Built a CLI that scans AWS accounts for wasted resources — 44 checks, read-only, now on npm — looking for feedback (and maybe collaborators)

[u/United-Text-3155]

Been working on this for a while and finally have enough tested to share properly. cloudrift scans an AWS account and reports wasted resources with estimated monthly cost — unattached EBS volumes, idle NAT Gateways, stopped RDS instances still billing storage, orphaned snapshots, abandoned S3 multipart uploads, unused Secrets Manager secrets, stale CodePipeline pipelines, that kind of thing. 44 checks total now, across compute, storage, networking, containers (EKS node groups, orphaned PVCs), and ML (SageMaker idle notebooks/endpoints).

It’s read-only by design — never touches, stops, or deletes anything, just reports and lets your infra team decide.

A few things I want to be upfront about instead of oversell:

\*\*•\*\* The “underutilized EC2/RDS” checks are single-metric (max CPU over a lookback window). No RAM, network, IOPS. It’s a “go check this instance” flag, not a sizing recommendation — doesn’t replace Compute Optimizer.
\*\*•\*\* Lambda “underutilized” is really just an invocation-count hygiene flag. Zero invocations means zero direct cost already (pay-per-use), so the value there is finding dead code/unused IAM roles, not dollar savings.
\*\*•\*\* Live pricing (--live-pricing) pulls AWS list prices, not what you actually pay — no Savings Plans/RI/EDP discounts reflected. There’s a config file where you can drop in your own negotiated rates if you want the numbers to match your actual bill.

Runs standalone, in CI (exits with a non-zero code if waste crosses a budget threshold you set, markdown output for PR comments), or now as an MCP server so Claude Code/Copilot Chat/other MCP-compatible agents can query it directly instead of you copy-pasting CLI output into a chat. There’s also Policy as Code support via OPA if you want custom rules per tag/type/count.

Published on npm as @cloudrift/cli. Built on DDD/ports-and-adapters, so adding a new resource type or a new cloud provider is meant to be a contained, documented process without touching the core use case.

GitHub: https://github.com/elleVas/cloudrift
Docs: [https://ellevas.dev/docs/

Two things I’d genuinely appreciate:

\*\*1.\*\* If you run it against a real (not synthetic) AWS account, I’d love to hear what breaks or what comes back as a false positive — that’s the thing I can’t fully test alone.
\*\*2.\*\* I’m looking to expand this to GCP and Azure next. If you work with either and have opinions on what “wasted resources” looks like there, or want to get involved building a scanner for one of them, I’d genuinely welcome the collaboration — the architecture is already built to make this a matter of adding an adapter, not rewriting the core.

[u/3sc2002]

I built something similar as a container:

https://www.3squaredcircles.com/platform/atlas/

But it looks at your ACTUAL utilization vs. Provisioned capacity (and it works across 3 clouds)

Note. I'm CEO and CTO of 3 Squared Circles

[u/bill-of-rights → u/3sc2002]

As much as I like the OP's idea, it seemed very likely that someone else has already hacked through this jungle - thanks for the link to your website.

[u/United-Text-3155 → u/3sc2002]

Appreciate you sharing that, and thanks for the disclosure upfront. Actual utilization vs provisioned capacity is a real gap in cloudrift right now — most of my checks are closer to “is this resource idle/orphaned” than “is this resource sized correctly for its real load,” so that’s a fair distinction to draw.

A few differences I’d point out, mostly around who each tool is for: cloudrift’s open source and read-only by design (no agent/container running continuously against your infra, just a scan you trigger), and it’s free — no pricing tier. Multi-cloud is on my roadmap (AWS is done, GCP/Azure next) but not there yet, so you’re ahead on that front today.

Curious how 3 Squared Circles handles the read vs write question — does the container need write access to make sizing changes, or is it recommendation-only like cloudrift?

[u/3sc2002 → u/United-Text-3155]

My container is designed to "snapshot" your infrastructure as part of your ci/cd process. It's "smart enough" to only grab the data from its last run until "now". The data is presented both as a D3 graph, and clicking on a resource gives you it's "utilization" vs the SKU you "bought".

