Developer Docs

AWS Operations

Discovering orphaned cloud resources, auditing AWS infrastructure, and cleaning up stale development stages.

AWS Operations

The ds aws commands help you manage the AWS resources behind DevStride. Over time, personal stages accumulate — developers create stages for features, forget to tear them down, and resources linger. These commands find and clean up that drift.

Cleanup

Interactive Cleanup

ds aws cleanup

Discovers and destroys orphaned personal stages. This is the primary tool for keeping your AWS account tidy.

Process:

  1. Scans all Pulumi stacks
  2. Identifies personal stages not deployed in the last 14 days (configurable)
  3. Shows an interactive menu of stale stages with details
  4. Destroys selected stages (empties S3, runs pulumi destroy, removes stack)

Options

FlagDescription
--region <regions>Comma-separated regions to scan (all regions if omitted)
--stale-days <n>Days since last deploy to flag as stale (default: 14)
--dry-runPreview without deleting
--include-neonAlso delete associated Neon database branches
--stages <list>Target specific stages (comma-separated)
--forceSkip interactive confirmation

Examples

# Find stages not deployed in 30+ days
ds aws cleanup --stale-days 30

# Preview what would be cleaned up
ds aws cleanup --dry-run

# Clean up specific stages
ds aws cleanup --stages phil-old-feature,phil-test-branch

# Full cleanup including Neon branches
ds aws cleanup --include-neon

# Scan only us-east-1
ds aws cleanup --region us-east-1

When to Run

  • Monthly — as part of routine hygiene
  • After finishing a set of features — clean up all related stages
  • When AWS costs spike — orphaned stages accumulate Lambda, API Gateway, and DynamoDB costs
  • Before onboarding — clean up old developer stages to reduce clutter

Resource Audit

Full Audit

ds aws audit

Inventories all deployed AWS resources by stage and service. This gives you a comprehensive view of what's running in your account.

Services scanned (14+):

ServiceWhat's Checked
LambdaFunctions, layers, event source mappings
API GatewayREST APIs, stages, custom domains
S3Buckets, objects
DynamoDBTables, indexes
CognitoUser pools, app clients
Step FunctionsState machines
EventBridgeEvent buses, rules
SQSQueues (standard and FIFO)
SNSTopics, subscriptions
CloudWatchLog groups, alarms
Secrets ManagerSecrets
CloudFrontDistributions
IAMRoles, policies
CloudFormationStacks (from CDK constructs)

Output

The default output groups resources by stage:

Stage: phil-local (personal, us-east-1)
  Last activity: 2 days ago
  Lambda: 8 functions
  API Gateway: 1 API
  S3: 2 buckets
  DynamoDB: 4 tables
  Cognito: 1 user pool
  ...

Stage: phil-feature-auth (personal, us-east-1)
  Last activity: 21 days ago ⚠️ STALE
  Lambda: 8 functions
  ...

Each stage is classified:

  • prod — Production environment
  • dev — Shared development environment
  • personal — Developer-specific stage

Stale stages (no activity in 14+ days) are flagged with a warning.

Options

FlagDescription
--region <region>Scan only a specific region
--jsonMachine-readable JSON output
--verboseList individual resource names (not just counts)

Examples

# Full audit across all regions
ds aws audit

# Audit a specific region
ds aws audit --region us-east-1

# Machine-readable output for scripting
ds aws audit --json

# Show individual resource names
ds aws audit --verbose

Cost Awareness

Every deployed personal stage incurs costs:

ResourceCost Driver
LambdaMinimal when idle (pay-per-invocation)
API GatewayMinimal when idle
DynamoDBOn-demand billing — minimal when idle
CloudFrontDistribution exists but costs little without traffic
CognitoFree tier covers most personal stages
S3Storage costs for frontend assets
Secrets ManagerPer-secret per-month fee

Individual personal stages are cheap, but dozens of forgotten stages add up. Regular cleanup with ds aws cleanup keeps costs predictable.

Next Steps