Rule catalog
LeftSize checks your AWS and Azure accounts against 188 rules and opens a GitHub issue for each finding. Cost optimization rules are included in the Free plan; deprecation, security and governance rules are part of the Team and Business plans.
Cloud
Category
Azure
Cost optimizationFree31 rules
- AKS clusters with low node CPU and memory usageRunning AKS clusters whose nodes averaged under 20% CPU and under 40% memory (working set) over 7 days
- AKS clusters without autoscalerRunning AKS clusters with 3+ nodes where no node pool has the cluster autoscaler enabled
- AKS node pools on expensive VM sizesRunning AKS clusters with a node pool on an older-generation VM size (Dsv3/Esv3 8+ vCPU, Esv3 4 vCPU, Fs v1) where a newer generation usually gives better price-performance
- App Service Plans on Basic/Standard - review Premium v3App Service Plans with apps on Basic (B1-B3) or Standard (S1-S3) SKUs that may get better price-performance on Premium v3
- Azure Bastion hosts with no sessions in 7 daysAzure Bastion hosts (Basic, Standard, Premium) with no sessions in the last 7 days
- Azure Container Registries without retention policyPremium Azure Container Registries without the untagged-manifest retention policy accumulate untagged manifests
- Azure Load Balancers with no backend membersAzure Load Balancers with no backend pool members (neither NIC-based nor IP-based), which can usually be deleted together with their public IPs
- Azure SQL Databases on the DTU purchasing modelAzure SQL Databases on DTU Standard S3+ or Premium (still supported) that may cost less on vCore
- Cosmos DB accounts with overprovisioned throughputProvisioned-throughput Cosmos DB accounts with average normalized RU consumption of 30% or less over 14 days
- Disk snapshots older than 30 daysOld disk snapshots no longer needed, accumulating storage costs
- Disks attached to deallocated VMsManaged disks attached to deallocated VMs incur storage costs with zero compute value
- Empty App Service PlansApp Service Plans with no deployed applications consuming unnecessary resources
- Empty SQL Elastic PoolsSQL Elastic Pools with no allocated database storage for the last 7 days (no databases), still incurring eDTU/vCore charges
- Idle Application GatewaysRunning Azure Application Gateways whose backend pools have no targets
- Idle VMsVirtual machines with consistently low CPU utilization that may be candidates for stopping or downsizing
- Linux VMs that could move to Arm64 sizesRunning Linux VMs on x64 D/E-series v3-v5 sizes that could move to Arm64 sizes (Dpsv5/Epsv5/Dpsv6) for better price-performance
- Non-prod VMs without auto-shutdownRunning non-production VMs (from tags or resource and resource group names) without an enabled auto-shutdown schedule
- Non-production AKS clusters running outside working hoursRunning non-production AKS clusters (from tags or names) that could be stopped or scaled down outside working hours
- Overprovisioned SQL databasesDTU-model Azure SQL Databases with average DTU consumption of 20% or less over 14 days
- SQL databases with unnecessary Business Critical tierNon-production Azure SQL databases (from tags or names) using the Business Critical tier; General Purpose costs roughly half or less for the same vCores (estimate)
- SQL databases without Azure Hybrid BenefitSingle Azure SQL databases on provisioned vCore General Purpose or Business Critical (not serverless, not in an elastic pool) without Azure Hybrid Benefit
- Stopped VMs still incurring storage costsVirtual machines that have been stopped or deallocated for about 30+ days and still incur costs for their managed disks, public IPs and other attached resources (and for compute too if only stopped, not deallocated)
- Storage accounts in regions with an 8–17% price increase from Feb 1, 2027Storage accounts (GPv2, Blob, Premium block blob, Premium files) in regions with an Azure Storage price increase on 1 February 2027
- Storage accounts on Hot tier with almost no activityGPv2/Blob storage accounts with Hot as default access tier, older than 90 days, with at most 100 transactions in the last 30 days
- Storage accounts paying the SFTP hourly chargeStorage accounts with SFTP enabled (flat hourly charge whether or not SFTP is used)
