How healthy is your cloud setup?

Can you explain last month's cloud bill by product, team or environment?

Do non-production environments shut down or scale down outside working hours?

Are steady workloads covered by Savings Plans or reservations?

Is MFA enforced for every person with cloud console access?

Are CI pipelines and laptops free of long-lived cloud access keys?

Have you restored a backup, for real, in the last three months?

Is your infrastructure defined in code (Terraform, OpenTofu or similar)?

Could you rebuild production in a new account or region from that code?

Do infrastructure changes go through review before they are applied?

Do you get alerted about outages before customers tell you?

Do deployments run through a pipeline instead of by hand?

Could someone other than one specific person handle a production incident?

Is a WAF in blocking mode in front of your public applications?

Can your origin servers only be reached through your CDN?

Are TLS certificates renewed automatically?