REC-042
Idle EC2 candidate
EC2 · i-0a2b · t3.xlarge
94%
- Average CPU
- 2.1%
- Observed
- 14 days
- Estimated monthly exposure
- €284
Suggested actionStop after dry run
No action runs before the configured review path.
AWS WASTE-TO-ACTION ENGINE · OPEN SOURCE · SELF-HOSTED
Turn AWS waste into controlled action.
Wasteless collects AWS evidence without write access, creates scored recommendations and routes each supported change through a direct, Terraform or guided manual path.
Start with zero AWS write permission. Enable a supported action path only when your policy allows it.
9detector families
0write permissions to detect
Defaultdry-run mode
Apache 2.0open source license
FROM VISIBILITY TO ACTION
Detection is only the beginning.
Native AWS tools and FinOps platforms already create valuable visibility. Wasteless complements them with an inspectable path from selected findings to controlled action.
01
Native AWS tools detect
CloudWatch, Cost Explorer and Compute Optimizer provide broad AWS signals, utilization data and service recommendations. They are an essential foundation.
Signals and recommendations
02
FinOps platforms explain
FinOps platforms organize spend, allocation and optimization opportunities so teams can understand where cloud value is created or lost.
Visibility and prioritization
03
Wasteless closes the loop
The self-hosted engine links evidence to policy, approval, supported execution paths and an action record your team can inspect.
Evidence to controlled action
Wasteless complements native AWS and FinOps views. It focuses on the last operational mile: turning a supported recommendation into a controlled, traceable outcome.
ONE RECOMMENDATION, END TO END
From raw telemetry to an auditable outcome
Explore the control loop. Each stage keeps the evidence that the next stage needs.
Selected stage / 01
Collect without write access
CloudWatch, Cost Explorer and Steampipe feed the engine on a five-minute schedule through the discovery role.
Read-only AWS evidenceTelemetry snapshot ready
Recommendation recordHuman approval required
- Resource
- i-0a2b
- Detector
- ec2_idle
- Evidence
- CPU 2.1% / 14d
- Confidence
- 0.94
Potential cost exposure€284 / month
Example data for product demonstration, not a customer result or savings guarantee.
PRODUCT COVERAGE
See what Wasteless can detect and act on
Coverage is explicit. Each detector produces evidence, and each recommendation follows the execution mode that the current product actually supports.
Observe
KPIs, trends, waste views, scheduled AWS synchronization and a live multi-region EC2 inventory.
Prioritize
Recommendations carry resource evidence, confidence, estimated monthly exposure and AWS pricing context.
Remediate
Supported paths cover EC2 stop or terminate, gp2 to gp3, EBS, NAT and load balancer actions. Other cases remain guided and manual.
Govern
Action history, state snapshots, YAML policies, reports, logs and configuration keep the operating context visible.
DETECTOR REGISTRY
Nine detector families
The current rules implemented in the product.
- 01Running EC2 with low average CPUCompute
- 02Stopped EC2 with residual EBS costCompute
- 03Unattached EBS volumesStorage
- 04Unassociated Elastic IPsNetwork
- 05Old EBS snapshots with exclusionsStorage
- 06Load balancers without targetsNetwork
- 07NAT Gateways without outbound trafficNetwork
- 08VPCs without network interfacesHygiene
- 09Attached gp2 volumes eligible for gp3Storage
Automation is capability-specific and opt-in. Wasteless does not silently execute every recommendation.
Supported action paths
The execution path depends on the resource, the configured policy and the permissions you explicitly provide.
| Target | Action | Execution path |
|---|---|---|
| EC2 | Stop or terminate an approved instance | Direct AWSGuarded AWS execution when the write role and policy allow it |
| gp2, EBS, NAT and Load Balancer | Migrate or remove a supported resource | Direct AWSBackend remediator after live recheck, safeguards and explicit authorization |
| Terraform-managed infrastructure | Prepare a reviewable infrastructure change | Terraform PROptional pull request when Terraform PR automation is configured |
| EC2 downsize, snapshots, EIP and VPC | Review and carry out the recommended change | Guided manualGuided manual workflow. Wasteless records the decision without silently touching AWS |
Automation is optional, policy-controlled and capability-specific. Destructive actions are not universally reversible. State snapshots support audit and recovery only where the action permits it.