- Unattached disksManaged disks that are not attached to any virtual machine but still incurring storage costs
- Underutilized App Service PlansApp Service Plans with low CPU and memory utilization that may benefit from downsizing or consolidation
- Underutilized Redis CachesAzure Cache for Redis instances with average memory usage of 20% or less over 14 days
- Unused public IPsPublic IP addresses that are not attached to any resource and generating unnecessary costs
- VMs in regions with an 8–17% price increase from Feb 1, 2027VMs in West Europe, North Europe, France Central/South, Norway East/West or Southeast Asia on a VM series that is not excluded from the 1 February 2027 regional price increase
- Windows VMs without Azure Hybrid BenefitRunning Windows VMs without Azure Hybrid Benefit enabled (savings require eligible Windows Server licenses with Software Assurance or subscriptions)
Deprecations & retirementsTeam38 rules
- Accounts of retired Azure AI services (LUIS, QnA Maker, Anomaly Detector, Metrics Advisor, Personalizer) - already retiredAzure AI services accounts of a retired kind: QnAMaker (retired 2025-10-31), LUIS (2026-03-31), MetricsAdvisor, Personalizer and AnomalyDetector (retired by 2026-10-01)
- AKS clusters on Kubernetes versions out of support or ending by Nov 30, 2026AKS clusters whose control plane or node pools run a Kubernetes minor version that is out of AKS support or ends support by November 30, 2026
- AKS clusters using kubenet networking — migrate to Azure CNI Overlay before Mar 31, 2028AKS clusters using kubenet networking, which is retired on March 31, 2028; migrate to Azure CNI Overlay
- AKS clusters using the Open Service Mesh add-on — retired Sep 30, 2027AKS clusters with the Open Service Mesh add-on enabled, which AKS stops supporting on September 30, 2027
- AKS clusters with Azure Linux 2.0 node pools — images removed from Oct 31, 2026AKS clusters with node pools on Azure Linux 2.0 (CBL-Mariner 2.0) node images, which AKS removes starting October 31, 2026
- AKS clusters with node pools on VM sizes that retire between March 2027 and November 2029AKS clusters with node pools on VM sizes that Microsoft retires between March 2027 and November 2029
- AKS clusters with Ubuntu 20.04 node pools — images deleted Mar 17, 2027AKS clusters with node pools on Ubuntu 20.04 node images, which AKS stops supporting and deletes on March 17, 2027
- AKS clusters with Ubuntu 22.04 node pools — unsupported Jun 30, 2027AKS clusters with node pools on Ubuntu 22.04, which AKS stops supporting on June 30, 2027 and removes on April 30, 2028
- AKS clusters with unsupported Windows node pools (WS2019 / Annual Channel) — migrate to Windows Server 2022/2025AKS clusters with Windows node pools on Windows Server 2019 or Windows Server Annual Channel, both unsupported; Annual Channel node images are removed on May 15, 2027 and the AKS team has announced Windows Server 2019 image removal for April 1, 2027
- Application Gateways still on the retired V1 SKU (retired Apr 28, 2026) — migrate to V2 nowAzure Application Gateways still on the V1 SKU, which was retired on April 28, 2026 and is no longer supported
- Application Gateways using legacy WAF configuration — upgrade to WAF policy before Mar 15, 2027Application Gateway WAF v2 gateways still using the legacy WAF configuration, which retires on March 15, 2027
- Azure Cache for Redis Enterprise caches — migrate to Azure Managed Redis before Mar 31, 2027Azure Cache for Redis Enterprise and Enterprise Flash instances must be migrated to Azure Managed Redis before March 31, 2027
- Azure Cache for Redis instances — migrate to Azure Managed Redis before Sep 30, 2028Azure Cache for Redis Basic, Standard and Premium instances must be migrated to Azure Managed Redis before September 30, 2028
- Azure CDN Standard from Microsoft (classic) profiles — migrate to Front Door before Sep 30, 2027Azure CDN Standard from Microsoft (classic) profiles must be migrated to Azure Front Door Standard or Premium before September 30, 2027
- Azure Front Door (classic) profiles — migrate to Standard/Premium before Mar 31, 2027Azure Front Door (classic) profiles must be migrated to Azure Front Door Standard or Premium before March 31, 2027
