# LeftSize

> LeftSize is "Dependabot for cloud waste": a GitHub App plus an open-source (MIT) GitHub Action that scans AWS and Azure accounts with read-only access and opens GitHub issues for idle and orphaned resources, service retirements and end-of-support deadlines, and security and governance gaps. Each issue includes the affected resources, impact and remediation steps.

- The scan runs in the customer's own GitHub Actions runner and signs in with OIDC using a read-only role (Azure: Reader and Monitoring Reader; AWS: ReadOnlyAccess). Credentials never leave the runner; LeftSize receives only the findings.
- Findings are grouped into one GitHub issue per rule and scope and updated on every scan. Issue comments such as `@leftsize explain`, `@leftsize howto`, `@leftsize script`, `@leftsize impact`, `@leftsize alternatives`, `@leftsize snooze` and `@leftsize ignore` give more detail or manage the issue.
- 188 rules: 77 cost optimization, 70 deprecation and retirement, 27 security and 14 governance (97 AWS, 91 Azure).
- Pricing: Free plan with all 77 cost optimization rules for up to 3 repositories. Paid plans per GitHub organization add the deprecation, security and governance rules and more repositories: Team $79/month (up to 10 repositories) or Business $249/month (unlimited repositories), 17% less when paid yearly.
- Built on Cloud Custodian. GitHub only (no GitLab or Azure DevOps).

## Links

- [Website](https://leftsize.com/)
- [Rule catalog](https://leftsize.com/rules/): every rule with what it checks, why it matters and how to fix it
- [Install the GitHub App](https://github.com/apps/leftsize)
- [GitHub Action source (MIT)](https://github.com/LeftSize/leftsize-action)
- [Documentation](https://support.leftsize.com)
- [LeftSize for coding agents](https://leftsize.com/agents/): work with findings from Claude Code, Codex or Cursor through the GitHub CLI or GitHub MCP server; no separate API or MCP server
- [Agent skill](https://github.com/LeftSize/agent-skills): install with `npx skills add LeftSize/agent-skills`
- [Coding agents guide](https://support.leftsize.com/agents.md)
- Contact: hi@leftsize.com

## Comparisons

- [LeftSize vs Azure Advisor](https://leftsize.com/compare/azure-advisor/): Microsoft’s built-in recommendations for Azure
- [LeftSize vs AWS Trusted Advisor & Cost Optimization Hub](https://leftsize.com/compare/aws-trusted-advisor/): AWS’s built-in checks and savings recommendations
- [LeftSize vs Infracost](https://leftsize.com/compare/infracost/): Cost estimates and FinOps policies for infrastructure as code
- [LeftSize vs Cloud Custodian (DIY)](https://leftsize.com/compare/cloud-custodian/): The open-source policy engine LeftSize is built on

