Outcome
By the end of this lesson, you will be able to categorize any finding into the right one of 11 rule categories, predict the rule’s typical severity and remediation path, and prioritize categories by savings impact.
| Prerequisites | T1.M1.1 (recommendations basics) |
| Time | 9 minutes |
1. Concept
There are 684 rules, and each one belongs to exactly one category.
Learn the categories and you stop needing to learn the rules. The category tells you how a rule behaves, whether it is allowed to report a saving of $0, and how it should be acted on.
It is the difference between 684 things you do not know and eleven you do.
CATEGORY COST-DRIVEN WHAT IT CATCHES EXAMPLES─────────────────────────────────────────────────────────────────────────────idle yes Running or provisioned RC-001 stopped EC2 with but not used attached storage still billing RC-010 idle Lambda RC-012 idle load balancerrightsizing yes Over-provisioned for the RC-003 EC2 rightsizing measured load (absorbs the retired RC-004 and RC-006) RC-020 gp2 to gp3schedule yes Better served by a RC-093 EC2 off-hours recurring on/off window RC-110 GCP VM non-prod than by one action RC-213 Azure VM non-prodorphan yes Detached leftovers that RC-002 unattached EBS still bill RC-021 orphan snapshot RC-016 unassociated EIPdiscount yes Commitment or spot RC-014 reserved EC2 opportunity on proven RC-091 compute savings plan steady demand RC-097 spot candidatecompliance no Configuration below a RC-005 RDS single-AZ documented bar RC-084 open security groupgovernance no Attribution hygiene Missing cost-allocation tags on Databricks clusters, warehouses, jobsperformance no Throughput or latency RC-156 Lambda timeout too headroom, not dollars high RC-188 burstable EC2 out of CPU creditsreliability no Risk to availability or RC-1703 EKS Deployment with recoverability no limits setsecurity no Exposed or unencrypted RC-1615 Bedrock guardrail setting without PII protection RC-1321 storage without a customer-managed keyadvisory no Guidance that deliberately Unused Bedrock guardrails, carries no dollar figure unused internet gateways─────────────────────────────────────────────────────────────────────────────Those eleven are the values the live rules emit from Category(), which is a free string rather than a fixed list. At the time of writing the registry splits like this: reliability 132, compliance 124, rightsizing 115, idle 75, governance 59, orphan 53, security 50, discount 29, schedule 26, advisory 12, performance 9 (684 in all).
reliabilityis the largest category. The K8s workload rules (no limits set, single replica, failed jobs, degraded DaemonSets) emit it, and so do many availability and backup posture rules.securitycovers exposed or unencrypted settings: Bedrock guardrail gaps (RC-1615, RC-1630), Vertex AI Workbench notebook exposure (RC-1236, RC-1237), and storage accounts without a customer-managed key (RC-1321).advisoryappears on rules that deliberately carry no dollar figure.
Do not memorise per-category rule counts, though: rules move between categories as their lever changes, and several were recategorised into schedule when the change they call for became a recurring off-hours window rather than a one-shot stop.
The cost-driven column is the load-bearing part. A cost-driven finding must carry a real dollar figure or the rule abstains, and an idle, rightsizing, discount or schedule finding under $5 is dropped by the low-savings suppressor. Orphan is exempt from that floor: a leaked resource stays actionable at any amount, including $0. That is why a genuine posture finding is deliberately filed under a non-cost-driven category: it is allowed to be worth $0 and still reach you. A rule that filed a $0 posture finding under idle would simply vanish.
Two rule families sit alongside this taxonomy and get their own modules later in the track: the autoscaler rules (RC-ASC-001 to 006, of which 004, 005 and 006 are registered only on Azure) and the AI and ML family in the RC-16xx range, which is 33 rules split between Bedrock (RC-1601 to 1610, plus 1615 and 1630 to 1634) and SageMaker (RC-1611 to 1614 and 1616 to 1628).
