Your cloud's second pair of eyes
Every day, LeftSize checks your AWS, Azure and Cloudflare accounts and tells your team what needs attention: VM sizes and runtimes being retired, resources costing money for nothing, security gaps. Each finding arrives as an issue in GitHub or Jira, with why it matters, the impact, and a fix script or AI prompt.
LeftSize never changes your systems: it runs read-only in your own GitHub Actions, and you decide what to fix. Cost rules are free for up to 3 repositories.
[COST] 15 idle VMs (≈ $2,100/mo)#142
Spaces / Cloud Ops / OPS-142
[COST] 15 idle VMs (≈ $2,100/mo)
Description
Ask for more with a comment such as/leftsize howto, or use the LeftSize panel.
Activity
Installs as a GitHub App • Issues in GitHub or Jira • No credit card required
Know what's changing in your cloud before it costs you
LeftSize keeps an eye on four things in your AWS, Azure and Cloudflare accounts: money going to waste, services and versions being retired, security risks, and resources nobody owns. The cost checks are free; the other three come with the Team plan.
Cost Optimization
Stop paying for what you're not using
Detect idle VMs, unattached disks, orphaned resources, and missing savings plans. Identify waste before it becomes expensive.
Examples include:
- Idle VMs (≤ 5% CPU over 7 days)
- Unattached disks and public IPs
- Missing Azure Hybrid Benefit
- Oversized or underutilized databases
- Paid Cloudflare zones serving no traffic
+ 76 more checks
Deprecations
Stay ahead of breaking changes
Get an issue for retiring VM sizes, end-of-support runtimes and engines, and retired services, with the date, before they impact your workloads.
Examples include:
- Retiring VM sizes (Dv2, Av2, Dv3 and more)
- Lambda and Functions runtimes out of support
- AKS, EKS and databases in paid extended support
- Retired SKUs: Basic Load Balancer, App Gateway v1
- Cloudflare Page Rules and Auto Minify
+ 70 more checks
Security
Catch risks before they become incidents
Spot public storage, open ports, databases reachable from the internet, weak TLS and missing encryption on AWS and Azure, and unencrypted origins and exposed tokens on Cloudflare.
Examples include:
- Public storage, open NSG / security group ports and SQL servers open to the internet
- Unencrypted EBS volumes and RDS databases, outdated TLS and plain HTTP
- Key Vault purge protection, Shared Key access and AKS local accounts
- IAM users without MFA, public snapshots and AMIs
- Cloudflare zones with Flexible SSL or without DNSSEC
+ 35 more checks
Governance
Know who owns what
Enforce tagging policies, track ownership and catch expiring certificates. Keep your cloud organized and accountable.
Examples include:
- Missing owner and cost-center tags
- Key Vault, ACM and Cloudflare certificates about to expire
- Unused Cloudflare Workers and inactive Tunnels
+ 18 more checks
217 rules across AWS, Azure and Cloudflare — covering compute, storage, Kubernetes, networking, databases, edge and DNS, and deprecations.
Already using Azure Advisor or AWS Cost Optimization Hub? Keep them. They show recommendations in a console; LeftSize turns findings into issues your team owns, with dates for retirements Advisor only partly covers.See how they compare
Cloud optimization shouldn't require a dedicated team
Most FinOps tools fail because they live outside your development workflow
For Developers
- Out-of-band emails feel punitive and interrupt workflow
- Dashboards require context-switching
- Unsure what's safe to change
For Platform / FinOps Teams
- FinOps dashboards are ignored by developers
- Security and governance reviews happen too late
- Credential-based SaaS scanners create trust barriers
LeftSize works inside your existing GitHub Actions pipelines — no new dashboard, no credential handover.
How it works
Four steps, about 15 minutes, and the first issues arrive after the first scan
Install the GitHub App
Choose the repository that runs the scan. A private repository is best. Nothing to host.
Give read-only access
Create a read-only role in AWS or Azure that GitHub Actions can sign in to with OIDC, or a read-only Cloudflare API token stored as a GitHub secret. The setup guide has the steps.
Add a workflow file
Commit the workflow the onboarding page generates. It scans daily in your own GitHub Actions; your credentials never leave your runner.
Receive actionable issues in GitHub or Jira
One issue per rule and scope, with the resources, the estimated savings and a fix: in the repository's GitHub Issues, or in a Jira project you link. Ask @leftsize for more, or /leftsize in Jira.
Your credentials stay in your control
Credentials never leave your GitHub Actions runner. LeftSize receives only the findings: resource IDs, the rule, configuration fields such as size or SKU, tag names and the estimated savings.
