Frequently Asked Questions

SOFE (Stairway Open FinOps Engine) is an open-source policy engine that scans your AWS infrastructure for cost waste, security gaps, and governance violations. It uses 18 collectors to gather metrics from your AWS resources and evaluates them against 36 pre-built policies. It's free to self-host (Apache 2.0).

Run: pip install sofe && sofe evaluate --profile your-aws-profile. That's it. For Docker: docker pull ghcr.io/breakingthecloud/sofe-community:0.3.0. For the Go CLI: curl -fsSL https://sofe.dev/install.sh | sh

Self-hosted is completely free forever (Apache 2.0 license). The SaaS platform (platform.sofe.dev) has a free tier with 10 evaluations/day and a Developer Program with 50 credits/month. Pro is S/89.99/month for unlimited use.

18 services: EC2, Lambda, S3, RDS, DynamoDB, EBS, IAM, CloudWatch, ECS, SNS, SQS, Secrets Manager, Route53, CloudFront, API Gateway, ELB, NAT Gateway, and Cost Explorer. Each collector gathers 65+ metrics.

Yes. SOFE scans Terraform plans before deployment with 6 pre-deploy policies. Use the CLI: sofe terraform --plan tfplan.json, or the GitHub Action (breakingthecloud/sofe-action@v2) in terraform mode.

Yes. SOFE supports 7 AI providers (OpenRouter, Bedrock, NVIDIA NIM, HuggingFace, OpenAI, Databricks, Huawei). Click 'Explain' on any finding to get a structured diagnosis: Why it matters, What to fix, CLI command, and Cost impact.

Yes. Policies are YAML files. You can write them manually or use natural language: describe what you want in English and SOFE generates the YAML policy for you.

Yes. The GitHub Action (sofe-action@v2) supports two modes: cloud mode (evaluates live AWS) and terraform mode (scans tfplan.json). Use --fail-on high to block PRs with critical findings.

Infracost estimates costs from Terraform plans (before deploy). SOFE scans live AWS resources (after deploy) with real Cost Explorer data. SOFE also has policy enforcement, AI explanations, architecture analysis (blast radius, SPOFs), and remediation commands. Both can be used together.

Yes. SOFE is used in production with real AWS accounts. The engine is at v0.3.0 (PyPI), the CLI at v0.6.1 (goreleaser), and the Docker image at 0.3.0 (multi-arch). All are Apache 2.0 licensed.

Deploy a CloudFormation stack that creates a read-only IAM role (SOFEReadOnlyRole). SOFE uses STS AssumeRole with ExternalId — your credentials never leave your account. One-click setup at platform.sofe.dev/accounts.

Yes. Free tier supports 1 connected account, Pro supports 5. Each account gets its own CloudFormation role. The platform shows findings per account with an alias.