Getting Started
LeftSize scans your AWS and Azure infrastructure for cost optimization opportunities, security risks, governance gaps, and upcoming service deprecations. Findings are delivered as GitHub Issues with actionable remediation guidance.
How it works
- Install the LeftSize GitHub App on your organization or personal account
- Connect your cloud accounts using secure OIDC authentication (no stored credentials)
- Scan automatically on a daily schedule via GitHub Actions
- Act on findings delivered as GitHub Issues with step-by-step guidance
Step 1: Install the GitHub App
Install LeftSize from the GitHub Marketplace. Choose which repositories should receive scan results. You can start with a single repository and add more later.
After installation, you’ll be redirected to the onboarding flow at leftsize.com/onboarding where you can configure your first scan.
Step 2: Set up cloud authentication
LeftSize uses OpenID Connect (OIDC) to authenticate with your cloud provider. This means no long-lived credentials are stored – GitHub Actions requests a short-lived token for each scan run.
Choose your cloud provider:
- Azure Setup Guide – App Registration with federated credentials
- AWS Setup Guide – IAM OIDC Provider with an assumed role
Step 3: Add the workflow
During onboarding, LeftSize generates a customized GitHub Actions workflow for your repository. Copy the workflow YAML and commit it to .github/workflows/leftsize.yml in your repository.
The workflow includes:
- A randomized daily schedule (unique per repository to distribute load)
- Manual trigger support via
workflow_dispatch - OIDC authentication to your cloud provider
- Multi-environment support via matrix strategy (e.g., scan PROD and DEV separately)
Step 4: Add secrets and variables
Add the required secrets to your repository under Settings > Secrets and variables > Actions:
Azure
| Secret | Description |
|---|---|
AZURE_CLIENT_ID_MAIN |
App Registration Client ID |
AZURE_SUBSCRIPTION_ID_MAIN |
Subscription ID to scan |
AZURE_TENANT_ID |
Azure AD Tenant ID |
LEFTSIZE_INSTALLATION_ID |
Provided during onboarding |
LEFTSIZE_REPOSITORY_TOKEN |
Provided during onboarding |
AWS
| Secret | Description |
|---|---|
AWS_ROLE_ARN_MAIN |
IAM Role ARN for OIDC |
LEFTSIZE_INSTALLATION_ID |
Provided during onboarding |
LEFTSIZE_REPOSITORY_TOKEN |
Provided during onboarding |
| Variable | Description |
|---|---|
AWS_REGIONS |
Comma-separated regions to scan (e.g., us-east-1,eu-west-1) |
Step 5: Run your first scan
You can wait for the scheduled run or trigger a scan manually:
- Go to your repository’s Actions tab
- Select LeftSize Cost Optimization Scan
- Click Run workflow
After the scan completes, check your repository’s Issues tab for findings. Each issue includes:
- A description of the problem
- The affected resources
- Estimated cost savings (where applicable)
- Interactive commands for remediation guidance
What’s next
- Learn about available commands you can use on issues
- Set up reports to track savings and fix rates over time
- Browse the rules catalog to see what LeftSize checks for
- Read how it works for a deeper technical overview