# Rules

Catalog of all 188 LeftSize rules for AWS and Azure: cost optimization, deprecations, security and governance.

<!-- Generated by scripts/generate_rules_page.py from website/src/data/rules.json. Do not edit by hand. -->

# Rules

LeftSize runs **188 rules**: 97 for AWS and 91 for Azure. Each rule links to its page on [leftsize.com/rules](https://leftsize.com/rules/) with what it checks and why it matters.

## Which plan includes which rules

- **Free** gets issues for the 77 cost optimization rules, in up to 3 repositories.
- **Team** and **Business** get issues for all 188 rules, including deprecations, security and governance.

On the Free plan, the paid rules still run: the scan summary in the Actions run shows what they found, but no issues are created for them.

## Categories

| Category | Rules | What it finds |
|---|---|---|
| Cost optimization | 77 | Idle, unused and over-provisioned resources that keep billing while delivering little or no value. |
| Deprecations & retirements | 70 | Service versions, SKUs and features that are retired or out of support, so you can migrate before the deadline. |
| Security | 27 | Public exposure, unused credentials and missing MFA or logging. |
| Governance | 14 | Missing tags, encryption, backups and audit settings, and certificates about to expire. |

## AWS

### AWS cost optimization (46)

| Rule | Plan | Rule ID |
|---|---|---|
| [Application Load Balancers with almost no requests](https://leftsize.com/rules/aws/unused-alb/) | Free | `leftsize-unused-alb` |
| [CloudWatch log groups without retention policy](https://leftsize.com/rules/aws/cloudwatch-logs-no-retention/) | Free | `leftsize-cloudwatch-logs-no-retention` |
| [EBS volumes attached to stopped EC2](https://leftsize.com/rules/aws/ebs-attached-to-stopped-ec2/) | Free | `leftsize-ebs-attached-to-stopped-ec2` |
| [EBS volumes on gp2 - migrate to gp3](https://leftsize.com/rules/aws/gp2-to-gp3-migration/) | Free | `leftsize-gp2-to-gp3-migration` |
| [EBS volumes using io1 instead of io2](https://leftsize.com/rules/aws/io1-to-io2-migration/) | Free | `leftsize-io1-to-io2-migration` |
| [EC2 instances averaging 10–40% CPU over 14 days — review for right-sizing](https://leftsize.com/rules/aws/underutilized-ec2-instance/) | Free | `leftsize-underutilized-ec2-instance` |
| [EC2 instances eligible for Spot](https://leftsize.com/rules/aws/spot-instance-eligible/) | Free | `leftsize-spot-instance-eligible` |
| [EC2 instances not using Graviton](https://leftsize.com/rules/aws/ec2-non-graviton/) | Free | `leftsize-ec2-non-graviton` |
| [EC2 instances on outdated generation](https://leftsize.com/rules/aws/ec2-outdated-generation/) | Free | `leftsize-ec2-outdated-generation` |
| [EC2 instances with EBS volumes that outlive termination](https://leftsize.com/rules/aws/ebs-delete-on-termination-disabled/) | Free | `leftsize-ebs-delete-on-termination-disabled` |
| [ECR repositories without lifecycle policy](https://leftsize.com/rules/aws/ecr-no-lifecycle-policy/) | Free | `leftsize-ecr-no-lifecycle-policy` |
| [ECS Auto Scaling groups with a minimum of 3+ instances — review for idle capacity](https://leftsize.com/rules/aws/idle-ecs-container-instances/) | Free | `leftsize-idle-ecs-container-instances` |
| [ECS services on regular Fargate — review for Fargate Spot](https://leftsize.com/rules/aws/fargate-spot-eligible/) | Free | `leftsize-fargate-spot-eligible` |
| [EKS clusters without any compute](https://leftsize.com/rules/aws/inactive-eks-cluster/) | Free | `leftsize-inactive-eks-cluster` |
| [Idle DynamoDB tables (zero activity in 30 days)](https://leftsize.com/rules/aws/idle-dynamodb-table/) | Free | `leftsize-idle-dynamodb-table` |
| [Idle ElastiCache clusters (zero connections in 14 days)](https://leftsize.com/rules/aws/idle-elasticache-cluster/) | Free | `leftsize-idle-elasticache-cluster` |
| [Idle RDS instances](https://leftsize.com/rules/aws/idle-rds-instance/) | Free | `leftsize-idle-rds-instance` |
| [Inactive EC2 instances](https://leftsize.com/rules/aws/inactive-ec2-instance/) | Free | `leftsize-inactive-ec2-instance` |