## Rules

### Azure: Cost optimization (Free)

- [AKS clusters with low node CPU and memory usage](https://leftsize.com/rules/azure/overprovisioned-aks-nodes/): Running AKS clusters whose nodes averaged under 20% CPU and under 40% memory (working set) over 7 days
- [AKS clusters without autoscaler](https://leftsize.com/rules/azure/aks-cluster-autoscaler-disabled/): Running AKS clusters with 3+ nodes where no node pool has the cluster autoscaler enabled
- [AKS node pools on expensive VM sizes](https://leftsize.com/rules/azure/aks-using-expensive-vm-sizes/): Running AKS clusters with a node pool on an older-generation VM size (Dsv3/Esv3 8+ vCPU, Esv3 4 vCPU, Fs v1) where a newer generation usually gives better price-performance
- [Non-production AKS clusters running outside working hours](https://leftsize.com/rules/azure/aks-dev-clusters-always-running/): Running non-production AKS clusters (from tags or names) that could be stopped or scaled down outside working hours
- [Idle VMs](https://leftsize.com/rules/azure/idle-vm/): Virtual machines with consistently low CPU utilization that may be candidates for stopping or downsizing
- [Empty App Service Plans](https://leftsize.com/rules/azure/idle-app-service-plan-no-apps/): App Service Plans with no deployed applications consuming unnecessary resources
- [Underutilized App Service Plans](https://leftsize.com/rules/azure/idle-app-service-plan/): App Service Plans with low CPU and memory utilization that may benefit from downsizing or consolidation
- [App Service Plans on Basic/Standard - review Premium v3](https://leftsize.com/rules/azure/outdated-app-service-plan/): App Service Plans with apps on Basic (B1-B3) or Standard (S1-S3) SKUs that may get better price-performance on Premium v3
- [Unattached disks](https://leftsize.com/rules/azure/unattached-disk/): Managed disks that are not attached to any virtual machine but still incurring storage costs
- [Unused public IPs](https://leftsize.com/rules/azure/unused-public-ip/): Public IP addresses that are not attached to any resource and generating unnecessary costs
- [Azure Load Balancers with no backend members](https://leftsize.com/rules/azure/inactive-azure-load-balancer/): Azure Load Balancers with no backend pool members (neither NIC-based nor IP-based), which can usually be deleted together with their public IPs
- [Windows VMs without Azure Hybrid Benefit](https://leftsize.com/rules/azure/hybrid-benefit-missing/): Running Windows VMs without Azure Hybrid Benefit enabled (savings require eligible Windows Server licenses with Software Assurance or subscriptions)
- [Non-prod VMs without auto-shutdown](https://leftsize.com/rules/azure/vm-scheduled-shutdown-missing/): Running non-production VMs (from tags or resource and resource group names) without an enabled auto-shutdown schedule
- [Disk snapshots older than 30 days](https://leftsize.com/rules/azure/orphaned-snapshots/): Old disk snapshots no longer needed, accumulating storage costs
- [Storage accounts on Hot tier with almost no activity](https://leftsize.com/rules/azure/storage-suboptimal-tier/): GPv2/Blob storage accounts with Hot as default access tier, older than 90 days, with at most 100 transactions in the last 30 days
- [Linux VMs that could move to Arm64 sizes](https://leftsize.com/rules/azure/vm-arm-architecture/): Running Linux VMs on x64 D/E-series v3-v5 sizes that could move to Arm64 sizes (Dpsv5/Epsv5/Dpsv6) for better price-performance
- [SQL databases with unnecessary Business Critical tier](https://leftsize.com/rules/azure/sql-business-critical-nonprod/): Non-production Azure SQL databases (from tags or names) using the Business Critical tier; General Purpose costs roughly half or less for the same vCores (estimate)
- [Stopped VMs still incurring storage costs](https://leftsize.com/rules/azure/stopped-vm-storage-costs/): Virtual machines that have been stopped or deallocated for about 30+ days and still incur costs for their managed disks, public IPs and other attached resources (and for compute too if only stopped, not deallocated)
- [Empty SQL Elastic Pools](https://leftsize.com/rules/azure/sql-elastic-pool-empty/): SQL Elastic Pools with no allocated database storage for the last 7 days (no databases), still incurring eDTU/vCore charges
- [SQL databases without Azure Hybrid Benefit](https://leftsize.com/rules/azure/sql-hybrid-benefit-missing/): Single Azure SQL databases on provisioned vCore General Purpose or Business Critical (not serverless, not in an elastic pool) without Azure Hybrid Benefit
- [Azure Container Registries without retention policy](https://leftsize.com/rules/azure/acr-no-lifecycle-policy/): Premium Azure Container Registries without the untagged-manifest retention policy accumulate untagged manifests
- [Idle Application Gateways](https://leftsize.com/rules/azure/app-gateway-idle/): Running Azure Application Gateways whose backend pools have no targets
- [Underutilized Redis Caches](https://leftsize.com/rules/azure/redis-cache-underutilized/): Azure Cache for Redis instances with average memory usage of 20% or less over 14 days
- [Disks attached to deallocated VMs](https://leftsize.com/rules/azure/disk-attached-to-deallocated-vm/): Managed disks attached to deallocated VMs incur storage costs with zero compute value
- [Overprovisioned SQL databases](https://leftsize.com/rules/azure/azure-sql-overprovisioned/): DTU-model Azure SQL Databases with average DTU consumption of 20% or less over 14 days
- [Cosmos DB accounts with overprovisioned throughput](https://leftsize.com/rules/azure/cosmos-overprovisioned-throughput/): Provisioned-throughput Cosmos DB accounts with average normalized RU consumption of 30% or less over 14 days
- [VMs in regions with an 8–17% price increase from Feb 1, 2027](https://leftsize.com/rules/azure/vm-regional-price-increase-2027/): VMs in West Europe, North Europe, France Central/South, Norway East/West or Southeast Asia on a VM series that is not excluded from the 1 February 2027 regional price increase
- [Storage accounts in regions with an 8–17% price increase from Feb 1, 2027](https://leftsize.com/rules/azure/storage-regional-price-increase-2027/): Storage accounts (GPv2, Blob, Premium block blob, Premium files) in regions with an Azure Storage price increase on 1 February 2027
- [Azure Bastion hosts with no sessions in 7 days](https://leftsize.com/rules/azure/bastion-idle/): Azure Bastion hosts (Basic, Standard, Premium) with no sessions in the last 7 days
- [Storage accounts paying the SFTP hourly charge](https://leftsize.com/rules/azure/storage-sftp-enabled/): Storage accounts with SFTP enabled (flat hourly charge whether or not SFTP is used)
- [Azure SQL Databases on the DTU purchasing model](https://leftsize.com/rules/azure/sql-database-dtu-model/): Azure SQL Databases on DTU Standard S3+ or Premium (still supported) that may cost less on vCore

