If you manage cloud infrastructure at scale, you already know the Friday afternoon drill: Finance pings you about a 15% spike in the AWS bill, and suddenly you are spending your weekend clicking through AWS Cost Explorer, hunting down unattached EBS volumes, idle EC2 instances, and unassociated Elastic IPs across multiple regions.

AWS provides native tools like Cost Explorer and Trusted Advisor, but they often lack programmable, deeply customizable data manipulation. Manually tracking down orphaned resources in the AWS Console is slow, repetitive, and burns engineering hours that should be spent shipping features.

To solve this, I built aws-finops-auditor.

It is a lightweight, CLI-driven tool that uses boto3 to inspect cloud resources and pandas to normalize, analyze, and aggregate infrastructure waste into an actionable report. No console clicking—just a fast terminal command that identifies where you are leaking budget and maps findings to compliance frameworks.

Technical Architecture: Treating Infrastructure as Data

Most custom AWS cleanup scripts blind-fire boto3 API calls and execute immediate deletions. When dealing with production workloads, destructive actions require guardrails and dry-run reviews.

Applying data analytics principles, aws-finops-auditor treats cloud infrastructure as an inspectable data pipeline:

  1. Vectorized Filtering: Rather than writing nested loops over raw API dictionaries, the tool pulls AWS resource state into a structured Pandas DataFrame. This makes complex filtering—such as isolating EBS volumes in an available state without active attachments—concise and robust.
  2. Deterministic Pricing Engine: The auditor calculates exact monthly financial drag based on provisioned storage classes and regional compute rates.
  3. Compliance Control Mapping: Resources are mapped against control frameworks (SOC2 CC6.6, ISO27001 A.10.1.1) and exported to CSV with resource tagging intact.
  4. Automated, Safe Remediation: Instead of executing deletions automatically, the --remediate flag synthesizes a safe, idempotent bash script (remediate_anomalies.sh) with strict set -euo pipefail safety checks. 
# Example generated purge script (remediate_anomalies.sh) set -euo pipefail # --- Unattached EBS Volumes --- # Estimated Monthly Savings: $48.00 aws ec2 delete-volume --volume-id vol-0123456789abcdef0 --region us-east-1

Try It Out

The single-account core engine is available free and open-source:

Need Multi-Account AWS Organization Support?

For DevOps teams, consultants, and MSPs managing multiple AWS accounts, the commercial toolkit adds enterprise cross-account automation:

  • Practitioner License ($99): Single-account CLI scanner, automated compliance CSV exports, and dynamic bash remediation generation.
  • Consultancy & Agency Pack ($499): Automated multi-account STS cross-account orchestration across an entire AWS Organization, automated CloudFormation StackSets, and branded executive PDF showback reports for clients and leadership.

👉 Explore the AWS Cloud Cost Auditor Toolkit on Gumroad

What is the most stubborn source of orphaned spend in your AWS environments? Let me know in the comments below!