Support
Everything you need to know before connecting your AWS account.
GhostHunter calls standard AWS read-only Describe APIs across your selected regions to list resources and check their status. It identifies resources that are idle or unattached — EBS volumes with no instance, Elastic IPs with no association, RDS instances with near-zero connections, aged snapshots, abandoned load balancers, unused security groups, and more. Nothing is written to your account during a scan.
The current scanner detects the following resource types:
More resource types are added regularly. NAT Gateways, ElastiCache, ECR, and ECS support are on the roadmap.
None. GhostHunter only calls AWS read-only Describe and List APIs — the same calls you make when browsing the AWS Console. No agents, sidecars, or binaries are installed anywhere. There is zero impact on your running workloads, databases, or network. AWS Describe APIs are also free-tier eligible, so scanning does not meaningfully add to your AWS bill.
GhostHunter never stores AWS credentials. You deploy an IAM Role in your account that trusts GhostHunter's AWS account ID.
We call sts:AssumeRole
with a unique ExternalId per account, which prevents the
confused deputy attack.
Your Role ARN and ExternalId are encrypted at rest (AES-256-GCM). All traffic uses HTTPS.
This is the same model used by Datadog, CloudHealth, and AWS Cost Explorer.
No. The default IAM role deployed in Step 1 is strictly read-only — it has zero write or delete permissions. Purge capability requires a separate optional CloudFormation update (Step 2) that you deploy yourself. Even with purge enabled, every deletion requires an explicit owner action in the UI, with a dry-run option that simulates the deletion without touching anything real. Only org owners can trigger live purges.
Delete the GhostHunterScanner
IAM Role from your AWS account. GhostHunter immediately loses all access — no offboarding steps needed on our side.
You control access entirely through standard AWS IAM, the same way you control access for any other service.
Negligibly. GhostHunter uses AWS Describe and List APIs, which are free-tier eligible and have no per-call cost for the vast majority of services. A full scan across all regions typically makes a few hundred API calls — well within AWS's free allowances. You will not see a measurable line item from GhostHunter on your AWS bill.
You can cancel your subscription at any time from the Billing page — no lock-in contracts or minimum periods. For refund requests, please see our full policy:
Read the Refund Policy →Still have questions?
Contact Support