zombiecost 0.1.0__tar.gz

zombiecost-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arabo Markarian
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

zombiecost-0.1.0/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: zombiecost
+Version: 0.1.0
+Summary: Find zombie AWS resources: idle and forgotten things that should be dead but still bill you every month.
+License-Expression: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3>=1.34
+Requires-Dist: rich>=13.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: moto[cloudwatch,ec2]>=5.0; extra == "dev"
+Dynamic: license-file
+
+# zombiecost
+
+Find the zombie resources in your AWS account: things that should be dead but still bill you every month.
+
+Find idle and forgotten AWS resources and see what they cost you every month.
+
+One read-only scan. One table. A number at the bottom you can act on today.
+
+## What it finds
+
+| Check | What it flags | How cost is estimated |
+|---|---|---|
+| `ebs-unattached` | EBS volumes attached to nothing | GB-month price by volume type |
+| `eip-unused` | Elastic IPs not associated with anything | Hourly unused-EIP charge |
+| `snapshots-old` | Snapshots older than 90 days that no AMI you own uses | GB-month snapshot price |
+| `ec2-idle` | Running instances averaging under 3% CPU over the lookback window | On-demand hourly price |
+| `nat-idle` | NAT gateways that moved under 1 GiB in the lookback window | Hourly NAT charge |
+| `rds-idle` | RDS instances with zero connections over the lookback window | Instance class + storage |
+| `lb-unused` | Load balancers with no registered targets, or ALBs that served 0 requests | Hourly LB charge |
+| `s3-stale` | Buckets nothing has written to in 180 days, with their size and storage class | GB-month by storage class |
+
+Prices are rough us-east-1 on-demand numbers. The goal is order of magnitude, not an invoice.
+
+Checks that depend on usage history (`ec2-idle`, `rds-idle`, `nat-idle`, `lb-unused`)
+ignore resources younger than 3 days, so a freshly launched instance is never
+reported as idle. `s3-stale` can see writes but not reads; it says so in every
+finding, because reads are invisible without paid request metrics.
+
+## Install
+
+```bash
+pip install zombiecost
+```
+
+Or from a clone:
+
+```bash
+python3 -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+## Run
+
+```bash
+zombiecost                                  # every enabled region, default profile
+zombiecost --profile prod --regions eu-west-1,us-east-1
+zombiecost --days 30 --json report.json     # longer lookback, machine-readable output
+```
+
+## Permissions
+
+The scan is read-only. Attach `ReadOnlyAccess`, or this minimal policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": [
+      "sts:GetCallerIdentity",
+      "ec2:DescribeRegions",
+      "ec2:DescribeVolumes",
+      "ec2:DescribeAddresses",
+      "ec2:DescribeSnapshots",
+      "ec2:DescribeImages",
+      "ec2:DescribeInstances",
+      "ec2:DescribeNatGateways",
+      "rds:DescribeDBInstances",
+      "elasticloadbalancing:DescribeLoadBalancers",
+      "elasticloadbalancing:DescribeTargetGroups",
+      "elasticloadbalancing:DescribeTargetHealth",
+      "s3:ListAllMyBuckets",
+      "s3:GetBucketLocation",
+      "s3:ListBucket",
+      "cloudwatch:GetMetricStatistics",
+      "cloudwatch:ListMetrics"
+    ],
+    "Resource": "*"
+  }]
+}
+```
+
+## Tests
+
+```bash
+pytest
+```
+
+Tests run against [moto](https://github.com/getmoto/moto), no AWS account needed.
+
+## Roadmap
+
+- [ ] Unused KMS keys, Secrets Manager secrets and VPC endpoints (small, fixed monthly charges that add up)
+- [ ] Stopped instances still paying for their volumes
+- [ ] Old AMIs and the snapshots behind them
+- [ ] Hosted version: cross-account role, weekly scans, Slack alerts