### Azure: Deprecations & retirements (Team and Business)

- [VMs on retired NVv3/NVv4 sizes (retired Sep 30, 2026) — resize required](https://leftsize.com/rules/azure/nvv4-series-retirement/): VMs on NVv3 or NVv4 sizes, which Microsoft retired on September 30, 2026; they are deallocated and must be resized to a supported GPU size
- [Linux Consumption Functions plans - migrate to Flex Consumption before Sep 30, 2028](https://leftsize.com/rules/azure/functions-linux-consumption-retirement/): Azure Functions Linux Consumption (Y1) hosting retires on September 30, 2028; v3-runtime apps on it already stopped on September 30, 2026; migrate to Flex Consumption
- [AKS clusters on Kubernetes versions out of support or ending by Nov 30, 2026](https://leftsize.com/rules/azure/aks-outdated-version/): AKS clusters whose control plane or node pools run a Kubernetes minor version that is out of AKS support or ends support by November 30, 2026
- [Application Gateways still on the retired V1 SKU (retired Apr 28, 2026) — migrate to V2 now](https://leftsize.com/rules/azure/appgateway-v1-deprecated/): Azure Application Gateways still on the V1 SKU, which was retired on April 28, 2026 and is no longer supported
- [OS disks using Standard HDD — migrate before Sep 8, 2028](https://leftsize.com/rules/azure/hdd-os-disk-retirement/): Azure Managed Disks using Standard HDD as OS disks require migration to Standard SSD or Premium SSD before September 8, 2028
- [MariaDB servers still present — service retired Sep 19, 2025, export data now](https://leftsize.com/rules/azure/mariadb-deprecated/): Azure Database for MariaDB was retired on September 19, 2025 — servers still listed must have their data exported and be migrated to MySQL Flexible Server
- [Basic Load Balancers — retired Sep 30, 2025, unsupported with no SLA](https://leftsize.com/rules/azure/basic-loadbalancer-deprecated/): Azure Basic Load Balancer was retired on September 30, 2025 — remaining Basic LBs still run but are unsupported with no SLA; upgrade to Standard
- [VMs still on unmanaged disks (retired Mar 31, 2026) — convert to managed disks](https://leftsize.com/rules/azure/unmanaged-disks-retirement/): Azure VMs still using unmanaged disks (VHDs in storage accounts) after the March 31, 2026 retirement; they cannot start until converted to managed disks
- [GPv1 / legacy Blob Storage accounts retired Oct 13, 2026 — upgrade to GPv2](https://leftsize.com/rules/azure/storage-legacy-account-retirement/): General-purpose v1 and legacy Blob Storage accounts were retired on October 13, 2026; remaining accounts are being migrated to GPv2 by Microsoft, which may increase transaction costs
- [VMs on M192i*_v2 sizes retiring March 31, 2027](https://leftsize.com/rules/azure/vm-m192i-v2-retirement/): VMs on isolated Msv2 / Mdsv2 Medium Memory (M192i*_v2) sizes, which Microsoft retires on March 31, 2027
- [VMs on NP/HC/HBv2 sizes retiring May 31, 2027](https://leftsize.com/rules/azure/vm-hpc-fpga-retirement-2027/): VMs on NP (FPGA), HC and HBv2 (HPC) sizes, which Microsoft retires on May 31, 2027
- [VMs on D/Ds/Dv2/Dsv2/Ls sizes retiring May 1, 2028](https://leftsize.com/rules/azure/vm-series-retirement-2028-05/): VMs on D, Ds, Dv2, Dsv2 and Ls sizes, which Microsoft retires on May 1, 2028
- [VMs on Av2/B/F/Fsv2/G/Lsv2 sizes retiring November 15, 2028](https://leftsize.com/rules/azure/vm-series-retirement-2028-11/): VMs on Av2, Amv2, B (v1), F, Fs, Fsv2, G, Gs and Lsv2 sizes, which Microsoft retires on November 15, 2028
- [VMs on Dv3/Dsv3/Ev3/Esv3 sizes retiring November 15, 2029](https://leftsize.com/rules/azure/vm-v3-series-retirement-2029/): VMs on Dv3, Dsv3, Ev3 and Esv3 sizes, which Microsoft retires on November 15, 2029
- [AKS clusters with Azure Linux 2.0 node pools — images removed from Oct 31, 2026](https://leftsize.com/rules/azure/aks-azure-linux-2-node-pools/): AKS clusters with node pools on Azure Linux 2.0 (CBL-Mariner 2.0) node images, which AKS removes starting October 31, 2026
- [AKS clusters with Ubuntu 20.04 node pools — images deleted Mar 17, 2027](https://leftsize.com/rules/azure/aks-ubuntu-2004-node-pools/): AKS clusters with node pools on Ubuntu 20.04 node images, which AKS stops supporting and deletes on March 17, 2027
- [AKS clusters with Ubuntu 22.04 node pools — unsupported Jun 30, 2027](https://leftsize.com/rules/azure/aks-ubuntu-2204-node-pools/): AKS clusters with node pools on Ubuntu 22.04, which AKS stops supporting on June 30, 2027 and removes on April 30, 2028
- [AKS clusters with unsupported Windows node pools (WS2019 / Annual Channel) — migrate to Windows Server 2022/2025](https://leftsize.com/rules/azure/aks-windows-unsupported-node-pools/): AKS clusters with Windows node pools on Windows Server 2019 or Windows Server Annual Channel, both unsupported; Annual Channel node images are removed on May 15, 2027 and the AKS team has announced Windows Server 2019 image removal for April 1, 2027
- [AKS clusters using kubenet networking — migrate to Azure CNI Overlay before Mar 31, 2028](https://leftsize.com/rules/azure/aks-kubenet-retirement/): AKS clusters using kubenet networking, which is retired on March 31, 2028; migrate to Azure CNI Overlay
- [AKS clusters using the Open Service Mesh add-on — retired Sep 30, 2027](https://leftsize.com/rules/azure/aks-open-service-mesh-retirement/): AKS clusters with the Open Service Mesh add-on enabled, which AKS stops supporting on September 30, 2027
