Remediation Commands
Every finding comes with copy-paste AWS CLI commands to fix it. Risk-rated so you know what's safe to run.
How It Works
When SOFE evaluates your account, each finding is matched against a remediation command library. Commands are pre-generated with YOUR resource IDs and regions — ready to copy and execute.
Where to Find It
- /history → Click evaluation → Finding card → "🛠️ View Remediation"
- /topology → Click node → Finding in sidebar → "🛠️ Remediation"
- CLI (coming v0.3.0):
sofe remediate <eval-id> --finding 0
Risk Levels
lowSafe to run. Non-destructive. Can be reversed easily. Examples: add tags, enable encryption.
mediumReview first. May cause brief downtime or change behavior. Examples: rightsize instance (stop→modify→start), add lifecycle rules.
highDestructive. May cause data loss or service disruption. Examples: terminate instance, delete volume, delete NAT Gateway.
Example
Finding:
require-cost-tags → htmlpruebaAdd owner taglow
aws resourcegroupstaggingapi tag-resources \ --resource-arn-list arn:aws:lambda:us-east-1:279...:function:htmlprueba \ --tags owner=TEAM_NAME --region us-east-1
⚠️ Replace TEAM_NAME with the responsible team. Non-destructive.
Policies with Remediation Commands
12 of 20 built-in policies have remediation commands:
no-idle-ec2 (stop/terminate)
no-idle-rds (stop/delete)
no-unattached-ebs (snapshot+delete)
no-old-snapshots (delete)
require-cost-tags (add tags)
s3-require-environment-tag (tag)
s3-encryption-required (enable SSE)
s3-lifecycle-required (add lifecycle)
idle-load-balancer (delete)
nat-gateway-high-cost (delete)
no-oversized-staging (rightsize)
budget-exceeded (create budget)
⚠️ Safety First
Always verify before running high-risk commands in production. Check dependencies, confirm backups exist, and consider running in staging first. SOFE shows you WHAT to do — the decision to execute is YOURS.