zombiecost-0.1.0/README.md

@@ -0,0 +1,96 @@
+# zombiecost
+
+Find the zombie resources in your AWS account: things that should be dead but still bill you every month.
+
+Find idle and forgotten AWS resources and see what they cost you every month.
+
+One read-only scan. One table. A number at the bottom you can act on today.
+
+## What it finds
+
+| Check | What it flags | How cost is estimated |
+|---|---|---|
+| `ebs-unattached` | EBS volumes attached to nothing | GB-month price by volume type |
+| `eip-unused` | Elastic IPs not associated with anything | Hourly unused-EIP charge |
+| `snapshots-old` | Snapshots older than 90 days that no AMI you own uses | GB-month snapshot price |
+| `ec2-idle` | Running instances averaging under 3% CPU over the lookback window | On-demand hourly price |
+| `nat-idle` | NAT gateways that moved under 1 GiB in the lookback window | Hourly NAT charge |
+| `rds-idle` | RDS instances with zero connections over the lookback window | Instance class + storage |
+| `lb-unused` | Load balancers with no registered targets, or ALBs that served 0 requests | Hourly LB charge |
+| `s3-stale` | Buckets nothing has written to in 180 days, with their size and storage class | GB-month by storage class |
+
+Prices are rough us-east-1 on-demand numbers. The goal is order of magnitude, not an invoice.
+
+Checks that depend on usage history (`ec2-idle`, `rds-idle`, `nat-idle`, `lb-unused`)
+ignore resources younger than 3 days, so a freshly launched instance is never
+reported as idle. `s3-stale` can see writes but not reads; it says so in every
+finding, because reads are invisible without paid request metrics.
+
+## Install
+
+```bash
+pip install zombiecost
+```
+
+Or from a clone:
+
+```bash
+python3 -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+## Run
+
+```bash
+zombiecost                                  # every enabled region, default profile
+zombiecost --profile prod --regions eu-west-1,us-east-1
+zombiecost --days 30 --json report.json     # longer lookback, machine-readable output
+```
+
+## Permissions
+
+The scan is read-only. Attach `ReadOnlyAccess`, or this minimal policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": [
+      "sts:GetCallerIdentity",
+      "ec2:DescribeRegions",
+      "ec2:DescribeVolumes",
+      "ec2:DescribeAddresses",
+      "ec2:DescribeSnapshots",
+      "ec2:DescribeImages",
+      "ec2:DescribeInstances",
+      "ec2:DescribeNatGateways",
+      "rds:DescribeDBInstances",
+      "elasticloadbalancing:DescribeLoadBalancers",
+      "elasticloadbalancing:DescribeTargetGroups",
+      "elasticloadbalancing:DescribeTargetHealth",
+      "s3:ListAllMyBuckets",
+      "s3:GetBucketLocation",
+      "s3:ListBucket",
+      "cloudwatch:GetMetricStatistics",
+      "cloudwatch:ListMetrics"
+    ],
+    "Resource": "*"
+  }]
+}
+```
+
+## Tests
+
+```bash
+pytest
+```
+
+Tests run against [moto](https://github.com/getmoto/moto), no AWS account needed.
+
+## Roadmap
+
+- [ ] Unused KMS keys, Secrets Manager secrets and VPC endpoints (small, fixed monthly charges that add up)
+- [ ] Stopped instances still paying for their volumes
+- [ ] Old AMIs and the snapshots behind them
+- [ ] Hosted version: cross-account role, weekly scans, Slack alerts

zombiecost-0.1.0/pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "zombiecost"
+version = "0.1.0"
+description = "Find zombie AWS resources: idle and forgotten things that should be dead but still bill you every month."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+dependencies = [
+  "boto3>=1.34",
+  "rich>=13.0",
+]
+
+[project.optional-dependencies]
+dev = [
+  "pytest>=8.0",
+  "moto[ec2,cloudwatch]>=5.0",
+]
+
+[project.scripts]
+zombiecost = "zombiecost.cli:main"
+
+[tool.setuptools.packages.find]
+include = ["zombiecost*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