- Azure Spring Apps instances - service retires Mar 31, 2028, migrate to Azure Container AppsAll Azure Spring Apps plans (Basic, Standard, Enterprise) retire on March 31, 2028; migrate to Azure Container Apps or AKS
- Basic Load Balancers — retired Sep 30, 2025, unsupported with no SLAAzure Basic Load Balancer was retired on September 30, 2025 — remaining Basic LBs still run but are unsupported with no SLA; upgrade to Standard
- Basic SKU public IPs still in use (retired Sep 30, 2025) — upgrade to StandardBasic SKU public IP addresses, retired on September 30, 2025, that are still in use without support or SLA
- Cloud Services (extended support) deployments - retires Mar 31, 2027, no extensionsCloud Services (extended support) is deprecated since March 31, 2025 and fully retired on March 31, 2027; no extensions are granted
- Content Moderator accounts - service retires Mar 15, 2027, migrate to Azure AI Content SafetyAzure Content Moderator is deprecated and retires on March 15, 2027 (lifecycle page: March 31, 2027); migrate to Azure AI Content Safety
- Function apps on language versions out of support by Nov 10, 2026Linux function apps on .NET 6-9 isolated, Python 3.10 or older, PowerShell 7.4 or older, or Node.js 20 or older; support has ended or ends by November 10, 2026
- Function apps on the .NET in-process model - support ends Nov 10, 2026Support for the Azure Functions .NET in-process model ends on November 10, 2026; migrate to the isolated worker model
- GPv1 / legacy Blob Storage accounts retired Oct 13, 2026 — upgrade to GPv2General-purpose v1 and legacy Blob Storage accounts were retired on October 13, 2026; remaining accounts are being migrated to GPv2 by Microsoft, which may increase transaction costs
- HDInsight clusters on 4.0/5.0 — retired Mar 31, 2025, migrate to 5.1HDInsight 4.0 and 5.0 were retired on March 31, 2025 — Microsoft may remove, disable or delete these clusters at any time; rebuild on HDInsight 5.1
- Linux Consumption Functions plans - migrate to Flex Consumption before Sep 30, 2028Azure Functions Linux Consumption (Y1) hosting retires on September 30, 2028; v3-runtime apps on it already stopped on September 30, 2026; migrate to Flex Consumption
- MariaDB servers still present — service retired Sep 19, 2025, export data nowAzure Database for MariaDB was retired on September 19, 2025 — servers still listed must have their data exported and be migrated to MySQL Flexible Server
- MySQL flexible servers in or entering paid extended support (5.7 billed since Oct 1, 2026; 8.0 from Feb 1, 2027)Azure Database for MySQL flexible servers on MySQL 5.7 (paid extended support since October 1, 2026) or 8.0 (paid extended support from February 1, 2027)
- NSGs with NSG flow logs — migrate to VNet flow logs before Sep 30, 2027Network security groups with NSG flow logs attached; NSG flow logs retire on September 30, 2027 and the flow log resources are deleted
- OS disks using Standard HDD — migrate before Sep 8, 2028Azure Managed Disks using Standard HDD as OS disks require migration to Standard SSD or Premium SSD before September 8, 2028
- PostgreSQL flexible servers in or entering paid extended support (PG 11–13 billed since Sep 1, 2026; PG 14 from Feb 1, 2027)Azure Database for PostgreSQL flexible servers on PostgreSQL 11, 12, 13 (paid extended support since September 1, 2026) or 14 (paid extended support from February 1, 2027)
- VM scale sets on VM sizes that retire between March 2027 and November 2029Virtual Machine Scale Sets (not AKS-managed) whose model uses a VM size that Microsoft retires between March 2027 and November 2029
- VMs on Av2/B/F/Fsv2/G/Lsv2 sizes retiring November 15, 2028VMs on Av2, Amv2, B (v1), F, Fs, Fsv2, G, Gs and Lsv2 sizes, which Microsoft retires on November 15, 2028
- VMs on D/Ds/Dv2/Dsv2/Ls sizes retiring May 1, 2028VMs on D, Ds, Dv2, Dsv2 and Ls sizes, which Microsoft retires on May 1, 2028
- VMs on Dv3/Dsv3/Ev3/Esv3 sizes retiring November 15, 2029VMs on Dv3, Dsv3, Ev3 and Esv3 sizes, which Microsoft retires on November 15, 2029
- VMs on M192i*_v2 sizes retiring March 31, 2027VMs on isolated Msv2 / Mdsv2 Medium Memory (M192i*_v2) sizes, which Microsoft retires on March 31, 2027