| [Inactive EFS filesystems](https://leftsize.com/rules/aws/inactive-efs-filesystem/) | Free | `leftsize-inactive-efs-filesystem` |
| [Inactive NAT Gateways](https://leftsize.com/rules/aws/inactive-nat-gateway/) | Free | `leftsize-inactive-nat-gateway` |
| [Inactive Network Load Balancers](https://leftsize.com/rules/aws/inactive-nlb/) | Free | `leftsize-inactive-nlb` |
| [Inactive RDS read replicas](https://leftsize.com/rules/aws/inactive-rds-read-replica/) | Free | `leftsize-inactive-rds-read-replica` |
| [Inactive VPC endpoints](https://leftsize.com/rules/aws/inactive-vpc-endpoint/) | Free | `leftsize-inactive-vpc-endpoint` |
| [io1/io2 EBS volumes overprovisioned](https://leftsize.com/rules/aws/ebs-io1-io2-overprovisioned/) | Free | `leftsize-ebs-io1-io2-overprovisioned` |
| [Lambda functions on x86 architecture](https://leftsize.com/rules/aws/lambda-x86-architecture/) | Free | `leftsize-lambda-x86-architecture` |
| [Lambda functions with potentially oversized memory](https://leftsize.com/rules/aws/lambda-oversized-memory/) | Free | `leftsize-lambda-oversized-memory` |
| [Non-prod EC2 instances without scheduled shutdown](https://leftsize.com/rules/aws/ec2-scheduled-shutdown-missing/) | Free | `leftsize-ec2-scheduled-shutdown-missing` |
| [Orphaned EBS snapshots](https://leftsize.com/rules/aws/orphaned-ebs-snapshots/) | Free | `leftsize-orphaned-ebs-snapshots` |
| [Orphaned RDS snapshots (source DB deleted)](https://leftsize.com/rules/aws/orphaned-rds-snapshots/) | Free | `leftsize-orphaned-rds-snapshots` |
| [RDS instances not using Graviton](https://leftsize.com/rules/aws/rds-non-graviton/) | Free | `leftsize-rds-non-graviton` |
| [RDS instances using io1/io2 - consider gp3](https://leftsize.com/rules/aws/rds-suboptimal-storage-type/) | Free | `leftsize-rds-suboptimal-storage-type` |
| [RDS instances with excessive backup retention](https://leftsize.com/rules/aws/rds-excessive-backup-retention/) | Free | `leftsize-rds-excessive-backup-retention` |
| [RDS instances with unnecessary Multi-AZ](https://leftsize.com/rules/aws/rds-multiaz-nonprod/) | Free | `leftsize-rds-multiaz-nonprod` |
| [S3 buckets accumulating incomplete multipart uploads](https://leftsize.com/rules/aws/s3-incomplete-multipart-uploads/) | Free | `leftsize-s3-incomplete-multipart-uploads` |
| [S3 buckets missing lifecycle policy](https://leftsize.com/rules/aws/s3-missing-lifecycle-policy/) | Free | `leftsize-s3-missing-lifecycle-policy` |
| [S3 buckets without Bucket Key (savings vary by usage)](https://leftsize.com/rules/aws/s3-missing-bucket-key/) | Free | `leftsize-s3-missing-bucket-key` |
| [Stopped RDS instances (AWS restarts them automatically after 7 days)](https://leftsize.com/rules/aws/rds-auto-restart-pending/) | Free | `leftsize-rds-auto-restart-pending` |
| [Unattached EBS volumes](https://leftsize.com/rules/aws/unattached-ebs-volume/) | Free | `leftsize-unattached-ebs-volume` |
| [Underutilized ElastiCache clusters](https://leftsize.com/rules/aws/elasticache-underutilized/) | Free | `leftsize-elasticache-underutilized` |
| [Unused AMIs keeping EBS snapshots](https://leftsize.com/rules/aws/unused-ami/) | Free | `leftsize-unused-ami` |
| [Unused Classic Load Balancers](https://leftsize.com/rules/aws/unused-load-balancer/) | Free | `leftsize-unused-load-balancer` |
| [Unused Elastic IPs](https://leftsize.com/rules/aws/unused-elastic-ip/) | Free | `leftsize-unused-elastic-ip` |
| [Unused Lambda functions (zero invocations in 30 days)](https://leftsize.com/rules/aws/unused-lambda-function/) | Free | `leftsize-unused-lambda-function` |
| [Unused Secrets Manager secrets](https://leftsize.com/rules/aws/secrets-manager-unused/) | Free | `leftsize-secrets-manager-unused` |
| [Versioned S3 buckets without version expiration](https://leftsize.com/rules/aws/s3-non-current-versions/) | Free | `leftsize-s3-non-current-versions` |
| [VPCs without S3 Gateway Endpoint (NAT data processing costs)](https://leftsize.com/rules/aws/missing-vpc-endpoint-s3/) | Free | `leftsize-missing-vpc-endpoint-s3` |

