awsspectre

README

awsspectre

awsspectre — AWS resource waste auditor with cost estimates. Part of SpectreHub.

What it is

• Scans EC2, RDS, EBS, ELB, NAT Gateway, EIP, Lambda, Kinesis, Firehose, SQS, SNS, CloudFront, CloudWatch Logs, snapshots, and security groups
• Detects idle, orphaned, and oversized resources using CloudWatch metrics
• Estimates monthly waste in USD per finding
• Supports tag-based exclusions and configurable thresholds
• Outputs text, JSON, SARIF, and SpectreHub formats

What it is NOT

• Not a real-time monitor — point-in-time scanner
• Not a remediation tool — reports only, never modifies resources
• Not a security scanner — checks utilization, not vulnerabilities
• Not a billing replacement — uses embedded on-demand pricing

Quick start

Homebrew

brew tap ppiankov/tap
brew install awsspectre

From source

git clone https://github.com/ppiankov/awsspectre.git
cd awsspectre
make build

Windows

Download the awsspectre_<version>_windows_amd64.zip (or arm64) asset from the releases page, extract it, and add the folder containing awsspectre.exe to your PATH.

Usage

awsspectre scan --region us-east-1 --format json

CLI commands

Command	Description
awsspectre scan	Scan AWS account for idle and wasteful resources
awsspectre init	Generate IAM policy and config file
awsspectre version	Print version

SpectreHub integration

awsspectre feeds AWS resource waste findings into SpectreHub for unified visibility across your infrastructure.

spectrehub collect --tool awsspectre

Safety

awsspectre operates in read-only mode. It inspects and reports — never modifies, deletes, or alters your resources.

Documentation

Document	Contents
CLI Reference	Full command reference, flags, and configuration

License

MIT — see LICENSE.

---

Built by Obsta Labs