- VMs on NP/HC/HBv2 sizes retiring May 31, 2027VMs on NP (FPGA), HC and HBv2 (HPC) sizes, which Microsoft retires on May 31, 2027
- VMs on retired NVv3/NVv4 sizes (retired Sep 30, 2026) — resize requiredVMs on NVv3 or NVv4 sizes, which Microsoft retired on September 30, 2026; they are deallocated and must be resized to a supported GPU size
- VMs still on unmanaged disks (retired Mar 31, 2026) — convert to managed disksAzure VMs still using unmanaged disks (VHDs in storage accounts) after the March 31, 2026 retirement; they cannot start until converted to managed disks
SecurityTeam14 rules
- AKS clusters with local accounts enabledAKS clusters with local accounts enabled
- Defender plans turned offMicrosoft Defender for Cloud plans that are turned off
- Key Vaults without purge protectionKey Vaults without purge protection
- Managed disks not using a customer-managed keyAttached managed disks not encrypted with a customer-managed key
- Network security groups allowing internet traffic to sensitive portsNetwork security groups that allow internet traffic to sensitive ports
- SQL servers open to the whole internetAzure SQL servers with a firewall rule open to the whole internet
- SQL servers without auditingAzure SQL servers without auditing
- Storage accounts accepting unencrypted HTTPStorage accounts that accept unencrypted HTTP requests
- Storage accounts allowing anonymous blob accessStorage accounts that allow anonymous (public) blob access
- Storage accounts allowing Shared Key accessStorage accounts that allow Shared Key (account key) authorization
- Storage accounts reachable from all networksStorage accounts reachable from all networks
- Storage accounts with a minimum TLS version below 1.2Storage accounts with a minimum TLS version below 1.2
- Web apps accepting plain HTTPApp Service and Function apps that accept plain HTTP
- Web apps allowing TLS 1.0 or 1.1App Service and Function apps that allow TLS 1.0 or 1.1
GovernanceTeam8 rules
- Attached disks on Standard HDD (Standard_LRS)Attached managed disks larger than 32 GiB on Standard HDD (Standard_LRS); review whether Standard SSD or Premium SSD fits the workload better
- Key Vault certificates expiring soonKey Vault certificates approaching expiration that need renewal to avoid service disruption
- Resources missing ownership tags: AKS clustersGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: managed disksGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: resource groupsGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: SQL serversGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: storage accountsGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: virtual machinesGovernance & compliance - helps track ownership and spending attribution
AWS
Cost optimizationFree46 rules
- Application Load Balancers with almost no requestsApplication Load Balancers older than 3 days with fewer than 10 requests in total over the last 7 days (no RequestCount data counts as 0)
- CloudWatch log groups without retention policyCloudWatch log groups without retention policies store logs indefinitely, accumulating storage costs
- EBS volumes attached to stopped EC2EBS volumes attached to stopped EC2 instances continue incurring full storage costs even though the instance is not running
- EBS volumes on gp2 - migrate to gp3EBS volumes still using gp2 that can be migrated to gp3 for about 20% lower storage price (estimate)
- EBS volumes using io1 instead of io2EBS volumes using io1 that should migrate to io2 for better durability at the same price
- EC2 instances averaging 10–40% CPU over 14 days — review for right-sizingRunning EC2 instances (≥14 days old, not T-family burstable, not tagged RightSized) whose 14-day average CPU is between 10% and 40%
- EC2 instances eligible for SpotNon-production EC2 instances on On-Demand pricing that could run on Spot (AWS advertises discounts of up to 90%)
- EC2 instances not using GravitonEC2 instances on x86 instance types with a Graviton equivalent that typically has a lower hourly price
- EC2 instances on outdated generationRunning EC2 instances, at least 7 days old, on previous-generation families (m1-m4, c1-c4, r1-r4, i1-i2, d2, h1, g3, p2, x1). Newer generations usually cost the same or less for more performance.