### AWS deprecations & retirements (32)

| Rule | Plan | Rule ID |
|---|---|---|
| [Amazon Cloud Directory directories — end of support July 24, 2027](https://leftsize.com/rules/aws/cloud-directory-end-of-support/) | Team | `leftsize-cloud-directory-end-of-support` |
| [Amazon Pinpoint apps affected by Pinpoint end of support (October 30, 2026)](https://leftsize.com/rules/aws/pinpoint-deprecated/) | Team | `leftsize-pinpoint-deprecated` |
| [ARC readiness checks — readiness check is in maintenance, no end date announced](https://leftsize.com/rules/aws/arc-readiness-check-maintenance/) | Team | `leftsize-arc-readiness-check-maintenance` |
| [AWS Batch compute environments on Amazon Linux 2 AMIs — support ended Jun 30, 2026](https://leftsize.com/rules/aws/batch-compute-al2-ami/) | Team | `leftsize-batch-compute-al2-ami` |
| [CloudSearch domains — CloudSearch is in maintenance, no end date announced](https://leftsize.com/rules/aws/cloudsearch-maintenance/) | Team | `leftsize-cloudsearch-maintenance` |
| [DMS replication instances on an End-of-Life engine version — EOL March 31, 2027 (3.5.4); already passed for older versions](https://leftsize.com/rules/aws/dms-replication-engine-eol/) | Team | `leftsize-dms-replication-engine-eol` |
| [DocumentDB 3.6 instances billed for Extended Support (standard support ended Mar 30, 2026)](https://leftsize.com/rules/aws/docdb-36-extended-support/) | Team | `leftsize-docdb-36-extended-support` |
| [EC2 instances on Amazon Linux 2 — end of support was Jun 30, 2026](https://leftsize.com/rules/aws/ec2-amazon-linux-2-eol/) | Team | `leftsize-ec2-amazon-linux-2-eol` |
| [EKS clusters on Kubernetes 1.34 or older — extended support costs $0.60/hr vs $0.10/hr (1.34 from Dec 2, 2026)](https://leftsize.com/rules/aws/eks-outdated-version/) | Team | `leftsize-eks-outdated-version` |
| [EKS node groups on Amazon Linux 2 AMIs — unsupported since Nov 26, 2025](https://leftsize.com/rules/aws/eks-nodegroup-al2-ami/) | Team | `leftsize-eks-nodegroup-al2-ami` |
| [Elastic Beanstalk environments on a retired Linux platform branch — no security updates (AL2 retired Aug 6, 2026)](https://leftsize.com/rules/aws/elasticbeanstalk-retired-linux-platform/) | Team | `leftsize-elasticbeanstalk-retired-linux-platform` |
| [Elastic Beanstalk environments on Windows Server 2016 — AMIs inaccessible from Jan 15, 2027](https://leftsize.com/rules/aws/elasticbeanstalk-windows-2016-platform/) | Team | `leftsize-elasticbeanstalk-windows-2016-platform` |
| [ElastiCache Redis OSS 6 nodes: standard support ends Jan 31, 2027, +80% Extended Support premium from Feb 1, 2027](https://leftsize.com/rules/aws/elasticache-redis6-end-of-standard-support/) | Team | `leftsize-elasticache-redis6-end-of-standard-support` |
| [ElastiCache Redis OSS nodes on v5 or older billed for Extended Support (+80% node price, +160% from Feb 1, 2028)](https://leftsize.com/rules/aws/elasticache-eol-redis/) | Team | `leftsize-elasticache-eol-redis` |
| [EMR clusters on an unsupported release — End of Support passed Sep 1, 2026 — End of Life Sep 1, 2027](https://leftsize.com/rules/aws/emr-release-end-of-support/) | Team | `leftsize-emr-release-end-of-support` |
| [EMR clusters on emr-5.36 / 6.6 – 6.15 — support ends June 30, 2027](https://leftsize.com/rules/aws/emr-release-support-ending-2027/) | Team | `leftsize-emr-release-support-ending-2027` |
