DEV Community

Skyveda
Skyveda

Posted on

A read-only Azure scanner that shows waste from your actual bill

#azure #devops #finops #opensource

Most Azure estates carry two kinds of quiet debt.

The first costs money every month: a disk left behind when a VM was deleted, a public IP nobody uses, a VM that was "stopped" but never deallocated, so it's still billed. Snapshots from a migration two years ago.

The second costs you later: SSH or RDP open to the internet, storage that allows anonymous access, an AKS cluster with no network policy. Nobody notices until a big customer sends a security questionnaire, or an auditor asks.

Neither is hard to fix. It's hard to see, because nobody has time to walk through every subscription. So we built Skyveda Scan, a free, open-source CLI that does the walking for you.

What it does

It checks an Azure estate against 60 checks across security, reliability and cost: VMs, networking, storage, AKS, App Service, SQL, PostgreSQL, Cosmos DB, Key Vault, Container Registry, Redis and more. It then writes an HTML report, and a PDF if you ask for one, with:

  • a score per area and an overall score
  • findings ranked by severity, each with why it matters and how to fix it
  • monthly waste in rupees, per resource and in total 
pip install "skyveda[azure]"   # Python 3.12+
az login
skyveda scopes                 # which subscriptions can I read?
skyveda scan --provider azure --subscription <id> --out ./out --pdf
Enter fullscreen mode Exit fullscreen mode

No Azure account handy? Point it at recorded sample data instead:

skyveda scan --offline <folder of recorded data> --out ./out
Enter fullscreen mode Exit fullscreen mode

Three design choices

1. Read-only, always. It only calls read, list and get APIs. It works with Azure's built-in Reader role, plus Cost Management Reader for the cost checks. It never creates, changes or deletes anything, and it never reads secrets or data inside your resources. That makes it something a security team can say yes to quickly.

2. Waste from the bill, not the price list. Most tools multiply a list price by a size and call it waste. Where Skyveda can read Cost Management, it uses what you were actually billed for that resource, so the number matches your invoice rather than a catalogue. Where it can't, it falls back to a list-price estimate and labels it clearly, so you always know which number you're looking at.

3. Local only, and checks are data. There's no telemetry. Nothing leaves your machine except the report files you choose to share. Each check is a single YAML file with a fixture to test it, so adding or adjusting a check doesn't need new code.

There's also a waivers file for accepted risks or wrong findings. Waived items drop out of the scores and totals, but the report still lists every one in an appendix, so nothing disappears silently.

What's next

More checks, AWS later, and a monthly mode that tracks trends. The code is Apache 2.0:

👉 https://github.com/skyvedahq/skyveda

I'd really value feedback: which checks are missing, which are noisy, and what would make the report more useful to you. Issues and pull requests are welcome.

If a scan turns up something you'd like help fixing, that's what we do at Skyveda: platform engineering, DevOps and reliability. Cloud, engineered right.

Microsoft and Azure are trademarks of the Microsoft group of companies. Skyveda is not affiliated with or endorsed by Microsoft.

Top comments (0)