# Wasteless FinOps Audit Report

## Document control

| Field | Value |
|---|---|
| Report ID | |
| Audit version | |
| Prepared by | |
| Reviewed by | |
| Audit date | |
| AWS account | |
| Observed regions | |
| Analysis period | |
| Currency | |
| Latest collection run | |
| Run status | Complete / Partial / Failed |
| Steampipe status | Available / Unavailable / Misconfigured |

> One Wasteless installation currently represents one AWS account. If this report consolidates several installations, identify the source installation for every finding.

## 1. Executive summary

| Metric | Value |
|---|---:|
| Monthly AWS spend in scope | |
| Detected waste | |
| Potential monthly savings | |
| Annualized potential | |
| Realized savings | |
| Confirmed savings | |
| Active recommendations | |
| Approved actions | |
| Executed actions | |
| Blocked or rejected actions | |
| Critical risks | |

### Executive statement

Wasteless analyzed **[account and regions]** over **[period]** and detected **[amount] per month** of waste across the detector families listed in this report.

The selected recommendations represent **[amount] per month** in potential savings. The annualized value of **[amount]** is a theoretical ceiling, not a forecast.

Actions representing **[amount]** have been executed. Of that amount, **[amount]** is currently confirmed using the validation method documented in section 8.

### Savings terminology

| Term | Meaning | Can be reported as achieved? |
|---|---|---|
| Detected waste | Monthly cost associated with resources classified by covered detectors | No |
| Potential savings | Estimated monthly saving if selected recommendations are applied | No |
| Annualized potential | Monthly potential multiplied by 12 | No |
| Realized savings | Value recorded after a remediation | With qualification |
| Confirmed savings | Saving validated with financial evidence for a supported path | Yes, for the documented scope and period |

> Automated confirmed-savings verification currently covers supported EC2 stop actions after enough post-action data is available. Other action types require a separately documented validation method.

## 2. Scope and coverage

### 2.1 Account and data scope

- AWS account:
- Installation identifier:
- Regions observed:
- Period analyzed:
- Cost currency:
- Pricing source:
- Cost Explorer enabled:
- Last successful collector run:
- Last successful detector run:
- Run status:
- Reason for partial coverage, if any:

### 2.2 Detector coverage

Mark only the families that actually completed during this audit.

| Detector family | Signal | Engine | Included | Notes |
|---|---|---|---|---|
| Running EC2 | Average CPU below 5% over 7 days | boto3 | Yes / No | |
| Stopped EC2 | Stopped at least 7 days with residual EBS cost | boto3 | Yes / No | |
| Unattached EBS | Volume has no attachment | boto3 | Yes / No | |
| Unassociated Elastic IP | Address has no association | boto3 | Yes / No | |
| Old EBS snapshot | Older than 90 days, excluding AMI, Backup and DLM snapshots | boto3 | Yes / No | |
| Load balancer with no targets | No registered targets | Steampipe | Yes / No | |
| NAT Gateway with no outbound traffic | No outbound traffic over 30 days | Steampipe | Yes / No | |
| VPC with no ENI | No network interfaces | Steampipe | Yes / No | |
| gp2 to gp3 opportunity | Eligible gp2 volume | Steampipe | Yes / No | |

> If Steampipe is unavailable, the boto3 detectors can still run. Record the result as partial and do not imply coverage of the four Steampipe families.

### 2.3 Exclusions

Record exclusions that affect interpretation.

- AWS accounts not represented by this installation:
- Regions not collected:
- Services without a Wasteless detector:
- RDS:
- EKS:
- Reserved Instances and Savings Plans:
- Marketplace charges:
- Support fees:
- Taxes:
- Enterprise discounts or credits:
- Carbon emissions:
- Other exclusions:

> RDS, EKS and carbon-emissions analysis are not native Wasteless detector capabilities at the time of this template. Include them only when a separate, documented analysis was performed.

## 3. Financial overview

| Metric | Value | Source | As of |
|---|---:|---|---|
| Monthly spend in scope | | | |
| Forecast | | | |
| Budget | | | |
| Budget usage | | | |
| Detected waste | | | |
| Potential monthly savings | | | |
| Annualized potential | | | |
| Realized savings | | | |
| Confirmed savings | | | |

### Calculation rules

```text
Waste percentage = detected waste / in-scope cloud spend * 100
Annualized potential = potential monthly savings * 12
```

Annualized potential assumes constant waste and immediate full remediation. It is not a forecast.

## 4. Cost breakdown

Include only services supported by the stated scope or by a separate documented analysis.

| Service | Cost | Share | Source | Notes |
|---|---:|---:|---|---|
| EC2 | | | | |
| EBS | | | | |
| NAT Gateway | | | | |
| Elastic IP | | | | |
| Elastic Load Balancing | | | | |
| CloudWatch | | | | |
| Other documented scope | | | | |

## 5. Findings and recommendations

### 5.1 Prioritized view

| Priority | Recommendation ID | Resource | Region | Detector | Owner | Potential saving | Confidence | Risk | Status |
|---:|---|---|---|---|---|---:|---:|---|---|

### 5.2 Finding record

Copy this block for each material recommendation.

