eks-exposure / read-only
Amazon EKS · extended support · $0.60 per cluster-hour

Your stale EKS clusters bill $0.60 an hour. See the number.

Every cluster past its 14-month standard-support window costs an extra $4,380 a year, and it's already a line on your bill. A short read-only script prints your exposure in dollars. Four API calls. Nothing leaves your terminal.

Extended-support premium accrued since you opened this page
$0.0000
for a typical account with 4 clusters in extended support · paste your report below to make this yours
$2.00 / hrabove standard support
Fastest path · paste this to Claude Code, Cursor, Codex, or whatever runs your terminal

Hand it to your agent

Don't take my word for what the script does. Have your agent read it first, confirm it's read-only, and only then run it with read-only credentials. The prompt below says exactly that, and tells the agent to keep the output local.

Replace PROFILE with the AWS profile or role you'd use for a read-only audit. The agent needs nothing from this site except the script itself.

Fetch https://eksexposure.scottyah.com/eks-exposure.sh and read the whole thing before running anything.

Confirm for me that it (1) only calls these AWS APIs: eks:ListClusters, eks:DescribeCluster, eks:DescribeClusterVersions, ec2:DescribeRegions; (2) makes no other network requests (no curl, wget, or URLs other than AWS); (3) writes nothing except its own output. The IAM policy it needs is at https://eksexposure.scottyah.com/iam-policy.json; check it matches.

If all three hold, run it with --profile PROFILE --json --redact and save the output as exposure.json. Do not send the output anywhere.

Then tell me: how many clusters are in extended support and what that costs per year, which clusters are within 90 days of a forced control-plane upgrade, and the version hop each cluster needs (current to the oldest version still in standard support).
What happens to your data

Nothing leaves your machine unless you email it to me.

Running a stranger's script against production and pasting the output into a stranger's website is a reasonable thing to be uneasy about. So this is built to be checked, not trusted.

The script

  • About 150 lines of bash. Four AWS API calls, all describe or list. No write permission in the IAM policy, so it can't change anything even if you run it as admin.
  • No network calls except to AWS. grep -nE 'curl|wget|http' eks-exposure.sh returns nothing at all.
  • No telemetry, no "usage ping", no version check.
  • --redact replaces cluster names with cluster-1, cluster-2 and drops ARNs, so the output has no account ID and no names. Everything on this page works the same with redacted output.

This page

  • One HTML file, no frameworks, no fonts or scripts loaded from anywhere. The browser is told to block every outbound request with a Content-Security-Policy of connect-src 'none', which you can see in the page source.
  • No analytics, no cookies, no local storage. Pasting the JSON runs a few hundred lines of JavaScript in your tab and nothing else.
  • Save the page and open it from disk. It works offline, which is the simplest proof that it never calls home.
  • The only way your report reaches me is if you attach it to an email yourself. That's a choice, not a side effect.
Check it in ten seconds: open DevTools, Network tab, then paste and render. The request list stays empty. If it doesn't, the page has been tampered with and you should close it.
Two steps, five minutes
1

Run the script

It calls ListClusters, DescribeCluster, DescribeClusterVersions and DescribeRegions. That's the whole list. Read it before you run it; it's about 150 lines.

# needs aws CLI v2.22+ and jq, with read-only credentials
curl -fsSLO https://eksexposure.scottyah.com/eks-exposure.sh
less eks-exposure.sh          # read it first
chmod +x eks-exposure.sh
./eks-exposure.sh             # human-readable report
./eks-exposure.sh --json --redact > exposure.json   # no names, no account id
View the script Minimal IAM policy

Flags: --profile, --regions us-east-1,us-west-2. Regions where EKS isn't enabled are skipped.

2

Paste the JSON

This page reads it in your browser and renders it. No upload, no request, no analytics. Open the network tab if you like.

The calendar, from AWS

When each version starts billing, and when it gets force-upgraded

Standard support lasts 14 months from the EKS release date. Extended support runs 12 more months at the higher rate, then the control plane is upgraded for you.

VersionEKS releaseBilling jumps (end of standard)Forced upgrade (end of extended)Status today

Source: Amazon EKS Kubernetes version lifecycle and EKS pricing. The script pulls live dates from describe-cluster-versions; this table was checked on 2026-09-05.

If you'd rather not do it yourself

EKS Upgrade Sprint

One cluster, one minor version or more, three weeks, fixed price. I do the upgrade; you keep the pager. The price is quoted against the line on your bill, so the math is yours to check.

$14,000 per cluster · 3 weeks · fixed

Included

  • Pre-flight: deprecated API scan, add-on and controller compatibility matrix, node-group and AMI plan, written go/no-go
  • Staged upgrade: control plane, then add-ons, then node groups, one hop at a time, in a window you choose
  • Rollback plan inside AWS's 7-day rollback window
  • Handoff document your team can repeat for the next version

Not included

  • On-call, retainers, or incident response after handoff
  • Application code changes beyond API deprecations

Get a fixed quote

Send the JSON from the script. I'll reply within one business day with a per-cluster price and the earliest window. Multi-cluster accounts get a bundled number.

Email the report

Read-only access is enough for the quote. Write access is scoped to the upgrade window and revoked at handoff.