- EC2 instances with EBS volumes that outlive terminationRunning EC2 instances with attached EBS volumes that have DeleteOnTermination disabled, so the volumes remain (and keep incurring charges) after the instance is terminated
- ECR repositories without lifecycle policyECR repositories without a lifecycle policy keep every pushed image until it is deleted manually
- ECS Auto Scaling groups with a minimum of 3+ instances — review for idle capacityAuto Scaling groups tagged as ECS capacity (AmazonECSManaged) with MinSize of 3 or more, created more than 14 days ago. Flags configuration for review; does not measure ECS utilization.
- ECS services on regular Fargate — review for Fargate SpotECS services on regular Fargate (launch type, or a capacity provider strategy without FARGATE_SPOT), not tagged as production, with 2+ desired tasks, created more than 7 days ago. Spot suitability depends on the workload and is not checked.
- EKS clusters without any computeActive EKS clusters (older than 7 days, not Auto Mode) with no managed node groups, Fargate profiles or running EC2 nodes. Control plane is ~$73/mo per cluster on standard support
- Idle DynamoDB tables (zero activity in 30 days)DynamoDB tables with zero read and write activity for 30+ days
- Idle ElastiCache clusters (zero connections in 14 days)ElastiCache clusters with no client connections beyond monitoring (peak CurrConnections <= 6) for 14+ days
- Idle RDS instancesAvailable RDS and Aurora DB instances (not DocumentDB or Neptune) with average CPU below 10% and an average of fewer than 1 database connection over the last 7 days
- Inactive EC2 instancesRunning EC2 instances, at least 7 days old, with average CPU below 5% and less than 1 GiB of total outbound network traffic over the last 7 days
- Inactive EFS filesystemsEFS filesystems with no client connections over 14 days, accumulating $0.30/GB-month storage costs
- Inactive NAT GatewaysNAT Gateways with no active traffic, that still incur hourly charges
- Inactive Network Load BalancersActive Network Load Balancers with zero ActiveFlowCount over 14 days, incurring fixed hourly charges
- Inactive RDS read replicasRDS read replicas with no database connections for 14+ days, paying for full instance + storage
- Inactive VPC endpointsInterface VPC endpoints with no observed traffic, incurring hourly per-AZ charges
- io1/io2 EBS volumes overprovisionedio1/io2 EBS volumes with IOPS < 16,000 that are candidates for gp3 (lower storage and IOPS prices)
- Lambda functions on x86 architectureLambda functions using x86_64 architecture that could cut duration cost by about 20% by switching to arm64 (Graviton2)
- Lambda functions with potentially oversized memoryLambda functions with >1024MB memory and low invocations (<1000 in 14 days) — candidates for rightsizing review. Actual savings require load testing with Lambda Power Tuning.
