Compliance Findings Beside Your Cloud Cost Data

Compliance recommendations flag configuration that falls short of a best practice: no encryption, public access, missing MFA, no backup. They sit in the same list as cost findings because the same inventory and the same owners handle both, but they are written differently. A compliance finding carries no saving, and its text is prose rather than a “resize” or “delete” headline, because there is no single action to lead with.

Every finding reads one authoritative field

The rules were rebuilt to read the flag the cloud control plane actually reports, not a customer tag that might say anything. They fail closed: if the field is absent, the rule stays silent rather than guessing. Some examples of the field behind a finding:

• RDS Instance Publicly Accessible reads the instance’s publicly-accessible flag.
• S3 Bucket With Public Access Enabled reads the four Block Public Access settings. It proves the guardrail is incomplete, not that objects are actually exposed, and says so.
• IAM User Without MFA Enabled fires only for users with console access, so automation users do not add noise.
• GCP Cloud SQL Instance Has Public IP Enabled reads the instance’s IPv4 setting.
• Azure NSG Open to Internet is raised at critical severity when SSH or RDP is reachable from the internet.

Where compliance meets cost

A few compliance rules protect money rather than data. EKS Cluster Autoscaling Not Configured and ASG Has No Scaling Policies point to capacity that cannot shrink. RDS Instance Not Using Multi-AZ deliberately stays silent on instances tagged or named as dev/test, so it never pushes a production-grade setting onto a test box. GCP VM Deletion Protection Disabled and Azure VM Missing Deletion Protection guard against accidental removal.

Acting on compliance findings

Most compliance findings are advisory and come with numbered “How to Fix” steps and a console link. They can be ticketed to Jira from the recommendation drawer, and a verified fix is detected by re-reading the exact field the finding fired on, not by the rule simply going quiet. Posture-specific areas have their own pages: security findings and reliability findings, and the combined view is covered in security and cost.

By cloud

AWS compliance, GCP compliance and Azure compliance.

Every compliance check ZopNight runs has its own page, with the reason it fires and the fix: see the compliance checks in the ZopNight rule catalogue.