- [Function apps on the .NET in-process model - support ends Nov 10, 2026](https://leftsize.com/rules/azure/functions-dotnet-inprocess-end-of-support/): Support for the Azure Functions .NET in-process model ends on November 10, 2026; migrate to the isolated worker model
- [Function apps on language versions out of support by Nov 10, 2026](https://leftsize.com/rules/azure/functions-linux-language-end-of-support/): Linux function apps on .NET 6-9 isolated, Python 3.10 or older, PowerShell 7.4 or older, or Node.js 20 or older; support has ended or ends by November 10, 2026
- [Accounts of retired Azure AI services (LUIS, QnA Maker, Anomaly Detector, Metrics Advisor, Personalizer) - already retired](https://leftsize.com/rules/azure/ai-services-retired/): Azure AI services accounts of a retired kind: QnAMaker (retired 2025-10-31), LUIS (2026-03-31), MetricsAdvisor, Personalizer and AnomalyDetector (retired by 2026-10-01)
- [Content Moderator accounts - service retires Mar 15, 2027, migrate to Azure AI Content Safety](https://leftsize.com/rules/azure/content-moderator-retirement/): Azure Content Moderator is deprecated and retires on March 15, 2027 (lifecycle page: March 31, 2027); migrate to Azure AI Content Safety
- [Azure Spring Apps instances - service retires Mar 31, 2028, migrate to Azure Container Apps](https://leftsize.com/rules/azure/spring-apps-retirement/): All Azure Spring Apps plans (Basic, Standard, Enterprise) retire on March 31, 2028; migrate to Azure Container Apps or AKS
- [Cloud Services (extended support) deployments - retires Mar 31, 2027, no extensions](https://leftsize.com/rules/azure/cloud-services-extended-support-retirement/): Cloud Services (extended support) is deprecated since March 31, 2025 and fully retired on March 31, 2027; no extensions are granted
- [Basic SKU public IPs still in use (retired Sep 30, 2025) — upgrade to Standard](https://leftsize.com/rules/azure/basic-public-ip-retired/): Basic SKU public IP addresses, retired on September 30, 2025, that are still in use without support or SLA
- [Application Gateways using legacy WAF configuration — upgrade to WAF policy before Mar 15, 2027](https://leftsize.com/rules/azure/appgateway-waf-config-retirement/): Application Gateway WAF v2 gateways still using the legacy WAF configuration, which retires on March 15, 2027
- [Azure Front Door (classic) profiles — migrate to Standard/Premium before Mar 31, 2027](https://leftsize.com/rules/azure/front-door-classic-retirement/): Azure Front Door (classic) profiles must be migrated to Azure Front Door Standard or Premium before March 31, 2027
- [Azure CDN Standard from Microsoft (classic) profiles — migrate to Front Door before Sep 30, 2027](https://leftsize.com/rules/azure/cdn-classic-retirement/): Azure CDN Standard from Microsoft (classic) profiles must be migrated to Azure Front Door Standard or Premium before September 30, 2027
- [NSGs with NSG flow logs — migrate to VNet flow logs before Sep 30, 2027](https://leftsize.com/rules/azure/nsg-flow-logs-retirement/): Network security groups with NSG flow logs attached; NSG flow logs retire on September 30, 2027 and the flow log resources are deleted
- [PostgreSQL flexible servers in or entering paid extended support (PG 11–13 billed since Sep 1, 2026; PG 14 from Feb 1, 2027)](https://leftsize.com/rules/azure/postgresql-flexible-extended-support/): Azure Database for PostgreSQL flexible servers on PostgreSQL 11, 12, 13 (paid extended support since September 1, 2026) or 14 (paid extended support from February 1, 2027)
- [MySQL flexible servers in or entering paid extended support (5.7 billed since Oct 1, 2026; 8.0 from Feb 1, 2027)](https://leftsize.com/rules/azure/mysql-flexible-extended-support/): Azure Database for MySQL flexible servers on MySQL 5.7 (paid extended support since October 1, 2026) or 8.0 (paid extended support from February 1, 2027)
- [Azure Cache for Redis Enterprise caches — migrate to Azure Managed Redis before Mar 31, 2027](https://leftsize.com/rules/azure/redis-enterprise-retirement/): Azure Cache for Redis Enterprise and Enterprise Flash instances must be migrated to Azure Managed Redis before March 31, 2027
- [Azure Cache for Redis instances — migrate to Azure Managed Redis before Sep 30, 2028](https://leftsize.com/rules/azure/redis-cache-retirement/): Azure Cache for Redis Basic, Standard and Premium instances must be migrated to Azure Managed Redis before September 30, 2028
- [HDInsight clusters on 4.0/5.0 — retired Mar 31, 2025, migrate to 5.1](https://leftsize.com/rules/azure/hdinsight-retired-version/): HDInsight 4.0 and 5.0 were retired on March 31, 2025 — Microsoft may remove, disable or delete these clusters at any time; rebuild on HDInsight 5.1
- [VM scale sets on VM sizes that retire between March 2027 and November 2029](https://leftsize.com/rules/azure/vmss-retiring-size/): Virtual Machine Scale Sets (not AKS-managed) whose model uses a VM size that Microsoft retires between March 2027 and November 2029
- [AKS clusters with node pools on VM sizes that retire between March 2027 and November 2029](https://leftsize.com/rules/azure/aks-node-pool-retiring-size/): AKS clusters with node pools on VM sizes that Microsoft retires between March 2027 and November 2029