zombiecost-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

zombiecost-0.1.0/tests/test_checks.py

@@ -0,0 +1,160 @@
+from datetime import datetime, timedelta, timezone
+
+from zombiecost.checks import UnattachedEbsVolumes, UnusedElasticIps, OldSnapshots, IdleEc2Instances
+from zombiecost.scanner import scan
+
+REGION = "us-east-1"
+
+
+def test_unattached_volume_is_flagged_and_attached_is_not(session):
+    ec2 = session.client("ec2", region_name=REGION)
+    ec2.create_volume(AvailabilityZone=f"{REGION}a", Size=100, VolumeType="gp3")
+
+    ami = ec2.describe_images()["Images"][0]["ImageId"]
+    inst = ec2.run_instances(ImageId=ami, InstanceType="t3.micro", MinCount=1, MaxCount=1)["Instances"][0]
+    attached = ec2.create_volume(AvailabilityZone=inst["Placement"]["AvailabilityZone"], Size=8)
+    ec2.attach_volume(VolumeId=attached["VolumeId"], InstanceId=inst["InstanceId"], Device="/dev/sdf")
+
+    findings = UnattachedEbsVolumes(session).run(REGION)
+
+    assert len(findings) == 1
+    assert findings[0].details["size_gb"] == 100
+    assert findings[0].monthly_cost_estimate == 8.0  # 100 GiB * $0.08 gp3
+
+
+def test_unassociated_eip_is_flagged(session):
+    ec2 = session.client("ec2", region_name=REGION)
+    ec2.allocate_address(Domain="vpc")
+
+    findings = UnusedElasticIps(session).run(REGION)
+
+    assert len(findings) == 1
+    assert findings[0].check == "eip-unused"
+    assert findings[0].monthly_cost_estimate > 0
+
+
+def test_recent_snapshot_is_not_flagged(session):
+    ec2 = session.client("ec2", region_name=REGION)
+    vol = ec2.create_volume(AvailabilityZone=f"{REGION}a", Size=20)
+    ec2.create_snapshot(VolumeId=vol["VolumeId"])
+
+    findings = OldSnapshots(session).run(REGION)
+
+    assert findings == []
+
+
+def test_brand_new_instance_is_not_flagged_even_with_low_cpu(session):
+    ec2 = session.client("ec2", region_name=REGION)
+    cw = session.client("cloudwatch", region_name=REGION)
+    ami = ec2.describe_images()["Images"][0]["ImageId"]
+    inst = ec2.run_instances(ImageId=ami, InstanceType="t3.micro", MinCount=1, MaxCount=1)["Instances"][0]
+    cw.put_metric_data(
+        Namespace="AWS/EC2",
+        MetricData=[{
+            "MetricName": "CPUUtilization",
+            "Dimensions": [{"Name": "InstanceId", "Value": inst["InstanceId"]}],
+            "Timestamp": datetime.now(timezone.utc) - timedelta(hours=1),
+            "Value": 0.0,
+            "Unit": "Percent",
+        }],
+    )
+
+    findings = IdleEc2Instances(session, lookback_days=14).run(REGION)
+
+    assert findings == []  # launched just now, too young to judge
+
+
+def test_idle_instance_is_flagged_when_cpu_is_low(session, monkeypatch):
+    # moto launches instances "now"; pretend this one is old enough to judge.
+    monkeypatch.setattr(IdleEc2Instances, "min_age_days", 0)
+    ec2 = session.client("ec2", region_name=REGION)
+    cw = session.client("cloudwatch", region_name=REGION)
+    ami = ec2.describe_images()["Images"][0]["ImageId"]
+    inst = ec2.run_instances(ImageId=ami, InstanceType="t3.medium", MinCount=1, MaxCount=1)["Instances"][0]
+
+    now = datetime.now(timezone.utc)
+    cw.put_metric_data(
+        Namespace="AWS/EC2",
+        MetricData=[
+            {
+                "MetricName": "CPUUtilization",
+                "Dimensions": [{"Name": "InstanceId", "Value": inst["InstanceId"]}],
