sofe 0.4.0

FinOps Policies as Code for AWS
Declarative YAML policies → live infrastructure evaluation → findings with dollar savings.

Quick Start · Why SOFE? · Comparison · Policies · CI/CD

SOFE evaluates declarative YAML policies against live AWS infrastructure and produces actionable findings — idle resources, missing tags, governance violations, and cost savings opportunities.

sofe evaluate --policies ./policies/ --profile production

────────────────────────────────────────────────────────────────────────────────
Severity   Policy                    Resource             Message
────────────────────────────────────────────────────────────────────────────────
🟠 high    no-idle-ec2               i-0abc123def         avg_cpu = 2.1% (threshold: <5%)
🟡 medium  require-cost-tags         i-0def456ghi         missing: costCenter, owner
🟡 medium  no-unattached-ebs         vol-789abc           180 days old, 500GB
────────────────────────────────────────────────────────────────────────────────
Summary: 3 findings | Potential savings: $365.00/mo

Why SOFE?

The Problem

Teams today manage cloud costs reactively — they see the bill spike, panic, then scramble to find what changed. Existing tools either alert on total spend (no root cause), scan for security (not cost-focused), or lock you into a vendor.

No tool does: declarative cost + governance policies that evaluate against live infrastructure and produce findings with dollar-amount savings.

The Solution

# policies/no-idle-production.yaml
apiVersion: sofe/v1
kind: Policy
metadata:
  name: no-idle-production
  description: "Flag idle EC2 in production (< 5% CPU for 30 days)"
spec:
  scope:
    environments: [production]
    resource_types: [aws.ec2]
  rule:
    metric: avg_cpu_utilization
    period: 30d
    operator: "<"
    threshold: 5
  severity: high
  actions:
    - type: recommend
      suggestion: "Rightsize or terminate"
      estimated_savings: calc

Write a policy once. Run it daily. Get findings with savings.

Who Should Use SOFE?

Quick Start

# Install
pip install sofe

# Write your first policy
cat > policies/require-tags.yaml << 'EOF'
apiVersion: sofe/v1
kind: Policy
metadata:
  name: require-cost-tags
  description: "All resources must have owner and costCenter tags"
spec:
  scope:
    resource_types: [aws.ec2, aws.rds, aws.s3]
  rule:
    metric: has_tag:owner
    operator: "=="
    threshold: 0
  severity: medium
  actions:
    - type: finding
EOF

# Validate
sofe validate --policies ./policies/

# Evaluate against live AWS
sofe evaluate --policies ./policies/ --profile production

# CI/CD mode (exit code 1 if high/critical found)
sofe evaluate --policies ./policies/ --fail-on high

# JSON output for automation
sofe evaluate --policies ./policies/ --format json > findings.json

How It Works

┌─────────────────┐     ┌──────────────┐     ┌──────────────────────┐
│ Policy Loader   │     │  Collectors  │     │  Evaluation Engine   │
│                 │     │              │     │                      │
│ Reads YAML      │────▶│ AWS APIs:    │────▶│ For each policy:     │
│ Validates       │     │ EC2, RDS     │     │ match scope →        │
│ schema          │     │ S3, Lambda   │     │ evaluate condition → │
│                 │     │ CloudWatch   │     │ if violated →        │
└─────────────────┘     └──────────────┘     │   generate finding   │
                                              └──────────┬───────────┘
                                                         │
                                               ┌─────────▼─────────┐
                                               │  Output            │
                                               │  • Table (CLI)     │
                                               │  • JSON (CI/CD)    │
                                               │  • Markdown (PRs)  │
                                               └────────────────────┘

Pre-Built Policies

Supported Metrics

CI/CD

- name: FinOps Policy Check
  run: |
    pip install sofe
    sofe evaluate --policies ./policies/ --fail-on high --format json > findings.json

Comparison

The SOFE Position

SOFE lives in the RUN phase: evaluate live infrastructure against declarative FinOps policies. Produce findings with dollar savings.

PLAN           DEPLOY       RUN               OPTIMIZE
Infracost      OPA/Rego     ★ SOFE ★          Spot.io
Checkov        Sentinel     Cloud Custodian   CAST AI
                            AWS Config

BYaML Integration

SOFE derives an Architecture Graph v0.4 (BYaML v2) — nodos con tipos canónicos (aws.ec2, aws.s3, …) y aristas tipadas. Es el mismo estándar del registry schema.byaml.org y de byaml-mcp (agentes). /evaluations/:id/graph expone el grafo derivado.

Ecosystem

License

Apache 2.0 — free to use, modify, and distribute.

Built by engineers who got tired of surprise AWS bills.
sofe.dev · GitHub · finoptix.dev

_{Write a policy once. Run it daily. Save money.}