Writing Policies

💡 Don't want to write YAML? Create policies with AI instead →

SOFE policies are YAML files that define rules for your cloud resources. Here's how to write your own.

Policy Schema

apiVersion: sofe/v1          # always sofe/v1
kind: Policy                  # always Policy
metadata:
  name: my-policy-name        # unique identifier (kebab-case)
  description: "Human-readable description"
  author: [email protected]
  tags: [cost-optimization, compute]

spec:
  scope:                       # WHAT resources to check
    resource_types: [aws.ec2]  # one or more collector types
    regions: ["*"]             # or specific: [us-east-1, eu-west-1]
    accounts: ["*"]            # or specific account IDs
    environments: ["*"]        # filter by tag:Environment

  rule:                        # WHEN to flag a violation
    metric: avg_cpu_utilization  # metric from collector
    period: 30d                  # evaluation window (optional)
    operator: "<"                # <, >, ==, !=, <=, >=
    threshold: 5                 # numeric value

  severity: high               # critical | high | medium | low | info

  actions:                     # WHAT to do on violation
    - type: finding            # always include (produces output)
    - type: recommend
      suggestion: "Rightsize or terminate"
      estimated_savings: calc  # engine calculates savings

Available Metrics (by Collector)

CollectorMetrics
aws.ec2avg_cpu_utilization, monthly_cost, running_days, has_tag:*
aws.s3monthly_cost, has_lifecycle_rules, encryption_enabled, has_tag:*
aws.rdsavg_connections, monthly_cost, has_tag:*
aws.ebsattached, monthly_cost, snapshot_age_days
aws.elbhas_targets, waf_enabled, monthly_cost
aws.natgatewaymonthly_cost
aws.dynamodbprovisioned_utilization_percent, monthly_cost
aws.sagemakerinvocations_per_day, monthly_cost
aws.secretsmanagerrotation_enabled
aws.cloudfrontcompression_enabled, monthly_cost
aws.apigatewaythrottle_configured, monthly_cost
aws.ecsavg_cpu_utilization, running_count

Examples

Tag governance
spec:
  scope: { resource_types: ["*"] }
  rule: { metric: "has_tag:costCenter", operator: "==", threshold: 0 }
  severity: medium
Budget alert
spec:
  scope: { resource_types: ["*"] }
  rule: { metric: budget_utilization_percent, operator: ">", threshold: 80 }
  severity: critical
Idle load balancer
spec:
  scope: { resource_types: [aws.elb] }
  rule: { metric: has_targets, operator: "==", threshold: 0 }
  severity: medium
  actions:
    - type: finding
    - type: recommend
      suggestion: "Delete this idle LB — no targets registered"

Validate Your Policy

sofe validate --policies ./my-policies/
← Getting StartedNext: Developing Collectors →