#### Finding [recommendation ID]

| Field | Value |
|---|---|
| Resource ID | |
| Resource type | |
| Account | |
| Region | |
| Environment | |
| Owner | |
| Detector family | |
| Observation window | |
| Signal and metrics | |
| Estimated monthly cost | |
| Potential monthly saving | |
| Pricing source | |
| Confidence score | |
| Proposed action | |
| Execution path | Direct / Manual / Terraform PR |
| Destructive | Yes / No |
| Available recovery | |
| Risk | Low / Medium / High / Critical |
| Current status | Pending / Rejected / Scheduled / Approved manual / PR open / Applied / Obsolete |
| Reviewer notes | |

## 6. Decision and action plan

| Recommendation | Decision | Decision maker | Decision time | Reason | Action owner | Target date |
|---|---|---|---|---|---|---|

### Current execution support

| Action | Wasteless path | Recovery note |
|---|---|---|
| Stop running EC2 | Direct when authorized | Start instance |
| Terminate long-stopped EC2 | Direct when authorized | Destructive |
| Migrate gp2 to gp3 | Direct when authorized | No automatic reverse migration |
| Delete unattached EBS | Direct after snapshot when authorized | Manual restore from snapshot |
| Delete unused NAT Gateway | Direct when authorized | Manual recreation |
| Delete load balancer with no targets | Direct when authorized | Manual or infrastructure-as-code recreation |
| Resize EC2 | Manual | Document the team's rollback plan |
| Delete old snapshot | Manual | Destructive |
| Release unassociated Elastic IP | Manual | Original address may not be recoverable |
| Delete VPC with no ENI | Manual | Destructive |

> A manual approval records the decision. It does not prove that the user completed the AWS action.

## 7. Safety and execution evidence

### 7.1 Policy snapshot

| Policy | Configured value |
|---|---|
| Dry-run | |
| Auto-remediation enabled | |
| Enabled action types | |
| Minimum confidence | |
| EC2 minimum age | |
| EC2 minimum idle duration | |
| Maximum EC2 actions per run | |
| Whitelisted resource IDs | |
| Protected tags | |
| Allowed schedule | |
| Grace period | |
| Terraform PR enabled | |

### 7.2 Controls by action

Do not assume that every action uses the same controls.

| Recommendation | Execution path | Controls evaluated | Result | Block reason |
|---|---|---|---|---|
| | EC2 / Non-EC2 / Manual / Terraform PR | | Pass / Blocked / Not applicable | |

The full EC2 automation path can evaluate global and per-action enablement, whitelist, instance age, confidence, idle duration, allowed schedule and per-run limits. Non-EC2 remediators use the relevant subset plus resource-specific preconditions. Manual actions do not make the AWS deletion call.

### 7.3 Execution trail

| Recommendation | Grace deadline | Cancelled | Execution time | Dry-run | AWS result | CloudTrail reference | Post-sync state |
|---|---|---|---|---|---|---|---|

### 7.4 Recovery evidence

| Recommendation | Recovery mechanism | Artifact or reference | Retention | Restore tested |
|---|---|---|---|---|
| | Restart / Snapshot / Infrastructure as code / None | | | Yes / No / Not applicable |

> A recorded rollback artifact does not make every operation reversible. EC2 termination, NAT deletion and load balancer deletion remain destructive unless the team can reconstruct the resource separately.

## 8. Savings validation

### 8.1 Validation status

| Recommendation | Action | Potential | Executed | Realized | Confirmed | Validation method | Validation period |
|---|---|---:|---|---:|---:|---|---|
| | | | Yes / No | | | | |

### 8.2 Supported automated confirmation

For a supported EC2 stop action:

- Record the action timestamp.
- Wait until sufficient post-action billing data is available.
- Compare Cost Explorer spend before and after the action.
- Record the comparison period and any confounding changes.
- Store the confirmed delta only when the comparison is meaningful.

### 8.3 Other action types

For gp2 migration, EBS deletion, NAT deletion, load balancer deletion and manual actions:

- Do not label the estimate as confirmed automatically.
- Document the external validation method.
- Record the billing period used.
- Account for pricing changes, usage changes, credits and unrelated infrastructure changes.
- Keep the result as potential or realized until the evidence is sufficient.

## 9. Risk summary

| Risk level | Count | Potential saving | Comment |
|---|---:|---:|---|
| Low | | | |
| Medium | | | |
| High | | | |
| Critical | | | |

### Material risks

- Production interruption:
- Destructive action:
- Missing owner:
- Incomplete observation window:
- Partial detector run:
- Missing pricing provenance:
- Missing recovery plan:
- LLM provider data handling:
- Other:

> LLM insights can explain an existing recommendation. They do not authorize, select or execute actions and must not be treated as a safety decision.

## 10. Limitations and assumptions

- One Wasteless installation represents one AWS account.
- Regions observed:
- Regions not observed:
- Detector families unavailable:
- Data freshness:
- Cost Explorer delay:
- Pricing assumptions:
- Discounts and credits:
- Workload seasonality:
- Business events during the period:
- Manual actions not yet synchronized:
- Services analyzed outside Wasteless:
- Other limitations:

## 11. Final statement

Wasteless detected **[amount] per month** of waste within the documented AWS account, region and detector scope.

Selected recommendations represent **[amount] per month** of potential savings. The annualized value of **[amount]** is a theoretical ceiling and not a forecast.

Remediations representing **[amount]** were executed. **[amount]** is recorded as realized. **[amount]** is confirmed using the validation method and period documented in section 8.

All remaining figures are estimates or executed actions awaiting sufficient financial validation.

## 12. Sign-off

| Role | Name | Decision | Date |
|---|---|---|---|
| FinOps owner | | | |
| Platform owner | | | |
| Security reviewer | | | |
| Finance reviewer | | | |
| Executive sponsor | | | |