Outcome
By the end of this lesson, you will be able to categorize any finding into the right one of 8 rule categories, predict the rule’s typical severity and remediation path, and prioritize categories by savings impact.
| Tier | Engineer |
| JTBD | ”Understand the 450+ rule library well enough to find what matters in my estate.” |
| Personas | Platform Engineer · FinOps Lead · SRE |
| Prerequisites | T1.M1.1 (recommendations basics) |
| Time | 9 minutes |
| Bloom verb | Categorize (Apply), Predict (Apply), Prioritize (Evaluate) |
1. Concept
There are more than 450 rules, and each one belongs to exactly one category.
Learn the categories and you stop needing to learn the rules. The category tells you how a rule behaves, whether it is allowed to report a saving of $0, and how it should be acted on.
It is the difference between 450 things you do not know and eight you do.
CATEGORY COST-DRIVEN WHAT IT CATCHES EXAMPLES─────────────────────────────────────────────────────────────────────────────idle yes Running or provisioned RC-001 stopped EC2 with but not used attached storage still billing RC-010 idle Lambda RC-012 idle load balancerrightsizing yes Over-provisioned for the RC-003 EC2 rightsizing measured load (absorbs the retired RC-004 and RC-006) RC-020 gp2 to gp3schedule yes Better served by a RC-093 EC2 off-hours recurring on/off window RC-110 GCP VM non-prod than by one action RC-213 Azure VM non-prodorphan yes Detached leftovers that RC-002 unattached EBS still bill RC-021 orphan snapshot RC-016 unassociated EIPdiscount yes Commitment or spot RC-014 reserved EC2 opportunity on proven RC-091 compute savings plan steady demand RC-097 spot candidatecompliance no Configuration below a RC-005 RDS single-AZ documented bar RC-084 open security groupgovernance no Attribution hygiene Missing cost-allocation tags on Databricks clusters, warehouses, jobsperformance no Throughput or latency RC-156 Lambda timeout too headroom, not dollars high RC-188 burstable EC2 out of CPU credits─────────────────────────────────────────────────────────────────────────────Those eight are the values the Rule interface’s Category() declares. Two more appear on live rules and are worth recognising when you meet them:
securityis declared by a small number of posture rules outside the interface comment: Bedrock guardrail gaps (RC-1615, RC-1630), Vertex AI Workbench notebook exposure (RC-1236, RC-1237), and storage accounts without a customer-managed key (RC-1321). It is what those rules emit, so it appears as a filter value.advisoryappears on a handful of rules that deliberately carry no dollar figure.
The K8s workload rules are grouped in the rule catalog’s documentation under headings like “Reliability Rules” and “Security Rules” (missing CPU/memory requests, single-replica deployment, HPA pinned at max, privileged container, container as root, host network). Those headings are documentation groupings, not category values: there is no reliability category, and the K8s rules emit categories from the same eight-value contract as everything else. Do not memorise per-category rule counts either: rules move between categories as their lever changes, and several were recategorised into schedule when their fix became a recurring window rather than a one-shot stop.
The cost-driven column is the load-bearing part. A cost-driven finding must carry a real dollar figure or the rule abstains, and a cost-driven finding under $5 is dropped by the low-savings suppressor. That is why a genuine posture finding is deliberately filed under a non-cost-driven category: it is allowed to be worth $0 and still reach you. A rule that filed a $0 posture finding under idle would simply vanish.
Two rule families sit alongside this taxonomy and get their own modules later in the track: the autoscaler rules (RC-ASC-001 to 006, of which 004, 005 and 006 are registered only on Azure) and the AI and ML family in the RC-16xx range, which is 33 rules split between Bedrock (RC-1601 to 1610, plus 1615 and 1630 to 1634) and SageMaker (RC-1611 to 1614 and 1616 to 1628).
