Metadata-Version: 2.4
Name: ratefence
Version: 0.2.0
Summary: Read-only AWS cost-findings CLI: scan for savings, generate Terraform/CloudFormation fixes, export evidence.
Project-URL: Homepage, https://github.com/easyharshmods/ratefence-cli
Project-URL: Documentation, https://github.com/easyharshmods/ratefence-cli#readme
Project-URL: Issues, https://github.com/easyharshmods/ratefence-cli/issues
Project-URL: Schema, https://github.com/easyharshmods/ratefence-cli/blob/main/SCHEMA.md
Author: Harshwardhan Choudhary
License-Expression: Apache-2.0
License-File: LICENSE
License-File: NOTICE
Keywords: aws,cloud,cloudformation,cost,finops,savings,terraform
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.11
Requires-Dist: boto3>=1.34
Requires-Dist: rich>=13.7
Requires-Dist: typer>=0.15
Provides-Extra: dev
Requires-Dist: jsonschema; extra == 'dev'
Requires-Dist: moto[all]; extra == 'dev'
Requires-Dist: mypy; extra == 'dev'
Requires-Dist: pytest; extra == 'dev'
Requires-Dist: pytest-cov; extra == 'dev'
Requires-Dist: ruff; extra == 'dev'
Description-Content-Type: text/markdown

# ratefence

**The AWS savings execution and evidence layer.** A read-only CLI that scans
your AWS account for cost savings, renders the findings as evidence you can
share, and generates ready-to-review Terraform and CloudFormation fixes — it
never modifies your infrastructure.

<!-- badges: ci -->
<!-- badges: pypi version -->
<!-- badges: python versions -->
<!-- badges: license -->

## Install

```sh
pip install ratefence
```

or as an isolated tool:

```sh
uv tool install ratefence
```

## Quickstart

```sh
# Scan your account (read-only): prints a findings table and writes
# ratefence-findings.json in the current directory.
ratefence scan --profile my-profile

# Narrow a scan: specific regions, checks, or thresholds.
ratefence scan --profile my-profile --region eu-central-1 --region us-east-1
ratefence scan --all-regions --check unattached-ebs --check gp2-volumes
ratefence scan --min-confidence medium --min-savings 10 --no-aws-native

# Re-render a previous scan (most recent *findings*.json, or --input <path>)
# as a terminal table, JSON, or paste-ready markdown.
ratefence report
ratefence report --input ratefence-findings.json --format markdown

# Generate remediation snippets for the safe finding types, written to
# ./ratefence-fixes/ for YOU to review and apply. ratefence itself never
# touches your infrastructure.
ratefence diff
ratefence diff --type terraform --action rf-0123456789abcdef

# List every check with its id, description, and remediation type.
ratefence checks
```

`rf` is a short alias for `ratefence` — `rf scan`, `rf report`, `rf diff`.

## Checks

ratefence ships 11 proprietary read-only checks (`ratefence checks` lists the
same catalog):

| Check id | Check | What it finds |
|---|---|---|
| `unattached-ebs` | Unattached EBS volumes | Volumes attached to nothing, still billing every month. |
| `gp2-volumes` | gp2 → gp3 candidates | gp2 volumes that migrate to cheaper gp3 with no downtime. |
| `aged-snapshots` | Aged EBS snapshots | Old snapshots accumulating storage cost long past their usefulness. |
| `idle-nat-gateway` | Idle NAT gateways | NAT gateways with little to no traffic (CloudWatch `BytesOutToDestination`). |
| `s3-lifecycle` | S3 buckets missing lifecycle rules | Buckets with no lifecycle policy to expire or tier down objects. |
| `stopped-ec2` | Stopped EC2 still billing EBS | Stopped instances whose attached volumes keep billing. |
| `unused-eip` | Unused Elastic IPs | Allocated EIPs not associated with anything, billed hourly. |
| `prev-gen-instances` | Previous-generation instance families | Instances on old families with cheaper, faster modern equivalents. |
| `idle-rds` | Idle RDS | Database instances with no connections over 14 days (CloudWatch). |
| `lambda-memory` | Oversized Lambda memory | Functions whose duration profile doesn't justify their memory setting. |
| `log-retention` | CloudWatch log groups without retention | Log groups keeping logs forever by default. |

On top of the proprietary checks, `scan` also ingests AWS-native
recommendations from **Cost Optimization Hub** and **Compute Optimizer** where
available. When an AWS recommendation targets the same resource as a ratefence
finding, the findings are deduplicated: the ratefence finding wins and the AWS
savings estimate is preserved in its `details` (see [SCHEMA.md](SCHEMA.md)).

## Safety: strictly read-only

- ratefence only calls AWS `Describe*` / `List*` / `Get*` APIs.
- It runs with **your own** AWS credentials/profile — nothing is delegated.
- No SaaS calls, no telemetry, no data leaves your machine.
- It **never modifies infrastructure**. The output of `ratefence diff` is
  Terraform/CloudFormation for *you* to review and apply through your own
  change process.

## Findings schema

`ratefence scan` exports `ratefence-findings.json` conforming to a versioned,
stable public contract documented in [SCHEMA.md](SCHEMA.md). Every finding
carries a **stable `action_id`** — a deterministic hash of account + check +
resource — so downstream tooling can track a finding's lifecycle
(new / still-open / resolved) across scans.

## Savings estimates

Estimated savings use static list-price assumptions. Treat them as
**directional, not billing-exact** — they tell you where to look, not what
your invoice will change by.

## Requirements

- Python ≥ 3.11
- AWS credentials (profile, environment, or SSO) with read-only access

## License

Apache-2.0
