Security and Cost Findings in One Recommendation Queue

Posture findings next to cost findings

ZopNight’s recommendation engine carries compliance and security rules alongside its cost rules, so one queue shows both. Examples:

• AWS: Security Group With Unrestricted Inbound Access, S3 Bucket With Public Access Enabled, RDS Instance Publicly Accessible, IAM User Without MFA Enabled, EC2 IMDSv2 Not Required, EBS Volume Not Encrypted, GuardDuty Not Enabled
• GCP: GCP Firewall Rule Allows All Ports, GCP Cloud SQL Instance Has Public IP Enabled, GCP Service Account Has Admin Role, GKE Cluster Not Private
• Azure: Azure NSG Open to Internet, Azure Storage Account Public Access Enabled, Azure SQL Database TDE Not Enabled, AKS Cluster API Server Not Private
• Kubernetes: Privileged Container, Container Running As Root, Ingress Without TLS

Where cost and security meet

Some findings are the same problem seen twice. An unused Secrets Manager secret or KMS key is both a line on the bill and a credential that should not exist. An Azure NSG attached to nothing is clutter that makes reviews harder. Other findings pull in opposite directions, and ZopNight shows both sides: Cloud SQL Production Instance Without HA argues for spending more, while GCP Cloud SQL Excessive Backup Retention for Dev/Test argues for spending less on a non-production copy.

Verified fixes, not silence

When a posture finding is marked fixed, ZopNight re-reads the exact setting the rule fired on. A finding going quiet is not accepted as proof, because a narrowed permission or a renamed field produces the same silence as a real fix. Where no honest verdict is possible, the recommendation says it abstained.

Catching it before deploy

IaC governance checks Terraform and OpenTofu plans in pull requests and scans state for inventory. ZopNight returns a decision; your GitHub required check enforces it, and ZopNight never runs apply. Built-in rules span security, IAM, networking, cost, reliability and more, tagged against frameworks such as CIS, PCI, SOC 2, HIPAA, NIST and ISO. Custom policies can be written in Rego. Cost guardrails in the same engine put a monthly cost figure on the PR and can block a change over a budget cap.

Access and audit

Role-based access scopes who can see and act on which resources, and every mutating request is written to the audit log, exportable to CSV as evidence.

See security recommendations, compliance recommendations and security vs cost trade-offs.