### Azure: Security (Team and Business)

- [Storage accounts allowing anonymous blob access](https://leftsize.com/rules/azure/anonymous-blob-access/): Storage accounts that allow anonymous (public) blob access
- [Storage accounts accepting unencrypted HTTP](https://leftsize.com/rules/azure/storage-http-allowed/): Storage accounts that accept unencrypted HTTP requests
- [Storage accounts with a minimum TLS version below 1.2](https://leftsize.com/rules/azure/storage-outdated-tls/): Storage accounts with a minimum TLS version below 1.2
- [Storage accounts reachable from all networks](https://leftsize.com/rules/azure/storage-public-network-access/): Storage accounts reachable from all networks
- [Network security groups allowing internet traffic to sensitive ports](https://leftsize.com/rules/azure/open-network-ports/): Network security groups that allow internet traffic to sensitive ports
- [Managed disks not using a customer-managed key](https://leftsize.com/rules/azure/unencrypted-disks/): Attached managed disks not encrypted with a customer-managed key
- [Defender plans turned off](https://leftsize.com/rules/azure/defender-for-cloud-disabled/): Microsoft Defender for Cloud plans that are turned off
- [SQL servers without auditing](https://leftsize.com/rules/azure/sql-auditing-disabled/): Azure SQL servers without auditing
- [SQL servers open to the whole internet](https://leftsize.com/rules/azure/sql-server-open-to-internet/): Azure SQL servers with a firewall rule open to the whole internet
- [Storage accounts allowing Shared Key access](https://leftsize.com/rules/azure/storage-shared-key-access-enabled/): Storage accounts that allow Shared Key (account key) authorization
- [Key Vaults without purge protection](https://leftsize.com/rules/azure/keyvault-purge-protection-disabled/): Key Vaults without purge protection
- [Web apps accepting plain HTTP](https://leftsize.com/rules/azure/webapp-https-only-disabled/): App Service and Function apps that accept plain HTTP
- [Web apps allowing TLS 1.0 or 1.1](https://leftsize.com/rules/azure/webapp-outdated-tls/): App Service and Function apps that allow TLS 1.0 or 1.1
- [AKS clusters with local accounts enabled](https://leftsize.com/rules/azure/aks-local-accounts-enabled/): AKS clusters with local accounts enabled

### Azure: Governance (Team and Business)

- [Resources missing ownership tags: virtual machines](https://leftsize.com/rules/azure/missing-ownership-tags-vm/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: storage accounts](https://leftsize.com/rules/azure/missing-ownership-tags-storage/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: SQL servers](https://leftsize.com/rules/azure/missing-ownership-tags-sql/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: managed disks](https://leftsize.com/rules/azure/missing-ownership-tags-disk/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: AKS clusters](https://leftsize.com/rules/azure/missing-ownership-tags-aks/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: resource groups](https://leftsize.com/rules/azure/missing-ownership-tags-resourcegroup/): Governance & compliance - helps track ownership and spending attribution
- [Key Vault certificates expiring soon](https://leftsize.com/rules/azure/keyvault-cert-expiring/): Key Vault certificates approaching expiration that need renewal to avoid service disruption
- [Attached disks on Standard HDD (Standard_LRS)](https://leftsize.com/rules/azure/standard-lrs-attached-disk/): Attached managed disks larger than 32 GiB on Standard HDD (Standard_LRS); review whether Standard SSD or Premium SSD fits the workload better