| [Glue jobs on an End-of-Life Glue version — EOL passed (Apr 1 / Jun 1, 2026)](https://leftsize.com/rules/aws/glue-job-eol-version/) | Team | `leftsize-glue-job-eol-version` |
| [Kendra indexes — Kendra is in maintenance, no end date announced](https://leftsize.com/rules/aws/kendra-maintenance/) | Team | `leftsize-kendra-maintenance` |
| [Lambda functions on a deprecated or soon-deprecated runtime — updates blocked from Aug 31, 2027](https://leftsize.com/rules/aws/lambda-deprecated-runtime/) | Team | `leftsize-lambda-deprecated-runtime` |
| [MSK clusters on an end-of-support Kafka version — auto-upgrade can happen at any time](https://leftsize.com/rules/aws/msk-kafka-version-end-of-support/) | Team | `leftsize-msk-kafka-version-end-of-support` |
| [MWAA environments on an end-of-support Airflow version — EOS passed, AWS may restrict legacy versions at any time](https://leftsize.com/rules/aws/mwaa-airflow-version-end-of-support/) | Team | `leftsize-mwaa-airflow-version-end-of-support` |
| [Neptune instances on engine versions reaching end of life (Dec 4, 2026 / Mar 6, 2027)](https://leftsize.com/rules/aws/neptune-engine-end-of-life/) | Team | `leftsize-neptune-engine-end-of-life` |
| [OpenSearch domains in paid Extended Support: surcharge = 100% of instance cost from Nov 7, 2026](https://leftsize.com/rules/aws/opensearch-outdated-version/) | Team | `leftsize-opensearch-outdated-version` |
| [PostgreSQL 11 DB instances: Extended Support ends Mar 31, 2027, then AWS upgrades automatically](https://leftsize.com/rules/aws/rds-postgres11-end-of-extended-support/) | Team | `leftsize-rds-postgres11-end-of-extended-support` |
| [PostgreSQL 14 DB instances: standard support ends Feb 28, 2027, Extended Support charges from Mar 1, 2027](https://leftsize.com/rules/aws/rds-postgres14-end-of-standard-support/) | Team | `leftsize-rds-postgres14-end-of-standard-support` |
| [RDS Custom for Oracle instances: service ends Mar 31, 2027](https://leftsize.com/rules/aws/rds-custom-oracle-end-of-support/) | Team | `leftsize-rds-custom-oracle-end-of-support` |
| [RDS for MariaDB instances on 10.6 or older: standard support ends Dec 31, 2026 (no Extended Support)](https://leftsize.com/rules/aws/rds-mariadb-end-of-support/) | Team | `leftsize-rds-mariadb-end-of-support` |
| [RDS SQL Server 2016 instances: support ended Jul 14, 2026, automatic upgrade to SQL Server 2019 pending](https://leftsize.com/rules/aws/rds-sqlserver-2016-end-of-support/) | Team | `leftsize-rds-sqlserver-2016-end-of-support` |
| [RDS/Aurora DB instances billed for Extended Support now (MySQL 5.7/8.0, PostgreSQL 12/13)](https://leftsize.com/rules/aws/rds-outdated-version/) | Team | `leftsize-rds-outdated-version` |
| [Simple AD directories — Simple AD is in maintenance, no end date announced](https://leftsize.com/rules/aws/simple-ad-maintenance/) | Team | `leftsize-simple-ad-maintenance` |
| [Timestream LiveAnalytics databases on a service closed to new customers](https://leftsize.com/rules/aws/timestream-deprecated/) | Team | `leftsize-timestream-deprecated` |
| [WorkSpaces still on PCoIP — end of support Oct 31, 2027](https://leftsize.com/rules/aws/workspaces-pcoip-end-of-support/) | Team | `leftsize-workspaces-pcoip-end-of-support` |