+                "Timestamp": now - timedelta(days=d),
+                "Value": 1.0,
+                "Unit": "Percent",
+            }
+            for d in range(1, 8)
+        ],
+    )
+
+    findings = IdleEc2Instances(session, lookback_days=14).run(REGION)
+
+    assert len(findings) == 1
+    assert findings[0].details["instance_type"] == "t3.medium"
+    assert findings[0].details["avg_cpu_percent"] == 1.0
+
+
+def test_scan_sorts_findings_by_cost(session):
+    ec2 = session.client("ec2", region_name=REGION)
+    ec2.create_volume(AvailabilityZone=f"{REGION}a", Size=10, VolumeType="gp3")   # $0.80
+    ec2.create_volume(AvailabilityZone=f"{REGION}a", Size=500, VolumeType="gp2")  # $50.00
+    ec2.allocate_address(Domain="vpc")                                            # $3.65
+
+    result = scan(session, regions=[REGION])
+
+    costs = [f.monthly_cost_estimate for f in result.findings]
+    assert costs == sorted(costs, reverse=True)
+    assert result.total_monthly_estimate == round(0.8 + 50.0 + 3.65, 2)
+
+
+from zombiecost.checks import IdleRdsInstances, UnusedLoadBalancers, StaleS3Buckets
+
+
+def test_rds_with_zero_connections_is_flagged(session, monkeypatch):
+    monkeypatch.setattr(IdleRdsInstances, "min_age_days", 0)
+    rds = session.client("rds", region_name=REGION)
+    cw = session.client("cloudwatch", region_name=REGION)
+    rds.create_db_instance(
+        DBInstanceIdentifier="lonely-db", DBInstanceClass="db.t3.micro", Engine="postgres",
+        AllocatedStorage=20, MasterUsername="admin", MasterUserPassword="password123",
+    )
+    cw.put_metric_data(
+        Namespace="AWS/RDS",
+        MetricData=[{
+            "MetricName": "DatabaseConnections",
+            "Dimensions": [{"Name": "DBInstanceIdentifier", "Value": "lonely-db"}],
+            "Timestamp": datetime.now(timezone.utc) - timedelta(days=1),
+            "Value": 0.0,
+        }],
+    )
+
+    findings = IdleRdsInstances(session).run(REGION)
+
+    assert [f.resource_id for f in findings] == ["lonely-db"]
+    assert findings[0].monthly_cost_estimate == round(0.017 * 730 + 0.115 * 20, 2)
+
+
+def test_alb_with_no_targets_is_flagged(session):
+    ec2 = session.client("ec2", region_name=REGION)
+    elb = session.client("elbv2", region_name=REGION)
+    vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
+    s1 = ec2.create_subnet(VpcId=vpc, CidrBlock="10.0.1.0/24", AvailabilityZone=f"{REGION}a")["Subnet"]["SubnetId"]
+    s2 = ec2.create_subnet(VpcId=vpc, CidrBlock="10.0.2.0/24", AvailabilityZone=f"{REGION}b")["Subnet"]["SubnetId"]
+    sg = ec2.create_security_group(GroupName="lb", Description="lb", VpcId=vpc)["GroupId"]
+    elb.create_load_balancer(Name="empty-alb", Subnets=[s1, s2], SecurityGroups=[sg], Type="application")
+
+    findings = UnusedLoadBalancers(session).run(REGION)
+
+    assert [f.resource_id for f in findings] == ["empty-alb"]
+    assert "no registered targets" in findings[0].description
+
+
+def test_recently_written_bucket_is_not_flagged_and_prefixes_are_ignored(session):
+    s3 = session.client("s3", region_name=REGION)
+    s3.create_bucket(Bucket="busy-bucket")
+    s3.put_object(Bucket="busy-bucket", Key="new.txt", Body=b"hi")
+    s3.create_bucket(Bucket="cf-templates-ignored")
+
+    findings = StaleS3Buckets(session).run(REGION)
+
+    assert findings == []