No agents or external cloud access required
OIDC with short-lived tokens is recommended for AWS and Azure; any login the action can use works. Cloudflare has no OIDC for API tokens, so it uses a read-only token kept as a GitHub secret.
Secure by default
Your credentials stay under your control — LeftSize never stores or accesses them
GitHub Actions
Under your control
Your Cloud
Read-only: OIDC or API token
LeftSize
Metadata only
GitHub Actions
Under your control
Your Cloud
Read-only: OIDC or API token
LeftSize
Metadata only
Only findings are sent to LeftSize:resource IDs, the rule, configuration fields such as size or SKU, tag names (never values) and the estimated savings. No credentials, no resource contents.
Scans run inside your GitHub Actions
Using your own cloud credentials: OIDC (recommended) or credentials stored as GitHub secrets for AWS and Azure, and a read-only API token stored as a GitHub secret for Cloudflare.
No credential storage
LeftSize never receives, stores, or has access to your cloud credentials.
No external service installation
No agents, no external cloud access required. Just a GitHub workflow.
Built on OIDC and short-lived tokens
Supports AWS and Azure best practices for credential management. Cloudflare has no OIDC for API tokens: use a read-only, account-owned token with an expiry date.
Only lightweight metadata shared
Resource IDs, cost data, and configuration metadata — not full resource data.
Full audit visibility
The action is open source (MIT), so you can read exactly what it sends. Every scan writes a job summary and logs in your repository.
Developer experience
See how LeftSize works in practice — with interactive commands and context-aware guidance
In Jira, the same commands are /leftsize comments or buttons in the LeftSize panel on the issue.
Idle Dev VMs
Issue:"[COST] 15 idle VMs (≈ $2,100/mo)"
Commands:@leftsize explain,@leftsize howto
Result: Clear guidance for safe cleanup
Missing Tags
Issue:"200 resources without owner tags"
Commands:@leftsize script azure-cli
Result: Bulk tagging script with audit trail
Open Security Groups
Issue:"NSG allows 0.0.0.0/0 on SSH/RDP ports"
Commands:@leftsize explain,@leftsize howto
Result: Step-by-step security remediation
Retiring VM SKUs
Issue:"VMs on D/Ds/Dv2/Dsv2/Ls sizes retiring May 1, 2028"
Commands:@leftsize explain
Result: Migration path with timeline
Missing Hybrid Benefit
Issue:"SQL Server VMs without Hybrid Benefit"
Commands:@leftsize script azure-cli
Result: Script to enable benefit
AKS Without Autoscaling
Issue:"AKS clusters without node autoscaler"
Commands:@leftsize howto
Result: Autoscaler configuration guide
Workflow setup
# .github/workflows/leftsize.yml
name: LeftSize Cost Optimization Scan
on:
schedule:
- cron: '0 9 * * *' # Daily at 9 AM
workflow_dispatch: # Manual trigger
permissions:
id-token: write # For Azure/AWS OIDC
contents: read
jobs:
leftsize-scan:
runs-on: ubuntu-latest
steps:
- name: Azure Login (OIDC)
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Run LeftSize Scan
uses: leftsize/leftsize-action@v1
with:
installation-id: ${{ secrets.LEFTSIZE_INSTALLATION_ID }}
repository-token: ${{ secrets.LEFTSIZE_REPOSITORY_TOKEN }}
cloud-provider: azure
On AWS, sign in with an IAM role instead and setcloud-provider: aws:
- name: AWS Login (OIDC)
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
aws-region: us-east-1
- name: Run LeftSize Scan
uses: leftsize/leftsize-action@v1
with:
installation-id: ${{ secrets.LEFTSIZE_INSTALLATION_ID }}
repository-token: ${{ secrets.LEFTSIZE_REPOSITORY_TOKEN }}
cloud-provider: aws
aws-regions: us-east-1,eu-west-1
On Cloudflare there is no OIDC login: pass a read-only API token stored as a GitHub secret, and the job doesn't needid-token: write:
- name: Run LeftSize Scan
uses: leftsize/leftsize-action@v1
with:
installation-id: ${{ secrets.LEFTSIZE_INSTALLATION_ID }}
repository-token: ${{ secrets.LEFTSIZE_REPOSITORY_TOKEN }}
cloud-provider: cloudflare
cloudflare-api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
The onboarding page generates this file and lists the secrets for your repository. Scanning more than one cloud? Add one job per cloud to the same workflow. Cloud credentials stay in GitHub — LeftSize never sees them.
