# Recommendations

> How ZopNight finds waste, what each finding includes, and how to act on it.

Source: https://zop.dev/docs/zopnight/optimization/recommendations

---

Recommendations are the output of ZopNight's audit engine; concrete, evidence-backed findings that point at specific resources costing more than they should. Each one is a single rule firing against a single resource, with the math, the evidence, and the suggested action all on the card.

![Recommendations list view showing 778 open findings totaling $19.1K potential savings, with anomalies detected and per-resource cards](https://storage.googleapis.com/zopdev-blog-resources/1/files/originals/20260602/a643bdad-ad1f-4aad-8c77-0b9330d8c38a-zopnightrecommendations.png)

*Recommendations page; open findings across the estate with savings, category, and resource detail. Filterable by status, provider, category, severity, and account.*

## How recommendations work

A cron job evaluates every audit rule against every resource on a schedule. Findings land in the database. The Recommendations page reads from the database; no recomputation per pageview, no slow lookups.

This matters because the rules are not cheap. Some rules need 90 days of CloudWatch / Cloud Monitoring / Azure Monitor data, or a billing-history join, or both. Doing that work at request time would make the page unusable. Doing it once a day, in batches, and storing the results makes the page instant.

**Note**

Findings are deduplicated by `(rule, resource)`; if the same rule keeps firing on the same resource across daily runs, you see one card whose evidence updates, not a new card every day.

## What's on a recommendation card

Every card has the same shape regardless of which rule fired.

| Field | What it is |
|---|---|
| **Title** | One-line description of the finding (e.g. "EC2 instance underutilised for 14 days") |
| **Resource** | The cloud resource the rule fired on, with cloud account and region |
| **Current cost** | Monthly cost of the resource as it sits today |
| **Optimised cost** | What the cost becomes if you apply the suggested change |
| **Potential savings** | The delta. ZopNight uses real billing data when available, rack rate otherwise |
| **Evidence** | The metric values that triggered the rule (CloudWatch averages, idle hours, etc.) |
| **Severity** | Critical / High / Medium / Low; based on savings size and category |
| **Action** | Suggested fix. Some actions are one-click via Auto-remediation; others are advisory |

## Categories

Recommendations fall into eight categories, plus the Autoscaler and Databricks rule families. See [Recommendation rules](https://zop.dev/docs/zopnight/optimization/recommendation-rules) for the full catalogue grouped by category.

**Idle**

    Resources running but doing no useful work; zero invocations, no connections, no CPU. The biggest single source of waste in most accounts.

**Rightsizing**

    Resources sized for headroom they never use. Smaller instance type, same workload, lower bill.

**Schedule**

    Resources running 24×7 that have a clear off-hours usage pattern. Candidates for ZopNight's start/stop scheduling.

**Discount**

    Reserved Instance, Savings Plan, and Committed Use opportunities; places where steady usage justifies a discount commitment.

**Orphan**

    Resources no longer attached to anything that needs them; unattached EBS volumes, unassigned Elastic IPs, released PVs.

**Compliance**

    Configuration drift from best practice; missing lifecycle policies, no logging retention, deprecated runtimes.

**Security**

    Risky configurations with cost or operational implications; public S3 buckets, wildcard IAM, privileged containers.

**Reliability**

    Production-shape issues that cause incidents and re-work; single-replica deployments, missing requests/limits, no HPA.

## Filters

The Recommendations page supports cascading filters:

- **Status**: Open, Applied, Dismissed, Optimised
- **Provider**: AWS, GCP, Azure
- **Category**: see above
- **Resource type**: comma-separated multi-select
- **Severity**: Critical, High, Medium, Low
- **Cloud account**: multi-select
- **Search**: matches title, resource name, resource UID

Selecting a provider narrows the available categories, severities, types, and accounts to what that provider actually has. The dropdowns never offer dead ends.

## Acting on a recommendation

There are three things you can do with any open recommendation:

**Apply the suggested change (Remediate)**

  For 124 rules (28 one-click, 96 guided), ZopNight can run the change for you. Opens a wizard that previews the change, asks for approval if the action is destructive, runs the cloud API call, and validates the result. See [Auto-remediation](https://zop.dev/docs/zopnight/optimization/auto-remediation).

**Apply it yourself, then mark Applied**

  For advisory rules (cases where ZopNight should not run cloud-side mutations on your behalf), the card shows a numbered "How to fix" playbook. After you've done the work in your cloud console or via Terraform, mark the recommendation Applied so it drops off the Open list.

**Dismiss it**

  Sometimes a recommendation doesn't apply; the resource has a reason to be over-provisioned, or it's about to be deleted anyway. Dismiss the recommendation with a reason. Dismissed recommendations don't reappear on the next cron run.

## Where recommendations show up

Beyond the dedicated Recommendations page, findings surface in several places:

- **Resource detail drawer**: "Recommendations" tab lists every open rec for that resource
- **Cost Flow Sankey**: hovering a node shows a "$X reclaimable" callout when the dimension matches a recommendation filter (resource type, cloud account)
- **Dashboard**: the Recommendations widget shows top findings by savings
- **MCP server**: the AI Assistant can list and filter recommendations through 43 read-only tools

## Why a recommendation might not show up

A few reasons a finding you expect to see isn't there:

- **The cron hasn't run yet.** Recommendations are computed daily. A freshly connected cloud account will see its first batch after the next run.
- **Metrics aren't flowing.** Rules that need CloudWatch / Cloud Monitoring / Azure Monitor data can't fire without the right IAM permissions. Check [Cloud permissions](https://zop.dev/docs/zopnight/cloud-setup/permissions) and the metric coverage endpoint.
- **Pricing data is missing.** If a rule needs to compute savings but the underlying SKU isn't in the pricing cache, the rule goes to the pricing-gap dead-letter queue so the gap is observable. Ask support to backfill.
- **The rule was dismissed previously.** Dismissed findings don't reappear unless you reopen them. Check the **Dismissed** tab.

## Exporting recommendations

You can export the filtered Recommendations list to CSV for sharing with finance or the platform team. The export runs as a background job; your browser doesn't have to stay open. ZopNight notifies you with a signed download link when the file is ready.

Recommendation exports are persisted in a jobs table, so a crashed export shows up as a Failed row (with reason) rather than disappearing silently. Re-trigger from the UI to retry.