What a finding holds
| Field | Meaning |
|---|---|
finding_id | Stable id, f- followed by 16 hex characters |
resource_arn, resource_id, resource_type | The resource |
account_id, region | Where it is |
waste_type | The kind of waste, for example unattached_volume |
monthly_cost | Monthly saving if you act on it |
cost_source | Where that number came from. See below |
confidence | 0 to 1. Raised when an AWS recommendation agrees with the scanner |
evidence | The metrics behind the conclusion, such as days idle or request count |
iac_owner | terraform, cloudformation, clickops or unknown |
keep | True when a keep tag or your allow-list protects the resource |
source | scanner, cost_optimization_hub or compute_optimizer |
Cost sources
cost_source | What the number is |
|---|---|
cur | Billed cost of that specific resource from your Cost and Usage Report (CUR 2.0, queried through Athena), discounts included. Used when the CUR export is configured |
list_price | The AWS Price List API rate for the resource's region. Rates are cached for 7 days. Your negotiated or committed rate may be lower |
aws_recommendation | An estimate supplied by Cost Optimization Hub or Compute Optimizer |
fallback_list_price | A built-in rate table, used only when the Price List API cannot be reached. Treat it as an approximation |
unknown | No cost could be determined |
When the CUR has the resource, the billed figure replaces the list price and both are kept in the evidence. In the hosted service CUR pricing is not wired up yet, so hosted findings carry list prices. Rightsizing estimates use on-demand prices and do not discount commitments you already hold, such as reservations.
What is scanned
| Category | Resources |
|---|---|
| Compute | EC2 instances, Lambda functions, ECS services |
| Database and cache | RDS instances and read replicas, ElastiCache, OpenSearch, DynamoDB, Redshift |
| Storage | S3 buckets (configuration only), unattached EBS volumes, orphaned snapshots, stale AMIs, gp2 volumes |
| Networking | Elastic IPs, load balancers, NAT gateways, CloudFront, API Gateway, Route 53 |
| Machine learning | SageMaker notebooks and endpoints; Bedrock provisioned throughput, custom models, knowledge bases, agents and guardrails |
| Streaming and analytics | Kinesis streams, Glue jobs |
| Other | Secrets Manager secrets not accessed (names and dates only), CloudWatch log groups with no retention |
Only some waste types have a remediation template. The rest are findings with a recommendation. See risk tiers.
AWS's own recommendations
Cost Optimization Hub and Compute Optimizer results are pulled into the same list and de-duplicated against the scanner's findings. Turn this off with AWS_NATIVE_RECOMMENDATIONS=false.
Keep tags and the allow-list
- A resource tagged
Keep=trueis left out of findings, recommendations and remediation. Change the tag keys withKEEP_TAG_KEYS. REMEDIATION_ALLOW_LISTtakes resource ARNs or ids that must never be touched.- The tag is read again from live AWS immediately before any approved action runs.
Verified savings
When a finding is remediated, the ledger records its before-cost, the date and who approved. A monthly job compares each entry with the CUR for a calendar month. Verified saving is the before-cost minus what the resource was still billed that month, and only months that start after the remediation date count. Without the CUR, savings stay "expected" and are never called verified. The hosted service does not read the CUR yet, so it reports no verified savings.
Sources: findings/model.py, findings/builder.py, pricing/rates.py, billing/cur.py, billing/ledger.py, workers/scan.py.