Why teams choose LeftSize
Shift cloud optimization left — where developers already work
Zero Credential Storage
Runs in your GitHub Actions — we never see or store your cloud credentials
Comprehensive Coverage
Cost, deprecation and retirement, security and governance checks across AWS, Azure and Cloudflare. See every rule
Where Your Team Works
Issues in GitHub or Jira, next to the rest of your work — no new dashboard to check
Short Setup
Install the GitHub App, grant a read-only cloud role or Cloudflare API token, add the workflow, and run your first scan
Built for platform engineers who care about developer experience
Instead of drowning developers in FinOps dashboards, LeftSize brings actionable recommendations to GitHub or Jira issues — complete with@leftsize explainand @leftsize howtocommands for context-aware guidance.
See exactly what LeftSize checks
Every rule is documented, and here is how LeftSize compares to the tools you may already use.
Browse all 217 rules
98 AWS, 93 Azure and 26 Cloudflare rules: what each one detects, why it matters and how to fix it.
- Cost optimization81
- Deprecations & retirements75
- Security40
- Governance21
Compare LeftSize
Where LeftSize fits next to native and open-source tools, and where they do more.
- LeftSize vs Azure AdvisorMicrosoft’s built-in recommendations for Azure
- LeftSize vs AWS Trusted Advisor & Cost Optimization HubAWS’s built-in checks and savings recommendations
- LeftSize vs InfracostCost estimates and FinOps policies for infrastructure as code
- LeftSize vs Cloud Custodian (DIY)The open-source policy engine LeftSize is built on
- LeftSize vs VantageCloud cost reporting, allocation and budgets across providers
- LeftSize vs KomiserSelf-hosted cloud asset inventory and cost dashboard
- LeftSize vs Steampipe Thrifty modsOpen-source cost checks with Steampipe and Powerpipe
Simple pricing per organization
Every cost optimization rule is free. Team and Business add deprecation and retirement alerts, security and governance, and more repositories. Priced per GitHub organization, the same whether issues go to GitHub or Jira.
Free
Every cost optimization rule, for a small project or a first try.
$0
- Up to 3 repositories
- All 81 cost optimization rules (AWS, Azure, Cloudflare)
- Issues in GitHub or Jira, switch any time
- @leftsize commands
Team
For a team that wants retirements, security and governance covered too.
$79/month
- Up to 10 repositories
- All 217 rules
- 75 deprecation & retirement alerts
- 61 security & governance rules
- Email support
Business
For organizations with many repositories and cloud accounts.
$249/month
- Unlimited repositories
- All 217 rules
- Everything in Team
- Priority email support
- Help with onboarding
To upgrade, install LeftSize, sign in on the setup page and choose a plan there; you pay with Stripe and can cancel any time. Already installed? Use the upgrade link in your scan's job summary. Prices in US dollars, excluding VAT.
Compare plans
| Feature | Free | Team | Business |
|---|---|---|---|
| Repositories | 3 | 10 | Unlimited |
| Cost optimization (81 rules) | |||
| Deprecations & retirements (75) | |||
| Security (40) | |||
| Governance & tagging (21) | |||
| @leftsize commands | |||
| Support | Docs | Priority email |
Frequently asked questions
Can't find what you're looking for? Reach out to our team at hi@leftsize.com.
What does LeftSize do?
LeftSize is like Dependabot for cloud waste. A GitHub Action scans your AWS, Azure or Cloudflare account with read-only access and opens issues in GitHub or Jira for idle and orphaned resources, upcoming service retirements, and security and governance gaps, each with remediation steps.
What do the plans include?
Free includes all 81 cost optimization rules for up to 3 repositories. Team ($79/month) adds 75 deprecation and retirement alerts and 61 security and governance rules (217 rules in total) for up to 10 repositories. Business ($249/month) removes the repository limit and adds priority support. Every plan can send its issues to GitHub or Jira at no extra cost.
Does LeftSize get access to my cloud?
No. The scan runs as a GitHub Action in your own workflow. On AWS and Azure it signs in with OIDC (recommended) or other credentials, using a read-only role you grant (Reader and Monitoring Reader on Azure, ReadOnlyAccess on AWS). On Cloudflare it uses a read-only API token stored as a GitHub secret, because Cloudflare has no OIDC sign-in for API tokens. Credentials stay on your runner; LeftSize only receives the findings: resource IDs, the rule, configuration fields such as size or SKU, tag names (not values) and the estimated savings.
Does LeftSize support Cloudflare?