- Non-prod EC2 instances without scheduled shutdownNon-production EC2 instances running 24/7 without scheduled stop/start that could save 30-70% by running only during business hours
- Orphaned EBS snapshotsEBS snapshots owned by this account, at least 30 days old, not used by an AMI, launch configuration or Auto Scaling launch template, not managed by AWS Backup or Data Lifecycle Manager, whose source volume was not found
- Orphaned RDS snapshots (source DB deleted)Manual RDS snapshots where the source database has been deleted
- RDS instances not using GravitonRDS instances using x86-based instance classes that can move to Graviton classes for a lower hourly price (estimate)
- RDS instances using io1/io2 - consider gp3RDS instances using io1/io2 storage with under 16,000 provisioned IOPS, where gp3 may provide enough performance at lower cost
- RDS instances with excessive backup retentionNon-production RDS instances with backup retention exceeding 14 days
- RDS instances with unnecessary Multi-AZNon-production RDS instances using Multi-AZ, which roughly doubles instance and storage cost
- S3 buckets accumulating incomplete multipart uploadsS3 buckets without lifecycle rules to abort incomplete multipart uploads
- S3 buckets missing lifecycle policyS3 buckets older than 30 days with no enabled lifecycle rules; transitioning or expiring rarely accessed data can lower storage costs
- S3 buckets without Bucket Key (savings vary by usage)S3 buckets using SSE-KMS encryption without Bucket Key enabled, resulting in excessive KMS API costs
- Stopped RDS instances (AWS restarts them automatically after 7 days)Stopped RDS instances; AWS starts a stopped DB instance automatically after 7 days, so stopping is not a long-term saving
- Unattached EBS volumesEBS volumes in the available (unattached) state that were created more than 7 days ago
- Underutilized ElastiCache clustersElastiCache (Redis/Memcached) clusters with sustained low CPU utilization (<5% over 14 days), candidates for downsizing
- Unused AMIs keeping EBS snapshotsAMIs at least 90 days old not used by any instance or Auto Scaling group, still keeping their EBS snapshots
- Unused Classic Load BalancersClassic Load Balancers with no registered instances, created more than 3 days ago
- Unused Elastic IPsElastic IP addresses with no association (not attached to an instance or network interface). AWS bills every public IPv4 address by the hour, attached or not.
- Unused Lambda functions (zero invocations in 30 days)Lambda functions with zero invocations in 30 days, generating unnecessary cost
- Unused Secrets Manager secretsSecrets Manager secrets that haven't been accessed in 90+ days, incurring unnecessary costs
- Versioned S3 buckets without version expirationVersioned S3 buckets without lifecycle rules to expire old object versions
- VPCs without S3 Gateway Endpoint (NAT data processing costs)VPCs with a NAT gateway but no S3 endpoint, so S3 traffic pays NAT data processing charges
Deprecations & retirementsTeam32 rules
- Amazon Cloud Directory directories — end of support July 24, 2027Enabled Amazon Cloud Directory directories; the service is closed to new customers and reaches end of support on July 24, 2027 — migrate to Amazon DynamoDB or Amazon Neptune
- Amazon Pinpoint apps affected by Pinpoint end of support (October 30, 2026)Amazon Pinpoint applications (projects); Pinpoint engagement features reach end of support on October 30, 2026
- ARC readiness checks — readiness check is in maintenance, no end date announcedAmazon Application Recovery Controller (ARC) readiness checks; the readiness check feature is in maintenance. AWS recommends ARC Region switch with plan evaluation
- AWS Batch compute environments on Amazon Linux 2 AMIs — support ended Jun 30, 2026AWS Batch managed EC2/Spot compute environments configured with ECS_AL2, ECS_AL2_NVIDIA, EKS_AL2 or EKS_AL2_NVIDIA image types
- CloudSearch domains — CloudSearch is in maintenance, no end date announcedAmazon CloudSearch domains; CloudSearch is closed to new customers and gets no new features. AWS recommends Amazon OpenSearch Service