How the categories map to action
Each category has a default action: what ZopNight recommends doing about the finding:
CATEGORY DEFAULT ACTION AUTO-REMEDIATION?─────────────────────────────────────────────────────────────────────────────idle Recurring off-hours schedule, Never as a one-shot stop or delete if unusedrightsizing Downsize Yes, for allowlisted resize rules (otherwise planned change)schedule Attach to schedule Yes, via group attachorphan Delete Yes, for allowlisted rulescompliance Configure missing setting No (planned change)discount Commit / restructure No (procurement decision)performance Tune the setting No (planned change)governance Apply tag (Smart Tags) Yes (Apply to cloud)security Fix the exposed setting No (PR required)reliability Fix the availability gap No (planned change)advisory Read and decide No (nothing to apply)The default actions are conservative, and starting with them is the right move.
Why this categorization
The 11 categories aren’t arbitrary; they reflect the different kinds of waste + the different kinds of response:
COST-RECOVERY categories (direct $ savings): idle → stop or delete things not being used rightsizing → make things smaller orphan → delete leftovers schedule → stop during off-hours discount → commit for better prices
QUALITY categories (cost-adjacent; mostly engineering hygiene): compliance → fix policy violations (some cost, some risk) performance → fix throughput/latency headroom, not dollars governance → fix tag hygiene (enables better cost reporting) security → fix exposed settings (cost-adjacent: incidents cost) reliability → fix availability and recovery gaps advisory → guidance with no dollar figure attachedCost-recovery categories deliver immediate $ savings. Quality categories pay back via avoided incidents, better reporting, audit-readiness.
Typical savings distribution
A mid-size estate (~$500K/mo cloud spend) can look like the shape below. Treat the figures as illustrative, not as a benchmark: they are here to show the distribution, which is what stays true, rather than the amounts, which depend entirely on the estate.
CATEGORY FINDINGS SAVINGS POTENTIAL % OF TOTAL─────────────────────────────────────────────────────────────────idle 47 $14,800/mo ~49%rightsizing 62 $9,420/mo ~31%schedule 156 (actioned via T1) n/aorphan 183 $1,940/mo ~6%compliance 54 $0 (posture debt) n/adiscount 8 $4,200/mo ~14%performance 6 $0 (headroom) n/asecurity 9 $0 (security debt) n/agovernance 71 $0 (tag debt) n/a─────────────────────────────────────────────────────────────────TOTAL ACTIONABLE $30,360/mo (~6% of spend)The biggest savings live in idle + rightsizing + discount. These three categories typically account for 80%+ of recoverable savings.
Reading the category breakdown
The category view in ZopNight Recommendations is the strategic dashboard:
WHAT TO ASK PER CATEGORY:
idle: How many resources? What's the average idle age? What's blocking action (data preservation, approval)?
rightsizing: Which families are most over-provisioned? What's the typical cost-reduction per right-size?
schedule: Are these resources already in groups? Why aren't existing schedules catching them?
orphan: How old? Cleanup safe? Who owns? (often nobody: that's the issue)
discount: What's the commitment opportunity? Coverage / utilization data points to decision
compliance / performance / governance / security: These are debts; address by quarter Don't expect direct $ savingsThe category-level view shapes the strategic conversation. Per-resource action follows.
Priority sequence: engineering teams
WEEK 1-2: idle + orphan Biggest wins; lowest risk Auto-remediation candidates for allowlisted rules
WEEK 3-4: schedule Already actionable via T1 schedules Tag-driven group attachment
MONTH 2: rightsizing Plan changes per workload Production: maintenance window required
MONTH 2-3: discount Procurement decision; multi-stakeholder Decision in Track 5 (FinOps Mastery)
MONTH 3+: compliance + governance + security Quality debts; address by quarter No direct $ savings; long-term postureThe sequence matches the typical impact-vs-risk gradient.
