Open SourceApache 2.0GitHub Stars

FinOps Policies as Code

Define cloud cost policies in YAML. Evaluate against real AWS accounts. Get actionable findings. No AI required — deterministic by default.

Get Started (Free)Star on GitHub
pip install sofe•go install github.com/breakingthecloud/sofe-cli@latest
v0.3.0•18 collectors•36 policies•Python + Go CLI + Docker
sofe eval

Built with

500+
GitHub Stars
10k+
PyPI Downloads
18
AWS Collectors
36
Built-in Policies

What is SOFE?

Policies as YAML

Define FinOps rules in version-controlled YAML files. What to check, thresholds, severity, and actions — all declarative.

AWS Collectors

18 collectors that read real data from your AWS accounts. Costs, resources, usage, tags — everything needed to evaluate policies.

Deterministic Engine

No AI, no LLMs, no surprises. Policies evaluate to pass/fail with evidence. Reproducible, auditable, fast.

How it works

From AWS account to actionable findings — the entire SOFE pipeline in one flow.

AWS Account
18 Collectors
Policy Engine
Actionable Findings
Remediation
# policy: check for untagged resources
apiVersion: sofe/v1
kind: Policy
metadata:
  name: require-cost-center-tag
  severity: high
spec:
  collector: aws.resource-tags
  condition:
    missing_tag: "CostCenter"
  action:
    type: finding
    message: "Resource missing CostCenter tag"

Features

18 AWS Collectors

EC2, RDS, S3, EBS, Lambda, ECS, EKS, ElastiCache, DynamoDB, CloudFront, API Gateway, NAT Gateway, ELB, Cost Explorer, and more

20 Built-in Policies

Idle resources, missing tags, oversized instances, budget thresholds, security gaps

Go CLI

sofe-cli binary — evaluate policies from terminal, CI/CD, or cron

FastAPI Server

REST API for evaluations — integrate with dashboards, Slack, or custom tools

Catalog UI

Browse collectors, policies, and findings visually in your browser

PyPI Package

pip install sofe — use as a library in your own Python scripts

Part of the ecosystem

SOFE is the deterministic engine. Combine with FinOptix for AI reasoning, or BYaML for architecture governance.

SOFE
sofe.dev

Policy engine. Collects data, evaluates rules, produces findings. Deterministic.

← You are here
FinOptix
finoptix.dev

AI reasoning layer. Explains costs, generates recommendations, runs investigations.

AI-powered →
BYaML
byaml.org

Architecture protocol. Defines what's deployed, validates structure, maps costs.

Schema →

SOFE in action

CLI scans your AWS account. Platform visualizes findings. Both open source.

sofe eval —profile prod
$ sofe eval --profile prod
⚡ Scanning 63 resources...
✓ aws.ec2 14 instances
✓ aws.lambda 21 functions
✓ aws.s3 8 buckets
🔍 135 findings (12 high, 87 medium, 36 low)
💰 $47.23/mo potential savings
● require-cost-tags 46 resources
● lambda-runtime-deprecated 6 functions
platform.sofe.dev — Findings
Findings Overview12 high
12
High
87
Medium
36
Low
Untagged Resources
46
Idle EC2 Instances
12
Deprecated Lambda Runtime
6

Use Cases

Real scenarios where SOFE saves you money and enforces governance.

Find Idle EC2

Detect instances with <5% CPU for 30+ days. Estimate monthly savings from termination or rightsizing.

$340/mo avg

Enforce Tagging

Find resources missing owner, env, or costCenter tags. Block deployments without required tags.

Governance

CI/CD Cost Gate

Block PRs that would create expensive untagged resources. Fail pipelines on critical findings.

Prevention

Multi-Account

Scan all org accounts from one place. Compare findings across dev/staging/prod environments.

Visibility

Trusted by FinOps teams

What engineers say about using SOFE in production.

🇵🇪"

SOFE caught $2,300/mo in idle EC2 instances we didn't know we had. The YAML policies are dead simple — our DevOps team wrote 3 custom policies in 10 minutes.

Luis M.
Cloud Engineer at a fintech startup
🇺🇸"

We were about to buy a $2K/mo CloudHealth license. SOFE does everything we needed for $0. The multi-account scan from one CLI command is a game changer.

Ana R.
SRE at a Series B company
🇵🇪"

Ser partners de AWS y tener una herramienta open-source como SOFE nos permite ofrecer auditorías rápidas sin depender de licencias caras. Nuestros clientes quedan impresionados con la claridad de los hallazgos.

Equipo de Infraestructura
AWS Partner — Lima, Perú
🇵🇪"

Implementamos SOFE como gate en nuestros pipelines de CI/CD. Cada PR que levanta recursos pasa una evaluación automática. Si hay algún drift de costos o seguridad, el build falla antes de llegar a producción. Zero sorpresas en la factura de AWS.

Carlos Cortez
Founder, BreakingTheCloud — Lima, Perú
Leave feedback

How SOFE Compares

Open source, self-hostable, policy-first approach to FinOps.

FeatureSOFEInfracostKubecostCloudHealth
Open Source✅Partial✅❌
Self-Hosted✅✅✅❌
SaaS Option✅✅✅✅
Policy Engine✅❌❌❌
Custom Policies (YAML)✅❌❌Limited
CLI✅✅❌❌
GitHub Action✅✅❌❌
Docker✅✅✅❌
Free TierUnlimited*LimitedLimited❌
AWS Native✅IaC onlyK8s only✅

* Self-hosted = unlimited. Cloud free tier = 10 evaluations/day.

Quick Start

1. Install
pip install sofe
2. Evaluate policies against your AWS account
from sofe import PolicyEngine

engine = PolicyEngine()
engine.load_policies("./policies/")
findings = engine.evaluate(profile="default")

for f in findings:
    print(f"{f.severity}: {f.message}")
3. Or use the CLI
# Install Go CLI
go install github.com/breakingthecloud/sofe-cli@latest

# Run evaluation
sofe eval --profile default --policies ./policies/
sofe serve --port 8080  # Start API server

Browse the catalog

Explore all 18 collectors, 36 policies, and see what SOFE can check in your infrastructure.

View on GitHubPyPI Package