### AWS security (13)

| Rule | Plan | Rule ID |
|---|---|---|
| [AMIs marked as public](https://leftsize.com/rules/aws/ami-public/) | Team | `leftsize-ami-public` |
| [EBS snapshots shared publicly](https://leftsize.com/rules/aws/ebs-snapshot-public/) | Team | `leftsize-ebs-snapshot-public` |
| [EBS volumes without encryption](https://leftsize.com/rules/aws/unencrypted-ebs-volumes/) | Team | `leftsize-unencrypted-ebs-volumes` |
| [IAM users inactive for 90+ days](https://leftsize.com/rules/aws/iam-unused-user/) | Team | `leftsize-iam-unused-user` |
| [IAM users with unused access keys (90+ days)](https://leftsize.com/rules/aws/iam-unused-access-key/) | Team | `leftsize-iam-unused-access-key` |
| [IAM users without MFA enabled](https://leftsize.com/rules/aws/iam-user-without-mfa/) | Team | `leftsize-iam-user-without-mfa` |
| [RDS instances publicly accessible](https://leftsize.com/rules/aws/rds-publicly-accessible/) | Team | `leftsize-rds-publicly-accessible` |
| [RDS instances without storage encryption](https://leftsize.com/rules/aws/unencrypted-rds-instances/) | Team | `leftsize-unencrypted-rds-instances` |
| [RDS snapshots shared publicly](https://leftsize.com/rules/aws/rds-snapshot-public/) | Team | `leftsize-rds-snapshot-public` |
| [S3 buckets without access logging](https://leftsize.com/rules/aws/s3-bucket-logging-disabled/) | Team | `leftsize-s3-bucket-logging-disabled` |
| [S3 buckets without full Block Public Access](https://leftsize.com/rules/aws/public-s3-access/) | Team | `leftsize-public-s3-access` |
| [Security groups allowing internet traffic to sensitive ports](https://leftsize.com/rules/aws/open-security-groups/) | Team | `leftsize-open-security-groups` |
| [VPCs without flow logs enabled](https://leftsize.com/rules/aws/vpc-flow-logs-disabled/) | Team | `leftsize-vpc-flow-logs-disabled` |

### AWS governance (6)

| Rule | Plan | Rule ID |
|---|---|---|
| [ACM certificates expiring soon](https://leftsize.com/rules/aws/acm-certificate-expiring/) | Team | `leftsize-acm-certificate-expiring` |
| [Resources missing ownership tags: Classic Load Balancers](https://leftsize.com/rules/aws/missing-ownership-tags-elb/) | Team | `leftsize-missing-ownership-tags-elb` |
| [Resources missing ownership tags: EBS volumes](https://leftsize.com/rules/aws/missing-ownership-tags-ebs/) | Team | `leftsize-missing-ownership-tags-ebs` |
| [Resources missing ownership tags: EC2 instances](https://leftsize.com/rules/aws/missing-ownership-tags/) | Team | `leftsize-missing-ownership-tags` |
| [Resources missing ownership tags: RDS instances](https://leftsize.com/rules/aws/missing-ownership-tags-rds/) | Team | `leftsize-missing-ownership-tags-rds` |
| [Resources missing ownership tags: S3 buckets](https://leftsize.com/rules/aws/missing-ownership-tags-s3/) | Team | `leftsize-missing-ownership-tags-s3` |