2. Demo
A real findings report from a mid-size estate (Q1 2026):
ORG: 50-engineer SaaS, $400K/mo cloud spend
CATEGORY FINDINGS SAVINGS POTENTIAL ACTIONED IN Q1────────────────────────────────────────────────────────────────────idle 47 $14,800/mo 41 of 47 (87%)rightsizing 62 $9,420/mo 38 of 62 (61%)schedule 156 (T1-handled) 142 of 156 (91%)orphan 183 $1,940/mo 178 of 183 (97%)compliance 54 $0 (posture) 41 of 54 (76%)discount 8 $4,200/mo 5 of 8 (RIs purchased)performance 6 $0 (headroom) 4 of 6 (67%)security 9 $0 (security) 7 of 9 (78%)governance 71 $0 (tags) 68 of 71 (96%)────────────────────────────────────────────────────────────────────TOTAL 596 findings
Q1 SAVINGS REALIZED: $28,400/mo recurring = ~$340K/yr% of total cloud spend: 7% reduction
ACTION RATE by category: Highest action rate: orphan, schedule, governance (>90%) (low-risk; easy actions) Mid action rate: idle, rightsizing, discount (61-87%) (require investigation + decision) Lower action rate: compliance, performance, security (67-78%) (K8s posture findings need a PR; multi-team coordination)The pattern is repeatable. The first 6 weeks usually capture 70-80% of the available savings; the next quarter cleans up the remainder.
3. Hands-on (5 min)
Open ZopNight Recommendations:
□ STEP 1: Filter by each category idle: ___ findings savings: $_____/mo rightsizing: ___ findings savings: $_____/mo schedule: ___ findings savings: $_____/mo orphan: ___ findings savings: $_____/mo compliance: ___ findings savings: $_____ (often $0) discount: ___ findings savings: $_____/mo performance: ___ findings savings: $_____ (often $0) security: ___ findings savings: $_____ (often $0) governance: ___ findings savings: $_____ (often $0) reliability: ___ findings savings: $_____ (often $0)
□ STEP 2: Identify top 3 by absolute savings 1. __________ savings: $_____/mo 2. __________ savings: $_____/mo 3. __________ savings: $_____/mo
□ STEP 3: Sanity-check Total actionable savings: $_____/mo % of monthly cloud spend: _____ % (Typical range: 3-15%)
□ STEP 4: Plan first action Pick: category with highest savings + lowest risk Owner: __________ Date: __________A 15-minute scan reveals the strategic picture. The biggest finding usually surprises someone.
Ask for it instead. The same task you just did in the console, asked in one sentence.
BEFORE A ZopNight account with one cloud connected. Discovery finished, so rules have something to fire on.ASK "How many recommendation rules do we have, by provider and category, and which are firing?"CHECK the categories against the eleven you just read. A category with zero firings is usually a permission gap, not a clean estate.Tools behind it: count_recommendation_rules (read, Explore), get_recommendation_rules (read, Optimize), get_recommendation_filters (read, Optimize). Connection details are in the MCP integration docs.
4. Knowledge check
Q1
A rule fires on a stopped EC2 instance whose attached EBS volume is still billing. Which category?
A. orphan
B. idle
C. rightsizing
D. discount
Show answer
Correct: B. Idle. RC-001 owns stopped EC2 and prices only the residual that still bills (attached EBS and EIP). With nothing attached billing, the rule abstains, because a stopped instance bills no compute. Orphan is for detached leftovers, such as an unattached volume.
Q2
A K8s deployment without resources.limits set. The rule catalog files it under its “Reliability Rules” heading. Which category does the recommendation carry?
A. reliability
B. idle
C. security
D. compliance
Show answer
Correct: A. The K8s no-limits rule returns reliability from Category(). It is a real category value and the largest one (132 rules). A workload with no limits can be evicted under node pressure, which is an availability risk, not a cost or exposure finding.
Q3
Rules whose fix is a recurring on/off window rather than a one-shot stop belong to which category?
A. compliance
B. discount
C. schedule
D. orphan
Show answer
Correct: C. Schedule. Giving these rules their own category made scheduling-driven recommendations a first-class filter. Examples: resources that fit dev/test schedule patterns; resources currently always-on that should follow schedule.
5. Apply
Recommendations → filter by category. Each category has its own savings rollup. Sort by impact; act on top items.
For your team: schedule a quarterly category review. Most teams capture 70-80% of savings in the first 6 weeks; the rest over the following quarter.
Related lessons
- L2: Severity ladder (next)
- L3: Rule interface
- L4: Pricing model
- L5: Reading a recommendation card
- M2.3: Auto-remediation
Glossary terms touched
Rule category · Recommendation card