How the categories map to action
Each category has a default action: what ZopNight recommends doing about the finding:
CATEGORY DEFAULT ACTION AUTO-REMEDIATION?─────────────────────────────────────────────────────────────────────────────idle Terminate (with snapshot) Yes, for certified rulesrightsizing Downsize during maintenance No (planned change)schedule Attach to schedule Yes, via group attachorphan Delete Yes, for certified rulescompliance Configure missing setting No (planned change)discount Commit / restructure No (procurement decision)performance Tune the setting No (planned change)governance Apply tag (Smart Tags) Yes (Apply to cloud)security Fix the exposed setting No (PR required)The default actions are conservative. Customers can change them per-rule, but starting with the defaults is the right move.
Why this categorization
The 8 categories aren’t arbitrary; they reflect the different kinds of waste + the different kinds of response:
COST-RECOVERY categories (direct $ savings): idle → stop or delete things not being used rightsizing → make things smaller orphan → delete leftovers schedule → stop during off-hours discount → commit for better prices
QUALITY categories (cost-adjacent; mostly engineering hygiene): compliance → fix policy violations (some cost, some risk) performance → fix throughput/latency headroom, not dollars governance → fix tag hygiene (enables better cost reporting) security → fix exposed settings (cost-adjacent: incidents cost)Cost-recovery categories deliver immediate $ savings. Quality categories pay back via avoided incidents, better reporting, audit-readiness.
Typical savings distribution
A mid-size estate (~$500K/mo cloud spend) can look like the shape below. Treat the figures as illustrative, not as a benchmark: they are here to show the distribution, which is what stays true, rather than the amounts, which depend entirely on the estate.
CATEGORY FINDINGS SAVINGS POTENTIAL % OF TOTAL─────────────────────────────────────────────────────────────────idle 47 $14,800/mo ~49%rightsizing 62 $9,420/mo ~31%schedule 156 (actioned via T1) ~10%orphan 183 $1,940/mo ~6%compliance 54 $0 (posture debt) n/adiscount 8 $4,200/mo ~14%performance 6 $0 (headroom) n/asecurity 9 $0 (security debt) n/agovernance 71 $0 (tag debt) n/a─────────────────────────────────────────────────────────────────TOTAL ACTIONABLE $30,360/mo (~6% of spend)The biggest savings live in idle + rightsizing + discount. These three categories typically account for 80%+ of recoverable savings.
Reading the category breakdown
The category view in ZopNight Recommendations is the strategic dashboard:
WHAT TO ASK PER CATEGORY:
idle: How many resources? What's the average idle age? What's blocking action (data preservation, approval)?
rightsizing: Which families are most over-provisioned? What's the typical cost-reduction per right-size?
schedule: Are these resources already in groups? Why aren't existing schedules catching them?
orphan: How old? Cleanup safe? Who owns? (often nobody: that's the issue)
discount: What's the commitment opportunity? Coverage / utilization data points to decision
compliance / performance / governance / security: These are debts; address by quarter Don't expect direct $ savingsThe category-level view shapes the strategic conversation. Per-resource action follows.
Priority sequence: engineering teams
WEEK 1-2: idle + orphan Biggest wins; lowest risk Auto-remediation candidates for certified rules
WEEK 3-4: schedule Already actionable via T1 schedules Tag-driven group attachment
MONTH 2: rightsizing Plan changes per workload Production: maintenance window required
MONTH 2-3: discount Procurement decision; multi-stakeholder Decision in Track 4 (FinOps Mastery)
MONTH 3+: compliance + governance + security Quality debts; address by quarter No direct $ savings; long-term postureThe sequence matches the typical impact-vs-risk gradient.
2. Demo
A real findings report from a mid-size estate (Q1 2026):
ORG: 50-engineer SaaS, $400K/mo cloud spend
CATEGORY FINDINGS SAVINGS POTENTIAL ACTIONED IN Q1────────────────────────────────────────────────────────────────────idle 47 $14,800/mo 41 of 47 (87%)rightsizing 62 $9,420/mo 38 of 62 (61%)schedule 156 (T1-handled) 142 of 156 (91%)orphan 183 $1,940/mo 178 of 183 (97%)compliance 54 $0 (posture) 41 of 54 (76%)discount 8 $4,200/mo 5 of 8 (RIs purchased)performance 6 $0 (headroom) 4 of 6 (67%)security 9 $0 (security) 7 of 9 (78%)governance 71 $0 (tags) 68 of 71 (96%)────────────────────────────────────────────────────────────────────TOTAL 596 findings
Q1 SAVINGS REALIZED: $28,400/mo recurring = ~$340K/yr% of total cloud spend: 7% reduction
ACTION RATE by category: Highest action rate: orphan, schedule, governance, compliance (>90%) (low-risk; easy actions) Mid action rate: idle, rightsizing, discount (60-90%) (require investigation + decision) Lower action rate: compliance, performance, security (67-78%) (K8s posture findings need a PR; multi-team coordination)The pattern is repeatable. The first 6 weeks usually capture 70-80% of the available savings; the next quarter cleans up the remainder.