- DMS replication instances on an End-of-Life engine version — EOL March 31, 2027 (3.5.4); already passed for older versionsAWS DMS replication instances on engine versions that are past End of Life or reach it on March 31, 2027; DMS upgrades them automatically in the maintenance window
- DocumentDB 3.6 instances billed for Extended Support (standard support ended Mar 30, 2026)Amazon DocumentDB instances on engine version 3.6, which left standard support on March 30, 2026 and is billed for Extended Support
- EC2 instances on Amazon Linux 2 — end of support was Jun 30, 2026EC2 instances launched from an Amazon Linux 2 AMI (amzn2-ami-*); Amazon Linux 2 reached end of support on June 30, 2026
- EKS clusters on Kubernetes 1.34 or older — extended support costs $0.60/hr vs $0.10/hr (1.34 from Dec 2, 2026)EKS clusters on Kubernetes 1.34 or older: 1.31-1.33 are billed extended support ($0.60/cluster-hour instead of $0.10) and 1.34 enters extended support on December 2, 2026
- EKS node groups on Amazon Linux 2 AMIs — unsupported since Nov 26, 2025EKS managed node groups using AL2_x86_64, AL2_x86_64_GPU or AL2_ARM_64; EKS AL2 AMIs lost support on November 26, 2025 and no AL2 AMIs exist for Kubernetes 1.33+
- Elastic Beanstalk environments on a retired Linux platform branch — no security updates (AL2 retired Aug 6, 2026)Elastic Beanstalk environments on retired AL1, AL2 or retired AL2023 platform branches; they no longer receive security updates, platform updates or bug fixes
- Elastic Beanstalk environments on Windows Server 2016 — AMIs inaccessible from Jan 15, 2027Elastic Beanstalk environments on Windows Server (Core) 2016 platform branches: retired October 8, 2026; default AMIs become inaccessible January 15, 2027 and new instance launches will fail
- ElastiCache Redis OSS 6 nodes: standard support ends Jan 31, 2027, +80% Extended Support premium from Feb 1, 2027ElastiCache node-based clusters on Redis OSS 6.x, which reaches end of standard support on January 31, 2027
- ElastiCache Redis OSS nodes on v5 or older billed for Extended Support (+80% node price, +160% from Feb 1, 2028)ElastiCache node-based clusters on Redis OSS 5 or older, billed for ElastiCache Extended Support since February 1, 2026
- EMR clusters on an unsupported release — End of Support passed Sep 1, 2026 — End of Life Sep 1, 2027Active Amazon EMR clusters on releases 2.x – 5.35 or 6.0 – 6.5, which reached End of Support on September 1, 2026 and End of Life on September 1, 2027
- EMR clusters on emr-5.36 / 6.6 – 6.15 — support ends June 30, 2027Active Amazon EMR clusters on releases 5.36 or 6.6 – 6.15, whose free Extended Support ends June 30, 2027 (End of Life July 1, 2028)
- Glue jobs on an End-of-Life Glue version — EOL passed (Apr 1 / Jun 1, 2026)AWS Glue Spark jobs on Glue 0.9/1.0/2.0 and Python shell jobs on Python 2 or the legacy Python 3.6 selector, which have reached End of Life
- Kendra indexes — Kendra is in maintenance, no end date announcedAmazon Kendra indexes; Kendra is in maintenance (no new features, closed to new customers). AWS recommends Amazon Bedrock Managed Knowledge Base
- Lambda functions on a deprecated or soon-deprecated runtime — updates blocked from Aug 31, 2027Lambda functions on runtimes that are deprecated or deprecating within ~6 months; Lambda blocks function create on July 29, 2027 and function update on August 31, 2027
- MSK clusters on an end-of-support Kafka version — auto-upgrade can happen at any timeAmazon MSK provisioned clusters on an Apache Kafka version past its MSK end-of-support date; MSK auto-upgrades them to the recommended version without notice
- MWAA environments on an end-of-support Airflow version — EOS passed, AWS may restrict legacy versions at any timeAmazon MWAA environments on an Apache Airflow version past its MWAA end-of-support date; no technical support, SLA exceptions apply and AWS may restrict access to legacy versions
- Neptune instances on engine versions reaching end of life (Dec 4, 2026 / Mar 6, 2027)Amazon Neptune DB instances on engine 1.1.1.0 or 1.2.x (end of life December 4, 2026) or 1.3.0.0 - 1.4.6.1 (end of life March 6, 2027)