### AWS: Cost optimization (Free)

- [ECS Auto Scaling groups with a minimum of 3+ instances — review for idle capacity](https://leftsize.com/rules/aws/idle-ecs-container-instances/): Auto Scaling groups tagged as ECS capacity (AmazonECSManaged) with MinSize of 3 or more, created more than 14 days ago. Flags configuration for review; does not measure ECS utilization.
- [ECS services on regular Fargate — review for Fargate Spot](https://leftsize.com/rules/aws/fargate-spot-eligible/): ECS services on regular Fargate (launch type, or a capacity provider strategy without FARGATE_SPOT), not tagged as production, with 2+ desired tasks, created more than 7 days ago. Spot suitability depends on the workload and is not checked.
- [Inactive EC2 instances](https://leftsize.com/rules/aws/inactive-ec2-instance/): Running EC2 instances, at least 7 days old, with average CPU below 5% and less than 1 GiB of total outbound network traffic over the last 7 days
- [EC2 instances averaging 10–40% CPU over 14 days — review for right-sizing](https://leftsize.com/rules/aws/underutilized-ec2-instance/): Running EC2 instances (≥14 days old, not T-family burstable, not tagged RightSized) whose 14-day average CPU is between 10% and 40%
- [Unattached EBS volumes](https://leftsize.com/rules/aws/unattached-ebs-volume/): EBS volumes in the available (unattached) state that were created more than 7 days ago
- [Unused Elastic IPs](https://leftsize.com/rules/aws/unused-elastic-ip/): Elastic IP addresses with no association (not attached to an instance or network interface). AWS bills every public IPv4 address by the hour, attached or not.
- [Idle RDS instances](https://leftsize.com/rules/aws/idle-rds-instance/): Available RDS and Aurora DB instances (not DocumentDB or Neptune) with average CPU below 10% and an average of fewer than 1 database connection over the last 7 days
- [Unused Classic Load Balancers](https://leftsize.com/rules/aws/unused-load-balancer/): Classic Load Balancers with no registered instances, created more than 3 days ago
- [Application Load Balancers with almost no requests](https://leftsize.com/rules/aws/unused-alb/): Application Load Balancers older than 3 days with fewer than 10 requests in total over the last 7 days (no RequestCount data counts as 0)
- [Orphaned EBS snapshots](https://leftsize.com/rules/aws/orphaned-ebs-snapshots/): EBS snapshots owned by this account, at least 30 days old, not used by an AMI, launch configuration or Auto Scaling launch template, not managed by AWS Backup or Data Lifecycle Manager, whose source volume was not found
- [EC2 instances on outdated generation](https://leftsize.com/rules/aws/ec2-outdated-generation/): Running EC2 instances, at least 7 days old, on previous-generation families (m1-m4, c1-c4, r1-r4, i1-i2, d2, h1, g3, p2, x1). Newer generations usually cost the same or less for more performance.
- [Non-prod EC2 instances without scheduled shutdown](https://leftsize.com/rules/aws/ec2-scheduled-shutdown-missing/): Non-production EC2 instances running 24/7 without scheduled stop/start that could save 30-70% by running only during business hours
- [S3 buckets without Bucket Key (savings vary by usage)](https://leftsize.com/rules/aws/s3-missing-bucket-key/): S3 buckets using SSE-KMS encryption without Bucket Key enabled, resulting in excessive KMS API costs
- [S3 buckets missing lifecycle policy](https://leftsize.com/rules/aws/s3-missing-lifecycle-policy/): S3 buckets older than 30 days with no enabled lifecycle rules; transitioning or expiring rarely accessed data can lower storage costs
- [EBS volumes on gp2 - migrate to gp3](https://leftsize.com/rules/aws/gp2-to-gp3-migration/): EBS volumes still using gp2 that can be migrated to gp3 for about 20% lower storage price (estimate)
- [RDS instances with unnecessary Multi-AZ](https://leftsize.com/rules/aws/rds-multiaz-nonprod/): Non-production RDS instances using Multi-AZ, which roughly doubles instance and storage cost
- [RDS instances not using Graviton](https://leftsize.com/rules/aws/rds-non-graviton/): RDS instances using x86-based instance classes that can move to Graviton classes for a lower hourly price (estimate)
- [RDS instances with excessive backup retention](https://leftsize.com/rules/aws/rds-excessive-backup-retention/): Non-production RDS instances with backup retention exceeding 14 days
- [RDS instances using io1/io2 - consider gp3](https://leftsize.com/rules/aws/rds-suboptimal-storage-type/): RDS instances using io1/io2 storage with under 16,000 provisioned IOPS, where gp3 may provide enough performance at lower cost
- [Lambda functions on x86 architecture](https://leftsize.com/rules/aws/lambda-x86-architecture/): Lambda functions using x86_64 architecture that could cut duration cost by about 20% by switching to arm64 (Graviton2)
- [Inactive NAT Gateways](https://leftsize.com/rules/aws/inactive-nat-gateway/): NAT Gateways with no active traffic, that still incur hourly charges
- [EC2 instances with EBS volumes that outlive termination](https://leftsize.com/rules/aws/ebs-delete-on-termination-disabled/): Running EC2 instances with attached EBS volumes that have DeleteOnTermination disabled, so the volumes remain (and keep incurring charges) after the instance is terminated
- [EBS volumes attached to stopped EC2](https://leftsize.com/rules/aws/ebs-attached-to-stopped-ec2/): EBS volumes attached to stopped EC2 instances continue incurring full storage costs even though the instance is not running
- [EC2 instances not using Graviton](https://leftsize.com/rules/aws/ec2-non-graviton/): EC2 instances on x86 instance types with a Graviton equivalent that typically has a lower hourly price
- [EBS volumes using io1 instead of io2](https://leftsize.com/rules/aws/io1-to-io2-migration/): EBS volumes using io1 that should migrate to io2 for better durability at the same price
- [EC2 instances eligible for Spot](https://leftsize.com/rules/aws/spot-instance-eligible/): Non-production EC2 instances on On-Demand pricing that could run on Spot (AWS advertises discounts of up to 90%)
- [S3 buckets accumulating incomplete multipart uploads](https://leftsize.com/rules/aws/s3-incomplete-multipart-uploads/): S3 buckets without lifecycle rules to abort incomplete multipart uploads
- [Versioned S3 buckets without version expiration](https://leftsize.com/rules/aws/s3-non-current-versions/): Versioned S3 buckets without lifecycle rules to expire old object versions
- [VPCs without S3 Gateway Endpoint (NAT data processing costs)](https://leftsize.com/rules/aws/missing-vpc-endpoint-s3/): VPCs with a NAT gateway but no S3 endpoint, so S3 traffic pays NAT data processing charges
- [Stopped RDS instances (AWS restarts them automatically after 7 days)](https://leftsize.com/rules/aws/rds-auto-restart-pending/): Stopped RDS instances; AWS starts a stopped DB instance automatically after 7 days, so stopping is not a long-term saving
- [Orphaned RDS snapshots (source DB deleted)](https://leftsize.com/rules/aws/orphaned-rds-snapshots/): Manual RDS snapshots where the source database has been deleted
- [ECR repositories without lifecycle policy](https://leftsize.com/rules/aws/ecr-no-lifecycle-policy/): ECR repositories without a lifecycle policy keep every pushed image until it is deleted manually
- [CloudWatch log groups without retention policy](https://leftsize.com/rules/aws/cloudwatch-logs-no-retention/): CloudWatch log groups without retention policies store logs indefinitely, accumulating storage costs
- [Unused Secrets Manager secrets](https://leftsize.com/rules/aws/secrets-manager-unused/): Secrets Manager secrets that haven't been accessed in 90+ days, incurring unnecessary costs
- [io1/io2 EBS volumes overprovisioned](https://leftsize.com/rules/aws/ebs-io1-io2-overprovisioned/): io1/io2 EBS volumes with IOPS < 16,000 that are candidates for gp3 (lower storage and IOPS prices)
- [Unused Lambda functions (zero invocations in 30 days)](https://leftsize.com/rules/aws/unused-lambda-function/): Lambda functions with zero invocations in 30 days, generating unnecessary cost
- [Idle DynamoDB tables (zero activity in 30 days)](https://leftsize.com/rules/aws/idle-dynamodb-table/): DynamoDB tables with zero read and write activity for 30+ days
- [Idle ElastiCache clusters (zero connections in 14 days)](https://leftsize.com/rules/aws/idle-elasticache-cluster/): ElastiCache clusters with no client connections beyond monitoring (peak CurrConnections <= 6) for 14+ days
- [EKS clusters without any compute](https://leftsize.com/rules/aws/inactive-eks-cluster/): Active EKS clusters (older than 7 days, not Auto Mode) with no managed node groups, Fargate profiles or running EC2 nodes. Control plane is ~$73/mo per cluster on standard support
- [Inactive RDS read replicas](https://leftsize.com/rules/aws/inactive-rds-read-replica/): RDS read replicas with no database connections for 14+ days, paying for full instance + storage
- [Inactive EFS filesystems](https://leftsize.com/rules/aws/inactive-efs-filesystem/): EFS filesystems with no client connections over 14 days, accumulating $0.30/GB-month storage costs
- [Inactive Network Load Balancers](https://leftsize.com/rules/aws/inactive-nlb/): Active Network Load Balancers with zero ActiveFlowCount over 14 days, incurring fixed hourly charges
- [Inactive VPC endpoints](https://leftsize.com/rules/aws/inactive-vpc-endpoint/): Interface VPC endpoints with no observed traffic, incurring hourly per-AZ charges
- [Lambda functions with potentially oversized memory](https://leftsize.com/rules/aws/lambda-oversized-memory/): Lambda functions with >1024MB memory and low invocations (<1000 in 14 days) — candidates for rightsizing review. Actual savings require load testing with Lambda Power Tuning.
- [Underutilized ElastiCache clusters](https://leftsize.com/rules/aws/elasticache-underutilized/): ElastiCache (Redis/Memcached) clusters with sustained low CPU utilization (<5% over 14 days), candidates for downsizing
- [Unused AMIs keeping EBS snapshots](https://leftsize.com/rules/aws/unused-ami/): AMIs at least 90 days old not used by any instance or Auto Scaling group, still keeping their EBS snapshots