zombiecost-0.1.0/zombiecost/__init__.py

@@ -0,0 +1,3 @@
+"""zombiecost: find idle and forgotten AWS resources and what they cost."""
+
+__version__ = "0.1.0"

zombiecost-0.1.0/zombiecost/checks/__init__.py

@@ -0,0 +1,22 @@
+from .base import Check
+from .ebs_unattached import UnattachedEbsVolumes
+from .eip_unused import UnusedElasticIps
+from .snapshots_old import OldSnapshots
+from .ec2_idle import IdleEc2Instances
+from .nat_idle import IdleNatGateways
+from .rds_idle import IdleRdsInstances
+from .lb_unused import UnusedLoadBalancers
+from .s3_stale import StaleS3Buckets
+
+ALL_CHECKS: list[type[Check]] = [
+    UnattachedEbsVolumes,
+    UnusedElasticIps,
+    OldSnapshots,
+    IdleEc2Instances,
+    IdleNatGateways,
+    IdleRdsInstances,
+    UnusedLoadBalancers,
+    StaleS3Buckets,
+]
+
+__all__ = ["Check", "ALL_CHECKS"]

zombiecost-0.1.0/zombiecost/checks/base.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from datetime import datetime, timedelta, timezone
+
+import boto3
+
+from ..models import Finding
+
+
+class Check(ABC):
+    """A single waste detector. Subclasses implement `run` for one region."""
+
+    name: str = "base"
+    description: str = ""
+
+    def __init__(self, session: boto3.Session, lookback_days: int = 14):
+        self.session = session
+        self.lookback_days = lookback_days
+
+    @abstractmethod
+    def run(self, region: str) -> list[Finding]:
+        ...
+
+    # Helpers shared by metric-based checks
+
+    def _window(self) -> tuple[datetime, datetime]:
+        end = datetime.now(timezone.utc)
+        start = end - timedelta(days=self.lookback_days)
+        return start, end
+
+    def _metric_average(
+        self, region: str, namespace: str, metric: str, dimensions: list[dict], stat: str = "Average"
+    ) -> float | None:
+        """Return the mean of a CloudWatch metric over the lookback window, or None if no data."""
+        cw = self.session.client("cloudwatch", region_name=region)
+        start, end = self._window()
+        resp = cw.get_metric_statistics(
+            Namespace=namespace,
+            MetricName=metric,
+            Dimensions=dimensions,
+            StartTime=start,
+            EndTime=end,
+            Period=86400,
+            Statistics=[stat],
+        )
+        points = resp.get("Datapoints", [])
+        if not points:
+            return None
+        return sum(p[stat] for p in points) / len(points)
+
+    def _metric_sum(self, region: str, namespace: str, metric: str, dimensions: list[dict]) -> float | None:
+        cw = self.session.client("cloudwatch", region_name=region)
+        start, end = self._window()
+        resp = cw.get_metric_statistics(
+            Namespace=namespace,
+            MetricName=metric,
+            Dimensions=dimensions,
+            StartTime=start,
+            EndTime=end,
+            Period=86400,
+            Statistics=["Sum"],
+        )
+        points = resp.get("Datapoints", [])
+        if not points:
+            return None
+        return sum(p["Sum"] for p in points)
+
+    def _metric_max(self, region: str, namespace: str, metric: str, dimensions: list[dict]) -> float | None:
+        cw = self.session.client("cloudwatch", region_name=region)
+        start, end = self._window()
+        resp = cw.get_metric_statistics(
+            Namespace=namespace,
+            MetricName=metric,
+            Dimensions=dimensions,
+            StartTime=start,
+            EndTime=end,
+            Period=86400,
+            Statistics=["Maximum"],
+        )
+        points = resp.get("Datapoints", [])
+        if not points:
+            return None
+        return max(p["Maximum"] for p in points)

zombiecost-0.1.0/zombiecost/checks/ebs_unattached.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from ..models import Finding
+from .. import pricing
+from .base import Check
+
+
+class UnattachedEbsVolumes(Check):
+    name = "ebs-unattached"
+    description = "EBS volumes in 'available' state, attached to nothing, still billed every month."
+
+    def run(self, region: str) -> list[Finding]:
+        ec2 = self.session.client("ec2", region_name=region)
+        findings: list[Finding] = []
+        paginator = ec2.get_paginator("describe_volumes")
+        for page in paginator.paginate(Filters=[{"Name": "status", "Values": ["available"]}]):
+            for vol in page.get("Volumes", []):
+                size = vol["Size"]
+                vtype = vol.get("VolumeType", "gp2")
+                cost = pricing.ebs_monthly(vtype, size)
+                findings.append(
+                    Finding(
+                        check=self.name,
+                        resource_id=vol["VolumeId"],
+                        region=region,
+                        description=f"{size} GiB {vtype} volume not attached to any instance",
+                        monthly_cost_estimate=cost,
+                        recommendation="Snapshot it if you might need the data, then delete the volume.",
+                        details={
+                            "size_gb": size,
+                            "volume_type": vtype,
+                            "created": vol["CreateTime"].isoformat(),
+                            "tags": {t["Key"]: t["Value"] for t in vol.get("Tags", [])},
+                        },
+                    )
+                )
+        return findings