Yes. 26 Cloudflare rules check zones, Workers, R2 buckets, API tokens, Zero Trust seats, Tunnels, certificates and Registrar domains: paid zones serving no traffic, origins reached without encryption, unused tokens and Workers, deprecated Page Rules and more. The scan uses a read-only Cloudflare API token stored as a GitHub secret; it stays on your runner and is never sent to LeftSize. Issues are grouped per Cloudflare account.
Can the issues go to Jira instead of GitHub?
Yes, to Jira Cloud, on every plan and at no extra cost. The scan still runs in GitHub Actions, but LeftSize opens its issues in the Jira project you choose, for all repositories or per repository. Commands work with /leftsize in a comment or with the buttons in the LeftSize panel on the issue, and you can switch between GitHub and Jira at any time: open issues move along. The LeftSize app for Jira is not on the Atlassian Marketplace yet: a Jira site admin installs it with the install link on support.leftsize.com/jira.
How is LeftSize licensed?
Per GitHub organization (or personal account). The repository limit counts the repositories in that organization that send scan results.
What do I need to set up?
Install the GitHub App, give the workflow a read-only identity in your cloud (an Azure app registration with federated credentials, an AWS IAM role trusted by GitHub OIDC, or a read-only Cloudflare API token), add the workflow file and the secrets the onboarding page lists, and run it. Issues appear after the first scan.
Can I scan multiple subscriptions or accounts?
Yes. Use a GitHub Actions matrix to scan several Azure subscriptions or AWS accounts and regions in parallel. On Cloudflare, one token scans every account it can read, or the accounts you list in cloudflare-account-ids. The onboarding page shows you how.
What clouds are supported?
AWS, Azure and Cloudflare: 98 rules for AWS, 93 for Azure and 26 for Cloudflare. The full list is on the rules page.
Which permissions does the Cloudflare API token need?
Read permissions only. Zone: Zone, Zone Settings, DNS, SSL and Certificates. Account: Account Settings, Account Analytics, Account API Tokens, Workers Scripts, Workers R2 Storage, Access: Apps and Policies, Access: Service Tokens, Access: Audit Logs, Access: Organizations, Identity Providers, and Groups, Cloudflare Tunnel, and Load Balancing: Monitors and Pools. The onboarding page links to a pre-filled account-owned token. Account-owned tokens cannot read Page Rules or Registrar, so the rules for deprecated Page Rules, expiring domains and domain transfer lock only run with a user API token that also has Page Rules Read and Registrar Domains Read. A missing permission only skips the rules that need it. Usually the job summary then lists the skipped rule, but some Cloudflare lists come back empty instead of refused, so if a scan finds nothing for a feature you use, check the token's permissions and the action log.
How is this different from Azure Advisor or AWS Trusted Advisor?
Those show recommendations in a console that someone has to check. LeftSize puts each finding in the repository of the team that owns the resource, as an issue with fix steps, and adds service retirements and end-of-support dates. See the comparison pages for details.
Is LeftSize only for cost optimization?
No. Cost optimization is the core and is free. Team and Business add deprecation and retirement alerts (retiring VM sizes, end-of-support database engines and runtimes, Cloudflare Page Rules), security rules (public access, open ports, encryption, TLS, unused API tokens) and governance rules (missing ownership tags, expiring certificates, unused Workers).
Is the GitHub Action open source?
Yes. The action is MIT-licensed on GitHub (LeftSize/leftsize-action) and builds on Cloud Custodian, so you can read exactly what it checks and what it sends.
Can one workflow scan several clouds?
Yes. Each run of the action scans one cloud, so add one job per cloud (AWS, Azure, Cloudflare) to the same workflow. The jobs run in parallel and each submits its own findings; a scan of one cloud never closes findings of another. Only the AWS and Azure jobs need the id-token: write permission for OIDC. Each job counts as one of the 20 findings submissions an installation can make per day. One job with a matrix over the clouds works too; the Workflow Reference on the support site shows both.
Do you support Azure DevOps or GitLab?
The scan runs in GitHub Actions, so your workflow needs GitHub. The issues can go to GitHub Issues or Jira. We're exploring Azure DevOps based on customer demand; reach out to hi@leftsize.com to voice your interest.
How do I get support?
Check our documentation at support.leftsize.com for guides and troubleshooting, or email hi@leftsize.com. Paid plans get email support; Business gets priority support.
Turn cloud waste into issues your team fixes
Every cost optimization rule is free for up to 3 repositories. Read-only access, running in your own GitHub Actions.
No credit card required • Runs in your GitHub Actions • Issues in GitHub or Jira
Found 15 running Azure VMs with average CPU utilization at or below 5% over the last 7 days.
Use the commands below to learn more:
@leftsize explain@leftsize howto@leftsize script azure-cli