### AWS: Deprecations & retirements (Team and Business)

- [Lambda functions on a deprecated or soon-deprecated runtime — updates blocked from Aug 31, 2027](https://leftsize.com/rules/aws/lambda-deprecated-runtime/): Lambda functions on runtimes that are deprecated or deprecating within ~6 months; Lambda blocks function create on July 29, 2027 and function update on August 31, 2027
- [ElastiCache Redis OSS nodes on v5 or older billed for Extended Support (+80% node price, +160% from Feb 1, 2028)](https://leftsize.com/rules/aws/elasticache-eol-redis/): ElastiCache node-based clusters on Redis OSS 5 or older, billed for ElastiCache Extended Support since February 1, 2026
- [OpenSearch domains in paid Extended Support: surcharge = 100% of instance cost from Nov 7, 2026](https://leftsize.com/rules/aws/opensearch-outdated-version/): OpenSearch Service domains on Elasticsearch 1.5, 2.3, 5.1-5.6, 6.0-6.7, 7.1-7.8 or OpenSearch 1.0-1.2, 2.3-2.9, which are in paid Extended Support
- [EKS clusters on Kubernetes 1.34 or older — extended support costs $0.60/hr vs $0.10/hr (1.34 from Dec 2, 2026)](https://leftsize.com/rules/aws/eks-outdated-version/): EKS clusters on Kubernetes 1.34 or older: 1.31-1.33 are billed extended support ($0.60/cluster-hour instead of $0.10) and 1.34 enters extended support on December 2, 2026
- [Amazon Pinpoint apps affected by Pinpoint end of support (October 30, 2026)](https://leftsize.com/rules/aws/pinpoint-deprecated/): Amazon Pinpoint applications (projects); Pinpoint engagement features reach end of support on October 30, 2026
- [Timestream LiveAnalytics databases on a service closed to new customers](https://leftsize.com/rules/aws/timestream-deprecated/): Amazon Timestream for LiveAnalytics databases; the service is closed to new customers (no end-of-support date announced)
- [PostgreSQL 11 DB instances: Extended Support ends Mar 31, 2027, then AWS upgrades automatically](https://leftsize.com/rules/aws/rds-postgres11-end-of-extended-support/): RDS for PostgreSQL and Aurora PostgreSQL DB instances on PostgreSQL 11, which leaves RDS Extended Support on March 31, 2027 and is then upgraded automatically
- [PostgreSQL 14 DB instances: standard support ends Feb 28, 2027, Extended Support charges from Mar 1, 2027](https://leftsize.com/rules/aws/rds-postgres14-end-of-standard-support/): RDS for PostgreSQL and Aurora PostgreSQL DB instances on PostgreSQL 14, which reaches end of standard support on February 28, 2027
- [RDS for MariaDB instances on 10.6 or older: standard support ends Dec 31, 2026 (no Extended Support)](https://leftsize.com/rules/aws/rds-mariadb-end-of-support/): RDS for MariaDB DB instances on MariaDB 10.6 (end of standard support December 31, 2026) or an already deprecated version (10.0-10.5)
- [RDS SQL Server 2016 instances: support ended Jul 14, 2026, automatic upgrade to SQL Server 2019 pending](https://leftsize.com/rules/aws/rds-sqlserver-2016-end-of-support/): RDS for SQL Server DB instances on SQL Server 2016 (13.00), which RDS stopped supporting on July 14, 2026
- [RDS Custom for Oracle instances: service ends Mar 31, 2027](https://leftsize.com/rules/aws/rds-custom-oracle-end-of-support/): RDS Custom for Oracle DB instances; AWS ends the RDS Custom for Oracle service on March 31, 2027
- [DocumentDB 3.6 instances billed for Extended Support (standard support ended Mar 30, 2026)](https://leftsize.com/rules/aws/docdb-36-extended-support/): Amazon DocumentDB instances on engine version 3.6, which left standard support on March 30, 2026 and is billed for Extended Support
- [Neptune instances on engine versions reaching end of life (Dec 4, 2026 / Mar 6, 2027)](https://leftsize.com/rules/aws/neptune-engine-end-of-life/): Amazon Neptune DB instances on engine 1.1.1.0 or 1.2.x (end of life December 4, 2026) or 1.3.0.0 - 1.4.6.1 (end of life March 6, 2027)
- [ElastiCache Redis OSS 6 nodes: standard support ends Jan 31, 2027, +80% Extended Support premium from Feb 1, 2027](https://leftsize.com/rules/aws/elasticache-redis6-end-of-standard-support/): ElastiCache node-based clusters on Redis OSS 6.x, which reaches end of standard support on January 31, 2027
- [EKS node groups on Amazon Linux 2 AMIs — unsupported since Nov 26, 2025](https://leftsize.com/rules/aws/eks-nodegroup-al2-ami/): EKS managed node groups using AL2_x86_64, AL2_x86_64_GPU or AL2_ARM_64; EKS AL2 AMIs lost support on November 26, 2025 and no AL2 AMIs exist for Kubernetes 1.33+
- [AWS Batch compute environments on Amazon Linux 2 AMIs — support ended Jun 30, 2026](https://leftsize.com/rules/aws/batch-compute-al2-ami/): AWS Batch managed EC2/Spot compute environments configured with ECS_AL2, ECS_AL2_NVIDIA, EKS_AL2 or EKS_AL2_NVIDIA image types
- [EC2 instances on Amazon Linux 2 — end of support was Jun 30, 2026](https://leftsize.com/rules/aws/ec2-amazon-linux-2-eol/): EC2 instances launched from an Amazon Linux 2 AMI (amzn2-ami-*); Amazon Linux 2 reached end of support on June 30, 2026
- [Elastic Beanstalk environments on a retired Linux platform branch — no security updates (AL2 retired Aug 6, 2026)](https://leftsize.com/rules/aws/elasticbeanstalk-retired-linux-platform/): Elastic Beanstalk environments on retired AL1, AL2 or retired AL2023 platform branches; they no longer receive security updates, platform updates or bug fixes
- [Elastic Beanstalk environments on Windows Server 2016 — AMIs inaccessible from Jan 15, 2027](https://leftsize.com/rules/aws/elasticbeanstalk-windows-2016-platform/): Elastic Beanstalk environments on Windows Server (Core) 2016 platform branches: retired October 8, 2026; default AMIs become inaccessible January 15, 2027 and new instance launches will fail
- [WorkSpaces still on PCoIP — end of support Oct 31, 2027](https://leftsize.com/rules/aws/workspaces-pcoip-end-of-support/): WorkSpaces Personal streaming over PCoIP; AWS ends PCoIP support on October 31, 2027, after which they cannot be created or connected to
- [Glue jobs on an End-of-Life Glue version — EOL passed (Apr 1 / Jun 1, 2026)](https://leftsize.com/rules/aws/glue-job-eol-version/): AWS Glue Spark jobs on Glue 0.9/1.0/2.0 and Python shell jobs on Python 2 or the legacy Python 3.6 selector, which have reached End of Life
- [EMR clusters on an unsupported release — End of Support passed Sep 1, 2026 — End of Life Sep 1, 2027](https://leftsize.com/rules/aws/emr-release-end-of-support/): Active Amazon EMR clusters on releases 2.x – 5.35 or 6.0 – 6.5, which reached End of Support on September 1, 2026 and End of Life on September 1, 2027
- [EMR clusters on emr-5.36 / 6.6 – 6.15 — support ends June 30, 2027](https://leftsize.com/rules/aws/emr-release-support-ending-2027/): Active Amazon EMR clusters on releases 5.36 or 6.6 – 6.15, whose free Extended Support ends June 30, 2027 (End of Life July 1, 2028)
- [MSK clusters on an end-of-support Kafka version — auto-upgrade can happen at any time](https://leftsize.com/rules/aws/msk-kafka-version-end-of-support/): Amazon MSK provisioned clusters on an Apache Kafka version past its MSK end-of-support date; MSK auto-upgrades them to the recommended version without notice
- [DMS replication instances on an End-of-Life engine version — EOL March 31, 2027 (3.5.4); already passed for older versions](https://leftsize.com/rules/aws/dms-replication-engine-eol/): AWS DMS replication instances on engine versions that are past End of Life or reach it on March 31, 2027; DMS upgrades them automatically in the maintenance window
- [MWAA environments on an end-of-support Airflow version — EOS passed, AWS may restrict legacy versions at any time](https://leftsize.com/rules/aws/mwaa-airflow-version-end-of-support/): Amazon MWAA environments on an Apache Airflow version past its MWAA end-of-support date; no technical support, SLA exceptions apply and AWS may restrict access to legacy versions
- [Amazon Cloud Directory directories — end of support July 24, 2027](https://leftsize.com/rules/aws/cloud-directory-end-of-support/): Enabled Amazon Cloud Directory directories; the service is closed to new customers and reaches end of support on July 24, 2027 — migrate to Amazon DynamoDB or Amazon Neptune
- [CloudSearch domains — CloudSearch is in maintenance, no end date announced](https://leftsize.com/rules/aws/cloudsearch-maintenance/): Amazon CloudSearch domains; CloudSearch is closed to new customers and gets no new features. AWS recommends Amazon OpenSearch Service
- [Kendra indexes — Kendra is in maintenance, no end date announced](https://leftsize.com/rules/aws/kendra-maintenance/): Amazon Kendra indexes; Kendra is in maintenance (no new features, closed to new customers). AWS recommends Amazon Bedrock Managed Knowledge Base
- [Simple AD directories — Simple AD is in maintenance, no end date announced](https://leftsize.com/rules/aws/simple-ad-maintenance/): AWS Directory Service Simple AD directories; Simple AD is in maintenance (closed to new customers). AWS recommends AWS Managed Microsoft AD or AD Connector
- [ARC readiness checks — readiness check is in maintenance, no end date announced](https://leftsize.com/rules/aws/arc-readiness-check-maintenance/): Amazon Application Recovery Controller (ARC) readiness checks; the readiness check feature is in maintenance. AWS recommends ARC Region switch with plan evaluation
- [RDS/Aurora DB instances billed for Extended Support now (MySQL 5.7/8.0, PostgreSQL 12/13)](https://leftsize.com/rules/aws/rds-outdated-version/): RDS for MySQL 5.7/8.0, RDS for PostgreSQL 12/13, Aurora MySQL 2 and Aurora PostgreSQL 12/13 DB instances past end of standard support and billed for RDS Extended Support

