Docs navigation
cloudrift logo

cloudrift

cloudrift is a CLI that analyzes AWS accounts to identify wasted resources and estimate their monthly cost.

Demo of cloudrift installation and interactive wizard

⚠️ Disclaimer: cloudrift is a read-only analysis tool: it reports estimated waste and recommendations — it does not delete, modify or stop any AWS resource. All findings should be validated by your infrastructure team before taking action.

Why

Unused AWS resources accumulate costs with no value. Unattached EBS volumes, unassociated Elastic IPs, stopped RDS instances, NAT Gateways with no traffic — cloudrift finds them automatically and tells you how much you’re spending for nothing.

Sample output

cloudrift analyze
  Scanning us-east-1 (account 123456789012) for wasted cloud resources...

  EBS Volumes — Unattached
  ┌────────────────────┬───────────┬────────┬──────┬────────────┬────────────┐
  │ Volume ID          │ Region    │ Size   │ Type │ Created    │ Est. Cost  │
  ├────────────────────┼───────────┼────────┼──────┼────────────┼────────────┤
  │ vol-0abc123def456  │ us-east-1 │ 500 GB │ gp3  │ 2025-01-15 │ $40.00/mo  │
  └────────────────────┴───────────┴────────┴──────┴────────────┴────────────┘

  NAT Gateways — Zero Traffic (14d)
  ┌────────────────────┬───────────┬────────────┬────────────┐
  │ Gateway ID         │ Region    │ Created    │ Est. Cost  │
  ├────────────────────┼───────────┼────────────┼────────────┤
  │ nat-0f1e2d3c4b5a6  │ us-east-1 │ 2025-02-03 │ $32.40/mo  │
  └────────────────────┴───────────┴────────────┴────────────┘

  Total estimated waste: $72.40/month

Same scan, different output depending on what you need: --format json for piping (jq), --format markdown for PR comments, --pdf for a shareable report, --silent for CI-only runs.

What makes it different

  • No new credentials to create — uses the AWS SDK credential chain you already have (profile, env vars, instance role). No dedicated IAM user, no access key to rotate just for cloudrift.
  • Read-only, always — the required policy is entirely Describe*/Get*/List*. No write action is ever called, in any command.
  • Zero third parties — runs locally or in your CI; data stays inside your perimeter. No SaaS account to create, no telemetry, nothing leaves your network unless you explicitly opt into a notification (Slack/webhook/email).
  • Open source — Apache-2.0, inspectable on GitHub.

Quick start

npm install -g @cloudrift/cli
cloudrift analyze

All you need is a read-only IAM policy — see Quick Start → for the full install and the policy to paste.

What it detects

cloudrift analyzes 44 resource types split into two categories — waste (money being spent now, eliminable) and optimization (a saving that keeps the resource) — from unattached EBS volumes to idle Redshift clusters, from stale CodePipeline pipelines to S3 buckets with no lifecycle.

→ See all 44 supported resources

Beyond waste detection

The core is cloud-cost waste detection, but cloudrift also covers three other domains — each with its own page:

  • MCP Server — an AI agent (Claude Code, Kiro, VS Code Copilot) calls the scanners directly as tools
  • CI/CD Gate — blocks the pipeline if waste exceeds a threshold
  • Security posture (resource-security, 29 checks) and dead resources (dead-resources, 18 checks) at $0 cost
  • Policy as Code with OPA for advanced rules
  • Spend comparison and trend via AWS Cost Explorer

False-positive guards

  • Grace period — resources younger than 7 days (configurable via --min-age-days) are never reported
  • Exclusion tag — any resource tagged cloudrift:ignore (configurable via --ignore-tag) is skipped
  • AMI-bound snapshots — orphan snapshots referenced by a registered AMI are not reported (they cannot be deleted anyway)
  • Conservative idle windows — 14 days (not 48h) for “zero activity” checks, specifically to avoid false positives on infrequent batch/DR workloads. See Honest Caveats

Tech stack

  • TypeScript (strict mode)
  • AWS SDK v3 (modular clients, built-in retry/backoff)
  • DDD Architecture (Ports & Adapters) with plugin model
  • Nx monorepo with pnpm
  • Jest for testing (unit, contract with fixture replay, e2e LocalStack)
  • esbuild for CLI bundling
  • pdfkit for PDF generation (no headless browser)
  • Commander.js for argument parsing
  • Zod for config validation