zombiecost-0.1.0/zombiecost/checks/ec2_idle.py

@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from ..models import Finding
+from .. import pricing
+from .base import Check
+
+
+class IdleEc2Instances(Check):
+    name = "ec2-idle"
+    description = "Running instances whose average CPU over the lookback window is below the threshold."
+
+    cpu_threshold_percent = 3.0
+    # An instance younger than this has not had a chance to do anything yet.
+    min_age_days = 3
+
+    def run(self, region: str) -> list[Finding]:
+        now = datetime.now(timezone.utc)
+        ec2 = self.session.client("ec2", region_name=region)
+        findings: list[Finding] = []
+        paginator = ec2.get_paginator("describe_instances")
+        for page in paginator.paginate(Filters=[{"Name": "instance-state-name", "Values": ["running"]}]):
+            for reservation in page.get("Reservations", []):
+                for inst in reservation.get("Instances", []):
+                    instance_id = inst["InstanceId"]
+                    age_days = (now - inst["LaunchTime"]).days
+                    if age_days < self.min_age_days:
+                        continue
+                    avg_cpu = self._metric_average(
+                        region,
+                        "AWS/EC2",
+                        "CPUUtilization",
+                        [{"Name": "InstanceId", "Value": instance_id}],
+                    )
+                    if avg_cpu is None or avg_cpu >= self.cpu_threshold_percent:
+                        continue
+                    itype = inst["InstanceType"]
+                    name = next((t["Value"] for t in inst.get("Tags", []) if t["Key"] == "Name"), "")
+                    findings.append(
+                        Finding(
+                            check=self.name,
+                            resource_id=instance_id,
+                            region=region,
+                            description=(
+                                f"{itype} instance{' ' + repr(name) if name else ''} averaged "
+                                f"{avg_cpu:.1f}% CPU over the last {min(age_days, self.lookback_days)} days"
+                            ),
+                            monthly_cost_estimate=pricing.ec2_monthly(itype),
+                            recommendation="Stop it, downsize it, or move the workload to a scheduled job.",
+                            details={
+                                "instance_type": itype,
+                                "name": name,
+                                "avg_cpu_percent": round(avg_cpu, 2),
+                                "age_days": age_days,
+                                "launch_time": inst["LaunchTime"].isoformat(),
+                            },
+                        )
+                    )
+        return findings

zombiecost-0.1.0/zombiecost/checks/eip_unused.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from ..models import Finding
+from .. import pricing
+from .base import Check
+
+
+class UnusedElasticIps(Check):
+    name = "eip-unused"
+    description = "Elastic IPs that are allocated but not associated with anything."
+
+    def run(self, region: str) -> list[Finding]:
+        ec2 = self.session.client("ec2", region_name=region)
+        findings: list[Finding] = []
+        for addr in ec2.describe_addresses().get("Addresses", []):
+            if addr.get("AssociationId") or addr.get("InstanceId") or addr.get("NetworkInterfaceId"):
+                continue
+            findings.append(
+                Finding(
+                    check=self.name,
+                    resource_id=addr.get("AllocationId") or addr["PublicIp"],
+                    region=region,
+                    description=f"Elastic IP {addr['PublicIp']} is allocated but not associated",
+                    monthly_cost_estimate=pricing.eip_monthly(),
+                    recommendation="Release the address if nothing will use it.",
+                    details={"public_ip": addr["PublicIp"]},
+                )
+            )
+        return findings