GreenOps Scan is a free command-line tool that finds idle and over-provisioned AWS resources using read-only APIs. It runs entirely on your machine and reports estimated cost and carbon savings — no account, no credit card, no data leaving your laptop.
On one real account, a sample scan surfaced 130 issues and approximately $2,209/month in estimated savings opportunities. Results vary by account — review every finding before acting.
Run a local scan against your AWS profile. No data leaves your laptop — you get a ranked list of waste, the dollars behind it, and the carbon footprint attached. Illustrative sample output below.
ReadOnlyAccessAn unedited terminal recording of an actual scan, from profile selection to the PDF report. Account ID and resource names have been replaced with placeholders.
From install to PDF report in about a minute.
npx greenops-scan — no install, no signup, no credit card. Works with your existing AWS CLI profile.
An interactive prompt lets you choose the AWS profile and region to scan, or pass them as flags for CI.
The scanner calls read-only AWS APIs from your machine. Nothing is uploaded, and your credentials never leave your laptop.
In about 60 seconds you get a JSON file and a PDF report: every finding ranked by estimated monthly savings, with modeled carbon impact.
The scan runs as a local process using your existing AWS CLI credentials. There is no server-side agent, no relay, and no upload step.
Every API call is a read operation (Describe/List/Get). The scanner cannot create, modify, or delete any resource in your account.
Try the CLI with zero commitment. Create a GreenOps Cloud account only if you want continuous, scheduled scanning later.
Want extra peace of mind? Create a dedicated read-only AWS profile with the AWS CLI before you run the scan.
Ten AWS services, checked for the waste patterns engineers most often miss.
| EC2 | Idle instances, old-gen → Graviton upgrades, unattached EBS volumes |
| S3 | Missing lifecycle policies, version accumulation, un-tiered buckets |
| ECS | Empty clusters, over-provisioned Fargate (30-day CloudWatch validated) |
| EKS | Outdated K8s versions, non-Graviton node groups, no autoscaler |
| Lambda | Zombie functions, legacy runtimes, x86→ARM, over-provisioned memory |
| RDS | Idle databases, Graviton upgrades, Multi-AZ on non-prod, old snapshots |
| ElastiCache | Idle caches, Graviton upgrades |
| CloudFront | Unused distributions, missing HTTPS redirect, outdated TLS |
| EBS Snapshots | Old snapshots, unused AMIs |
| Bedrock | Idle provisioned throughput, unused custom models, stale agents |
| VPC Endpoints | NAT Gateway paying data fees to reach S3/DynamoDB instead of a free Gateway Endpoint |
Pass flags to skip the interactive prompts and run non-interactively in a pipeline.
| -p, --provider <name> | Cloud provider: aws (skip interactive selection) |
| --profile <name> | AWS profile name (skip interactive selection) |
| -r, --region <code> | AWS region code, e.g. eu-west-1 (skip interactive selection) |
| -s, --severity <levels> | Comma-separated severity filter: critical,high,medium,low |
| --min-cost <amount> | Minimum monthly savings amount (USD) to include |
| --endpoint-url <url> | Custom AWS endpoint (e.g. LocalStack) |
Full flag reference and how to report issues are in the GitHub README. The scanner is closed-source; the CLI is free to use.
The free CLI is great for a one-off or ad hoc check. When your team wants continuous coverage, GreenOps Cloud adds: