch gets thin. Wildcard IAM costs nothing while nothing goes wrong; it sets the blast radius, and the author's own term for it is unpriced tail risk ^[6]. The difference described is between an incident report saying an attacker enumerated one bucket and one saying the attacker launched 400 instances in three regions the company does not use ^[7]. Finance has no current line to point at, so this item stays a security ask with a cost label stapled on, and it will lose to the RDS finding every time.

The organisational logic still holds for the items that do have a number. Cost carries a monthly forcing function executives already read; security carries veto power; a finding wearing both labels clears prioritization queues that pure-risk findings sit in for quarters, according to the same piece ^[8][9].

The audit itself is cheap enough that the argument is mostly about routing. Public exposure is one `describe-db-instances` query filtered on `PubliclyAccessible`, cross-checked against each instance's security group; open groups are a `describe-security-groups` filter on `0.0.0.0/0` with the intentional web listeners removed ^[11]. The disposition rules matter more than the commands: every remaining open rule gets closed or documented today rather than sprint-after-next, and every wildcard role either gets scoped or gets a named owner and an expiry date ^[15]. A role with an owner and a date is the only version of that finding that survives contact with a prioritization meeting, because someone has to renew it.