- OpenSearch domains in paid Extended Support: surcharge = 100% of instance cost from Nov 7, 2026OpenSearch Service domains on Elasticsearch 1.5, 2.3, 5.1-5.6, 6.0-6.7, 7.1-7.8 or OpenSearch 1.0-1.2, 2.3-2.9, which are in paid Extended Support
- PostgreSQL 11 DB instances: Extended Support ends Mar 31, 2027, then AWS upgrades automaticallyRDS for PostgreSQL and Aurora PostgreSQL DB instances on PostgreSQL 11, which leaves RDS Extended Support on March 31, 2027 and is then upgraded automatically
- PostgreSQL 14 DB instances: standard support ends Feb 28, 2027, Extended Support charges from Mar 1, 2027RDS for PostgreSQL and Aurora PostgreSQL DB instances on PostgreSQL 14, which reaches end of standard support on February 28, 2027
- RDS Custom for Oracle instances: service ends Mar 31, 2027RDS Custom for Oracle DB instances; AWS ends the RDS Custom for Oracle service on March 31, 2027
- RDS for MariaDB instances on 10.6 or older: standard support ends Dec 31, 2026 (no Extended Support)RDS for MariaDB DB instances on MariaDB 10.6 (end of standard support December 31, 2026) or an already deprecated version (10.0-10.5)
- RDS SQL Server 2016 instances: support ended Jul 14, 2026, automatic upgrade to SQL Server 2019 pendingRDS for SQL Server DB instances on SQL Server 2016 (13.00), which RDS stopped supporting on July 14, 2026
- RDS/Aurora DB instances billed for Extended Support now (MySQL 5.7/8.0, PostgreSQL 12/13)RDS for MySQL 5.7/8.0, RDS for PostgreSQL 12/13, Aurora MySQL 2 and Aurora PostgreSQL 12/13 DB instances past end of standard support and billed for RDS Extended Support
- Simple AD directories — Simple AD is in maintenance, no end date announcedAWS Directory Service Simple AD directories; Simple AD is in maintenance (closed to new customers). AWS recommends AWS Managed Microsoft AD or AD Connector
- Timestream LiveAnalytics databases on a service closed to new customersAmazon Timestream for LiveAnalytics databases; the service is closed to new customers (no end-of-support date announced)
- WorkSpaces still on PCoIP — end of support Oct 31, 2027WorkSpaces Personal streaming over PCoIP; AWS ends PCoIP support on October 31, 2027, after which they cannot be created or connected to
SecurityTeam13 rules
- AMIs marked as publicAmazon Machine Images (AMIs) with Public=true
- EBS snapshots shared publiclyEBS snapshots with public CreateVolumePermission
- EBS volumes without encryptionEBS volumes without encryption
- IAM users inactive for 90+ daysIAM users with no password or access key activity for 90+ days
- IAM users with unused access keys (90+ days)IAM users with access keys unused for 90+ days
- IAM users without MFA enabledIAM users with console access but no MFA device
- RDS instances publicly accessibleRDS databases with PubliclyAccessible flag set to true
- RDS instances without storage encryptionRDS DB instances without storage encryption
- RDS snapshots shared publiclyRDS snapshots with public restore permissions
- S3 buckets without access loggingS3 buckets without server access logging configured
- S3 buckets without full Block Public AccessS3 buckets where Block Public Access is not fully on, combining bucket and account level
- Security groups allowing internet traffic to sensitive portsSecurity groups that allow internet traffic to sensitive ports
- VPCs without flow logs enabledVPCs without flow logs for network monitoring
GovernanceTeam6 rules
- ACM certificates expiring soonACM certificates approaching expiration that need renewal to avoid service disruption
- Resources missing ownership tags: Classic Load BalancersGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: EBS volumesGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: EC2 instancesGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: RDS instancesGovernance & compliance - helps track ownership and spending attribution
- Resources missing ownership tags: S3 bucketsGovernance & compliance - helps track ownership and spending attribution