CODE AS PROOF
Inspect every step from evidence to action
Collectors, detectors, safeguards, action modes and trackers are implemented as inspectable code. The decision path stays deterministic even when optional AI adds context.
01 / INPUTAWS evidence
CloudWatchCost ExplorerSteampipe
02 / ENGINEPython enginecollect · detect · score · guard
03 / STATEPostgreSQLfindings · actions · snapshots
04 / REVIEWFastAPI UIreview · reports · configuration
SAFETY CONTROL
The repository defines the control boundary
01
Separate IAM pathsDiscovery uses a read-only role. Write access is optional and isolated.
02
Dry run and approvalRemediation is off by default and can require explicit human validation.
03
Configurable policyConfidence thresholds, whitelists, schedules and limits live in YAML.
04
Cancellable automationThe automated path supports a configurable grace period, set to three days by default.
State snapshots support audit and recovery where the action allows it. Destructive infrastructure changes are not described as universally reversible.
OPTIONAL AI INSIGHTS
A copilot outside the control loop
Via LiteLLM, Wasteless can explain recommendations, answer contextual questions and prepare a daily briefing. The deterministic engine still owns detection and safeguards.
- Provider of your choice
- Local model possible with Ollama
- Token and cost tracking
- Product works with AI disabled
A hosted model receives the context included in its prompts. Use a local provider when that data must stay entirely in your environment.
THE REPOSITORY IS THE EVIDENCE
Inspect the promise in the code.
Wasteless is licensed under Apache 2.0. Its detectors, seven safeguards, action registry, IAM policies, audit store and supported savings tracker can be inspected before you connect an AWS account.
Python 3.11+FastAPIboto3SteampipePostgreSQLDocker
README / QUICK START
macOS, Linux or WSL2Quick start
- 01Clone the repository
- 02Run ./install.sh
- 03Connect the read-only AWS role
- 04Review the first collection
Read the exact permissions and supported action modes before enabling any write path.
CLEAR ANSWERS
Before Wasteless touches your AWS account
01Does discovery require AWS write access?
No. Collection and detection use a dedicated read-only IAM role. A separate write role is optional and only needed for supported remediation paths.
02Why not use AWS Compute Optimizer alone?
Compute Optimizer provides broad AWS rightsizing and efficiency recommendations. Wasteless does not replace that breadth. It adds a self-hosted, inspectable loop around the waste families it supports: evidence, policy, approval, supported action paths, history and operational follow-through.
03Does Wasteless remediate every finding automatically?
No. Automation is disabled by default and depends on the resource type. Some actions can run through guarded AWS remediators, an optional Terraform PR path or a guided manual workflow.
04Does the AI decide what gets changed?
No. The LLM layer is optional and non-decision-making. It explains recommendations, answers questions and creates briefings while deterministic rules and human approval remain in control.
05How are savings verified?
Wasteless stores estimates and action history for recommendations. For supported EC2 stop actions, the current tracker checks realized savings later with AWS Cost Explorer after enough post-action data exists.
06Where does operational data live?
The application and PostgreSQL store run in your environment. If you enable a hosted LLM provider, the recommendation context included in a prompt is sent to that provider. A local Ollama model is supported.
07Which environments are supported?
The documented paths cover macOS, native Linux and Windows through WSL2, with Docker and Python 3.11 or newer as prerequisites.
RUN THE ENGINE. KEEP THE EVIDENCE.
Install Wasteless and inspect the first recommendation.
Start with zero write permission. Keep the evidence, policy, decision and supported outcome linked in one traceable record.
9 detector families · dry-run by default · Apache 2.0