Cloud Cost Optimization Tools

Cloud Custodian is an open-source rules engine that uses declarative YAML policies to query, filter, and take automated actions on cloud resources for governance and compliance. It functions as a stateless policy execution engine, where each policy evaluation runs as an independent, idempotent operation without maintaining internal state between runs. Policies are defined using a YAML-based domain-specific language that structures rules as a query-filter-action pipeline. The engine supports dry-run validation, allowing users to simulate policy actions against live resources without applying c

aws-nuke is an AWS account cleanup tool that scans every resource in an AWS account and removes them, leaving the account clean for reuse or decommissioning. It enumerates all resource types by iterating through service APIs and paginating results, then deletes resources in parallel using goroutines while throttling against AWS API rate limits. The tool applies a config-file-driven filter pipeline that lets users exclude or include specific resource types, protect individual resources by matching their identifiers, and define reusable filter presets that can be applied across multiple account

Infracost is an infrastructure-as-code financial governance platform that calculates the cost impact of cloud resource changes. By performing static analysis on configuration files, the tool identifies infrastructure resources and their properties to estimate spending changes before deployment occurs. The platform distinguishes itself by integrating directly into development workflows, providing automated cost reporting and policy validation within pull request comments. It utilizes a modular architecture to map infrastructure definitions to real-time pricing data from cloud providers, allowi

KRR is an open-source tool for analyzing Kubernetes resource requests and recommendations. It evaluates how pods are currently configured and provides suggestions for optimizing CPU and memory allocations based on actual usage patterns. The project focuses on helping teams right-size their Kubernetes workloads by identifying over-provisioned and under-provisioned resources. It scans clusters and generates reports that highlight where adjustments can reduce costs or improve performance without compromising reliability. KRR is distributed as a Python command-line tool that can be run directly

tfsec is a static analysis tool and security scanner for infrastructure as code, specifically designed to detect misconfigurations and compliance violations in Terraform and cloud infrastructure definitions before deployment. It functions as a cloud security policy engine that identifies vulnerabilities across multiple cloud platforms. The tool provides capabilities for cloud compliance auditing and scanning of Cloud Development Kit code. It supports custom security policy enforcement and allows for the definition of organization-specific security requirements. The scanner includes features

This project is a unified, cloud-native policy engine designed to decouple authorization and security logic from application codebases. It functions as a centralized authorization service that evaluates structured input data against declarative rules, enabling consistent policy enforcement across microservices, infrastructure, and continuous integration pipelines. The engine utilizes a specialized logic programming language to express complex constraints, which are compiled into an optimized intermediate representation for high-performance evaluation. By supporting both sidecar-based deployme

Nomad is a distributed workload orchestrator and infrastructure automation platform designed to manage the lifecycle of applications across large-scale, heterogeneous environments. It functions as a multi-cloud orchestration engine, providing a unified control plane to deploy, scale, and govern containers, virtual machines, and legacy applications. By utilizing declarative job specifications, the system ensures infrastructure convergence and maintains the desired state across distributed data centers and geographic regions. The platform distinguishes itself through a flexible, plugin-based ar

pyinfra is a Python-based infrastructure automation framework that turns Python code into shell commands for managing servers, Docker containers, and local machines. It operates as a declarative, idempotent deployment tool, applying desired system states by comparing target configurations against current states and making only the necessary changes. The framework provides a connector-based transport abstraction that unifies SSH, Docker, and local execution behind a common interface, with a parallel execution engine that manages concurrent operations across hosts. The tool distinguishes itself

pyinfra is an agentless infrastructure automation framework that turns declarative Python code into idempotent shell commands to manage servers, containers, and local machines over SSH without requiring any pre-installed software on target hosts. It operates by comparing the desired state of a system against its current state, using a dry-run simulation mode to preview changes and a fact-based conditional execution engine to gather host attributes at runtime and control which operations run. The tool compiles Python operations into optimized shell commands and executes them in parallel across