### AWS: Security (Team and Business)

- [IAM users with unused access keys (90+ days)](https://leftsize.com/rules/aws/iam-unused-access-key/): IAM users with access keys unused for 90+ days
- [IAM users without MFA enabled](https://leftsize.com/rules/aws/iam-user-without-mfa/): IAM users with console access but no MFA device
- [IAM users inactive for 90+ days](https://leftsize.com/rules/aws/iam-unused-user/): IAM users with no password or access key activity for 90+ days
- [VPCs without flow logs enabled](https://leftsize.com/rules/aws/vpc-flow-logs-disabled/): VPCs without flow logs for network monitoring
- [RDS instances publicly accessible](https://leftsize.com/rules/aws/rds-publicly-accessible/): RDS databases with PubliclyAccessible flag set to true
- [S3 buckets without access logging](https://leftsize.com/rules/aws/s3-bucket-logging-disabled/): S3 buckets without server access logging configured
- [EBS snapshots shared publicly](https://leftsize.com/rules/aws/ebs-snapshot-public/): EBS snapshots with public CreateVolumePermission
- [RDS snapshots shared publicly](https://leftsize.com/rules/aws/rds-snapshot-public/): RDS snapshots with public restore permissions
- [AMIs marked as public](https://leftsize.com/rules/aws/ami-public/): Amazon Machine Images (AMIs) with Public=true
- [S3 buckets without full Block Public Access](https://leftsize.com/rules/aws/public-s3-access/): S3 buckets where Block Public Access is not fully on, combining bucket and account level
- [Security groups allowing internet traffic to sensitive ports](https://leftsize.com/rules/aws/open-security-groups/): Security groups that allow internet traffic to sensitive ports
- [EBS volumes without encryption](https://leftsize.com/rules/aws/unencrypted-ebs-volumes/): EBS volumes without encryption
- [RDS instances without storage encryption](https://leftsize.com/rules/aws/unencrypted-rds-instances/): RDS DB instances without storage encryption

### AWS: Governance (Team and Business)

- [Resources missing ownership tags: EC2 instances](https://leftsize.com/rules/aws/missing-ownership-tags/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: RDS instances](https://leftsize.com/rules/aws/missing-ownership-tags-rds/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: S3 buckets](https://leftsize.com/rules/aws/missing-ownership-tags-s3/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: EBS volumes](https://leftsize.com/rules/aws/missing-ownership-tags-ebs/): Governance & compliance - helps track ownership and spending attribution
- [Resources missing ownership tags: Classic Load Balancers](https://leftsize.com/rules/aws/missing-ownership-tags-elb/): Governance & compliance - helps track ownership and spending attribution
- [ACM certificates expiring soon](https://leftsize.com/rules/aws/acm-certificate-expiring/): ACM certificates approaching expiration that need renewal to avoid service disruption