FinOps Policies as Code for AWS
Declarative YAML policies → live infrastructure evaluation → findings with dollar savings.

Quick Start · Why SOFE? · Comparison · Policies · CI/CD

---

SOFE evaluates declarative YAML policies against live AWS infrastructure and produces actionable findings — idle resources, missing tags, governance violations, and cost savings opportunities.

sofe evaluate --policies ./policies/ --profile production

────────────────────────────────────────────────────────────────────────────────
Severity Policy Resource Message
────────────────────────────────────────────────────────────────────────────────
🟠 high no-idle-ec2 i-0abc123def avg_cpu = 2.1% (threshold: <5%)
🟡 medium require-cost-tags i-0def456ghi missing: costCenter, owner
🟡 medium no-unattached-ebs vol-789abc 180 days old, 500GB
────────────────────────────────────────────────────────────────────────────────
Summary: 3 findings | Potential savings: $365.00/mo

Why SOFE?

The Problem

Teams today manage cloud costs reactively — they see the bill spike, panic, then scramble to find what changed. Existing tools either alert on total spend (no root cause), scan for security (not cost-focused), or lock you into a vendor.

No tool does: declarative cost + governance policies that evaluate against live infrastructure and produce findings with dollar-amount savings.

The Solution

# policies/no-idle-production.yamlapiVersion: sofe/v1kind: Policymetadata:
name: no-idle-productiondescription: "Flag idle EC2 in production (< 5% CPU for 30 days)"spec:
scope:
environments: [production]resource_types: [aws.ec2]rule:
metric: avg_cpu_utilizationperiod: 30doperator: "<"threshold: 5severity: highactions:
- type: recommendsuggestion: "Rightsize or terminate"estimated_savings: calc

Write a policy once. Run it daily. Get findings with savings.

Who Should Use SOFE?

Role	Why SOFE matters
Cloud/DevOps Engineers	Automate governance checks in CI/CD. sofe evaluate --fail-on high blocks deploys that violate cost policies.
FinOps Practitioners	Define cost optimization rules as code. Track compliance across accounts. Quantify waste.
Platform Engineers	Enforce tagging standards, idle resource cleanup, and architecture best practices at scale.
CTOs / Engineering Managers	Visibility into cloud waste without manual audits.
AWS Partners / Consultants	Deliver FinOps assessments faster with repeatable, auditable policy evaluations.

Quick Start

# Install
pip install sofe
# Write your first policy
cat > policies/require-tags.yaml << 'EOF'apiVersion: sofe/v1kind: Policymetadata: name: require-cost-tags description: "All resources must have owner and costCenter tags"spec: scope: resource_types: [aws.ec2, aws.rds, aws.s3] rule: metric: has_tag:owner operator: "==" threshold: 0 severity: medium actions: - type: findingEOF# Validate
sofe validate --policies ./policies/
# Evaluate against live AWS
sofe evaluate --policies ./policies/ --profile production
# CI/CD mode (exit code 1 if high/critical found)
sofe evaluate --policies ./policies/ --fail-on high
# JSON output for automation
sofe evaluate --policies ./policies/ --format json > findings.json

How It Works

┌─────────────────┐ ┌──────────────┐ ┌──────────────────────┐
│ Policy Loader │ │ Collectors │ │ Evaluation Engine │
│ │ │ │ │ │
│ Reads YAML │────▶│ AWS APIs: │────▶│ For each policy: │
│ Validates │ │ EC2, RDS │ │ match scope → │
│ schema │ │ S3, Lambda │ │ evaluate condition → │
│ │ │ CloudWatch │ │ if violated → │
└─────────────────┘ └──────────────┘ │ generate finding │
└──────────┬───────────┘
│
┌─────────▼─────────┐
│ Output │
│ • Table (CLI) │
│ • JSON (CI/CD) │
│ • Markdown (PRs) │
└────────────────────┘

Pre-Built Policies

Policy	Type	Severity
no-idle-ec2	Cost Optimization	high
no-idle-rds	Cost Optimization	high
require-cost-tags	Governance	medium
no-oversized-staging	Cost Optimization	high
s3-lifecycle-required	Storage	medium
s3-encryption-required	Security/Cost	high
no-unattached-ebs	Storage	medium
no-old-snapshots	Storage	low
budget-exceeded	Budget	critical
no-public-without-waf	Security/Cost	high

Supported Metrics

Metric	Source	Resources
avg_cpu_utilization	CloudWatch (30d avg)	EC2, RDS
monthly_cost	Cost Explorer	All
running_days	LaunchTime	EC2, RDS
has_tag:{key}	Tags API	All
storage_used_gb	CloudWatch	S3, EBS
connections	CloudWatch	RDS
invocations	CloudWatch	Lambda

CI/CD

- name: FinOps Policy Checkrun: | pip install sofe sofe evaluate --policies ./policies/ --fail-on high --format json > findings.json

Exit Code	Meaning
0	No violations (or below --fail-on threshold)
1	Violations found at or above --fail-on severity

Comparison

Tool	Cost Policies	Live Eval	Savings Calc	CI/CD	Open Source
SOFE	✅	✅	✅	✅	✅
AWS Budgets	❌ (alerts only)	❌	❌	❌	❌
Infracost	🟡 (pre-deploy)	❌	✅	✅	✅
OPA/Rego	✅ (security)	❌	❌	✅	✅
Prowler	❌ (security only)	✅	❌	✅	✅
Cloud Custodian	🟡 (not FinOps-first)	✅	❌	🟡	✅

The SOFE Position

SOFE lives in the RUN phase: evaluate live infrastructure against declarative FinOps policies. Produce findings with dollar savings.

PLAN DEPLOY RUN OPTIMIZE
Infracost OPA/Rego ★ SOFE ★ Spot.io
Checkov Sentinel Cloud Custodian CAST AI
AWS Config

BYaML Integration

SOFE derives an Architecture Graph v0.4 (BYaML v2) — nodos con tipos canónicos (aws.ec2, aws.s3, …) y aristas tipadas. Es el mismo estándar del registry schema.byaml.org y de byaml-mcp (agentes). /evaluations/:id/graph expone el grafo derivado.

Ecosystem

Project	Description
sofe-server	REST API server (FastAPI)
sofe-cli	Go CLI (19 commands, TUI)
sofe-action	GitHub Action
byaml-spec	Estándar Architecture Graph v0.4 (schema/catalog/relationships)
byaml-mcp	MCP tools para agentes (graph + insights + remediation)
FinOptix	AI model for FinOps reasoning

License

Apache 2.0 — free to use, modify, and distribute.

---

Built by engineers who got tired of surprise AWS bills.
sofe.dev · GitHub · finoptix.dev

_{Write a policy once. Run it daily. Save money.}