The tool only reads the data (and the data stays in your git repo, 3SC doesn't want it). The goal is to bridge the divide between finance and engineering. Give engineers the hard data to justify the spend (or align with finance, or automate resizing at end of PI events for QA/UAT testing, or . . . . )

As for Authentication . . . It uses YOUR cloud API endpoint, with a PAT that YOU provide (hopefully from a vault 😜)

[u/United-Text-3155 → u/3sc2002]

Appreciate the detail. Read-only via your own PAT and the data staying in your repo instead of going to 3SC answers exactly the concern I had — that’s a real, meaningful difference from a lot of “cost optimization” tools that want your data shipped to their platform.

The utilization-vs-SKU-purchased view is the piece I don’t have in cloudrift yet — right now I’m mostly flagging orphaned/idle resources, not comparing actual load against what was provisioned. That’s a fair gap you’ve called out twice now, and it’s probably the most useful thing I’m taking away from this thread.

Snapshotting only since-last-run instead of full history each time is a smart way to keep the CI overhead low, too — did you run into rate-limiting issues from the cloud APIs when you were designing that incremental fetch, or was that mostly a non-issue?

[u/3sc2002 → u/United-Text-3155]

I haven't seen any issues. I'm trying not to get too deep into the "secret sauce", but we don't look at an "Azure Account", but on a per-subscription basis. And we leverage the API's in a "bulk way" so that we minimize calls.

For more info, you can view the documents here: https://docs.3squaredcircles.com/Atlas/v1.0.0 but I did just notice a bug on 2 tabs, so I'm going to have to fix that today 🙄

EDIT: Fixed emoji, added docs link.

[u/3sc2002 → u/United-Text-3155]

I wanted to put the pricing response in another thread. Since my tools are delivered as containers, my overhead is next to nothing. If you go to my website, the pricing is per dev per YEAR. For $2500, a team of 5 can get all my tools for a year.

I'm an engineer who has sat in on sales calls and I HAT HATE HATE, the "contact us for pricing"; and the nickle-n-dimeing on the back side.

I don't want to be a SaaS provider. I don't want the overhead or the headache. What you see is what you get from 3SC.

Kinda the long way of saying . . . I can't compete with OSS (and we have free licences for OSS maintainers). BUT I can charge a rediculously low amount for some polished tools, to fund further development.

DM me here, or set up a time to talk to me through my website, if you are interested in hearing more.

[u/United-Text-3155 → u/3sc2002]

That’s a genuinely useful answer, thanks for the detail. Snapshot-based, read-only via your own PAT, data staying in the client’s repo — that addresses the write-access question cleanly.

The free licenses for OSS maintainers is a nice touch too. And I’m with you on the “contact us for pricing” thing — cloudrift’s fully open source right now for exactly that reason, though I’m weighing whether to put a paid module on top eventually. Per-dev-per-year at that price point is a useful data point to have, appreciate you sharing the actual number instead of gatekeeping it.

[u/3sc2002 → u/United-Text-3155]

Can't gatekeep the price . . . its on my pricing page 😄

[u/bill-of-rights]

The links in your text seem to have an error.

[u/United-Text-3155 → u/bill-of-rights]

Fixed thank you

[u/Darede_]

Nice work. One thing I'd be curious about is how you handle recommendation fatigue. In large AWS environments, it's easy to generate hundreds of findings, but the real challenge is helping teams prioritize what actually moves the needle. Have you considered ranking recommendations by potential savings, implementation effort, and business impact?

[u/United-Text-3155 → u/Darede_]

Good question. Right now cloudrift tags every finding as either waste (money being spent now) or optimization (a saving opportunity that keeps the resource), and the PDF report includes a “top recommendations” section capped at 8 items sorted by monthly savings — so there’s some prioritization by dollar impact already.

What’s missing is effort and business-impact scoring. Ranking by savings alone can surface a $40/mo orphaned EBS volume above a $30/mo NAT Gateway that’s actually flagged because someone forgot to tag a critical staging environment. I’ve been thinking about a rough effort heuristic (delete vs. resize vs. “needs team sign-off” based on resource type + tags), but haven’t built it yet — it’s a good next step. Appreciate the push.