Shift-Left FinOps
Catch cost and governance issues BEFORE deployment — not after your bill arrives.
The Problem
Traditional FinOps is reactive: deploy → get bill → discover waste → fix. By then, you've already paid for the mistake. The average enterprise wastes 30% of cloud spend on resources that should never have been deployed.
Shift-Left: Prevent > Detect > Fix
Traditional (Right): Code → Deploy → Run for days → Bill arrives → "Why is this $500?" Shift-Left (SOFE approach): Code → PR → SOFE scan → "This will cost $500/mo, missing owner tag, oversized for staging" → Fix BEFORE deploy Same policies work at BOTH stages: ├── Pre-deploy: sofe evaluate --terraform ./infra/ (coming soon) └── Post-deploy: sofe evaluate --cloud (live scan)
How SOFE Enables Shift-Left
1. CI/CD Gate (Today ✅)
Add SOFE to your GitHub Actions pipeline. If high-severity findings exist → PR is blocked.
- uses: breakingthecloud/sofe-action@v1
with:
api-key: ${{ secrets.SOFE_API_KEY }}
fail-on: high # Block PR if high/critical findings2. Post-Deploy Continuous Scan (Today ✅)
Scheduled evaluations every 6h catch drift and new resources that violate policies.
3. Terraform Pre-Deploy Scan (Coming Soon)
Scan .tf files or tfplan.json BEFORE terraform apply. Same policies, different input source. One set of rules governs both planning and production.
SOFE vs Competitors
| Feature | SOFE | Infracost | Cloud Custodian |
|---|---|---|---|
| Pre-deploy scan | Coming (same policies!) | ✅ (cost only) | ❌ |
| Post-deploy scan | ✅ | ❌ | ✅ |
| Policy-as-code | ✅ YAML | JSON | YAML |
| AI Explain | ✅ | ❌ | ❌ |
| Remediation commands | ✅ | ❌ | ✅ (auto-execute) |
| Open source | ✅ Apache 2.0 | ✅ | ✅ |
SOFE's advantage: Same policies work pre AND post deploy. Write once, enforce everywhere. Plus AI-powered explanations no one else has.