HetOps Radar
Sign in Start free

Dates checked against AWS's own pages

AWS end-of-support, before it bills you.

Radar checks every EKS, RDS, ElastiCache, OpenSearch, MSK and Lambda version across your accounts against AWS's published dates. When something slips into paid Extended Support, you hear about it with the monthly cost attached.

Start free See how it works
  • Read-only IAM role
  • No access keys
  • Open-source scanner
$0/mo billing now $0/mo more in 60 days Closer to the centre, sooner it bills you
Checks, in every region EKSRDS and AuroraElastiCacheOpenSearchMSKLambda

Old versions don't break. They quietly start costing.

When standard support ends, AWS keeps your cluster or database running and moves it to paid Extended Support. Nothing alerts you. The first sign is usually the bill.

Per EKS cluster, every month, on extended support

$365 /month extra

Standard $0.10/hExtended $0.60/h

Then AWS upgrades it for you

When extended support ends, the upgrade happens on AWS's schedule, not yours. Radar shows that date for every resource.

Lambda runtimes go stale

Deprecated runtimes stop getting security patches. Radar lists every function still on one, in every region.

How it works

Connected in two minutes. Watched from then on.

No agent and no access keys. The only thing you add to your account is one role.

  1. Deploy one read-only role

    Radar gives you a CloudFormation template with your private connection id built in. One command creates HetOpsRadarReadOnly.

    # in the AWS account you want watched
aws cloudformation deploy \
  --stack-name hetops-radar \
  --template-file hetops-radar-role.yaml \
  --capabilities CAPABILITY_NAMED_IAM

  2. Paste its ARN

    Radar assumes the role once to prove it works, then runs the first scan across every enabled region.

    arn:aws:iam::4821·····9037:role/HetOpsRadarReadOnlyConnected

  3. Hear about it before the bill does

    Daily scans. Only new or worse findings reach you, by email or in Slack, with the date, the AWS source and the monthly cost.

    HetOps Radar · production

    2 new end-of-support findings · about $365 a month

    payments-prod · EKS 1.31extended

    thumbnailer · python3.10soon

Security

What Radar can and can't touch.

  • Reads versions, nothing elseEleven list and describe actions. No data, no secrets, no writes.
  • No keys leave your accountThe role trusts only the HetOps account, and only with your private external id.
  • One-hour credentialsEach scan assumes the role for at most an hour. The credentials are never stored.
  • A scanner you can readIt's open source; its tests assert it only calls list and describe.
  • Gone in one stepDelete the stack and access ends that second.
HetOpsRadarReadOnly
  • EC2DescribeRegions
  • EKSListClustersDescribeCluster
  • RDS and AuroraDescribeDBInstancesDescribeDBClusters
  • ElastiCacheDescribeCacheClustersDescribeServerlessCaches
  • OpenSearchListDomainNamesDescribeDomains
  • MSKListClustersV2
  • LambdaListFunctions

11 actions allowed0 writes0 data readsEverything else denied

One month of one extended-support cluster pays for a year of Pro.

Start free with one account. Upgrade when Radar has paid for itself, which is usually its first finding.

Billed monthly through Lemon Squeezy, taxes handled. Cancel any time and keep the plan until the period ends. 14-day refund on your first payment. Terms, privacy and refunds.

FAQ

Questions platform teams ask.

Something else? Email Het.

Can Radar change anything in my account?

No. The role allows eleven list and describe actions and nothing else. The full permission list is above, and in the template before you deploy it.

Does it cost anything on the AWS side?

No. Assuming a role and making describe and list calls are free.

Which regions does it scan?

Every region enabled in your account, found again on each scan. Nothing to configure when you start using a new one.

Where do the end-of-support dates come from?

From AWS's own documentation, kept in the open-source retirements.yaml with a source link for every service. A version Radar doesn't know is shown as unknown, never as fine.

Can I try it without paying?

Yes. Free covers one account with weekly scans and email alerts, for as long as you like.

How do I disconnect?

Delete the hetops-radar stack in your AWS account; access ends immediately. Remove the account in Radar to delete its scan history too.

Start watching your first account.

Free for one account. No card and no password: we email you a sign-in link.