3. Hands-on (5 min)
Open ZopNight Recommendations:
□ STEP 1: Filter by each category idle: ___ findings savings: $_____/mo rightsizing: ___ findings savings: $_____/mo schedule: ___ findings savings: $_____/mo orphan: ___ findings savings: $_____/mo compliance: ___ findings savings: $_____ (often $0) discount: ___ findings savings: $_____/mo performance: ___ findings savings: $_____ (often $0) security: ___ findings savings: $_____ (often $0) governance: ___ findings savings: $_____ (often $0)
□ STEP 2: Identify top 3 by absolute savings 1. __________ savings: $_____/mo 2. __________ savings: $_____/mo 3. __________ savings: $_____/mo
□ STEP 3: Sanity-check Total actionable savings: $_____/mo % of monthly cloud spend: _____ % (Typical range: 3-15%)
□ STEP 4: Plan first action Pick: category with highest savings + lowest risk Owner: __________ Date: __________A 15-minute scan reveals the strategic picture. The biggest finding usually surprises someone.
Ask for it instead. The same task you just did in the console, asked in one sentence.
BEFORE A ZopNight account with one cloud connected. Discovery finished, so rules have something to fire on.ASK "How many recommendation rules do we have, by provider and category, and which are firing?"CHECK the categories against the eight you just read. A category with zero firings is usually a permission gap, not a clean estate.Tools behind it: count_recommendation_rules (read, Explore), get_recommendation_rules (read, Optimize), get_recommendation_filters (read, Optimize). The full catalogue is at zop.dev/learn/mcp-tools.
4. Knowledge check
Q1
A rule fires on a stopped EC2 instance with no attached volumes. Which category?
A. orphan
B. idle
C. rightsizing
D. discount
Show answer
Correct: A. Orphan. The resource has no attached usage; nothing is running. Idle would be a running instance with low utilization. Stopped + no volumes = orphan resource generating cost (e.g., EIPs, snapshots).
Q2
A K8s deployment without resources.limits set. The rule catalog files it under its “Reliability Rules” heading. Which category does the recommendation carry?
A. reliability, since a workload with no limits set can be evicted under node pressure and that is a reliability concern
B. idle
C. security
D. A category from the eight-value contract, because reliability is a documentation grouping in the catalog, not a category value
Show answer
Correct: D. No rule can emit reliability. This is the distinction to hold on to: the catalog groups the K8s workload rules under Reliability / Security / Idle / Orphan / Rightsizing headings for readability, but Category() only ever returns one of the eight contract values. Filtering the Recommendations page by “reliability” will find nothing, because the value does not exist.
Q3
Six rules carved out from idle/rightsizing in the 2026-04-13 migration. Which category?
A. compliance
B. discount
C. schedule
D. orphan
Show answer
Correct: C. Schedule. The carve-out gave scheduling-driven recommendations their own first-class filter. Examples: resources that fit dev/test schedule patterns; resources currently always-on that should follow schedule.
5. Apply
Recommendations → filter by category. Each category has its own savings rollup. Sort by impact; act on top items.
For your team: schedule a quarterly category review. Most teams capture 70-80% of savings in the first 6 weeks; the rest over the following quarter.
Related lessons
- L2: Severity ladder (next)
- L3: Rule interface
- L4: Pricing model
- L5: Reading a recommendation card
- M2.3: Auto-remediation
Glossary terms touched
Rule category · Recommendation card · Cost-recovery vs quality category · Action default