## Azure

### Azure cost optimization (31)

| Rule | Plan | Rule ID |
|---|---|---|
| [AKS clusters with low node CPU and memory usage](https://leftsize.com/rules/azure/overprovisioned-aks-nodes/) | Free | `leftsize-overprovisioned-aks-nodes` |
| [AKS clusters without autoscaler](https://leftsize.com/rules/azure/aks-cluster-autoscaler-disabled/) | Free | `leftsize-aks-cluster-autoscaler-disabled` |
| [AKS node pools on expensive VM sizes](https://leftsize.com/rules/azure/aks-using-expensive-vm-sizes/) | Free | `leftsize-aks-using-expensive-vm-sizes` |
| [App Service Plans on Basic/Standard - review Premium v3](https://leftsize.com/rules/azure/outdated-app-service-plan/) | Free | `leftsize-outdated-app-service-plan` |
| [Azure Bastion hosts with no sessions in 7 days](https://leftsize.com/rules/azure/bastion-idle/) | Free | `leftsize-bastion-idle` |
| [Azure Container Registries without retention policy](https://leftsize.com/rules/azure/acr-no-lifecycle-policy/) | Free | `leftsize-acr-no-lifecycle-policy` |
| [Azure Load Balancers with no backend members](https://leftsize.com/rules/azure/inactive-azure-load-balancer/) | Free | `leftsize-inactive-azure-load-balancer` |
| [Azure SQL Databases on the DTU purchasing model](https://leftsize.com/rules/azure/sql-database-dtu-model/) | Free | `leftsize-sql-database-dtu-model` |
| [Cosmos DB accounts with overprovisioned throughput](https://leftsize.com/rules/azure/cosmos-overprovisioned-throughput/) | Free | `leftsize-cosmos-overprovisioned-throughput` |
| [Disk snapshots older than 30 days](https://leftsize.com/rules/azure/orphaned-snapshots/) | Free | `leftsize-orphaned-snapshots` |
| [Disks attached to deallocated VMs](https://leftsize.com/rules/azure/disk-attached-to-deallocated-vm/) | Free | `leftsize-disk-attached-to-deallocated-vm` |
| [Empty App Service Plans](https://leftsize.com/rules/azure/idle-app-service-plan-no-apps/) | Free | `leftsize-idle-app-service-plan-no-apps` |
| [Empty SQL Elastic Pools](https://leftsize.com/rules/azure/sql-elastic-pool-empty/) | Free | `leftsize-sql-elastic-pool-empty` |
| [Idle Application Gateways](https://leftsize.com/rules/azure/app-gateway-idle/) | Free | `leftsize-app-gateway-idle` |
| [Idle VMs](https://leftsize.com/rules/azure/idle-vm/) | Free | `leftsize-idle-vm` |
| [Linux VMs that could move to Arm64 sizes](https://leftsize.com/rules/azure/vm-arm-architecture/) | Free | `leftsize-vm-arm-architecture` |
| [Non-prod VMs without auto-shutdown](https://leftsize.com/rules/azure/vm-scheduled-shutdown-missing/) | Free | `leftsize-vm-scheduled-shutdown-missing` |
| [Non-production AKS clusters running outside working hours](https://leftsize.com/rules/azure/aks-dev-clusters-always-running/) | Free | `leftsize-aks-dev-clusters-always-running` |
| [Overprovisioned SQL databases](https://leftsize.com/rules/azure/azure-sql-overprovisioned/) | Free | `leftsize-azure-sql-overprovisioned` |
| [SQL databases with unnecessary Business Critical tier](https://leftsize.com/rules/azure/sql-business-critical-nonprod/) | Free | `leftsize-sql-business-critical-nonprod` |
| [SQL databases without Azure Hybrid Benefit](https://leftsize.com/rules/azure/sql-hybrid-benefit-missing/) | Free | `leftsize-sql-hybrid-benefit-missing` |
| [Stopped VMs still incurring storage costs](https://leftsize.com/rules/azure/stopped-vm-storage-costs/) | Free | `leftsize-stopped-vm-storage-costs` |
| [Storage accounts in regions with an 8–17% price increase from Feb 1, 2027](https://leftsize.com/rules/azure/storage-regional-price-increase-2027/) | Free | `leftsize-storage-regional-price-increase-2027` |
| [Storage accounts on Hot tier with almost no activity](https://leftsize.com/rules/azure/storage-suboptimal-tier/) | Free | `leftsize-storage-suboptimal-tier` |
| [Storage accounts paying the SFTP hourly charge](https://leftsize.com/rules/azure/storage-sftp-enabled/) | Free | `leftsize-storage-sftp-enabled` |
| [Unattached disks](https://leftsize.com/rules/azure/unattached-disk/) | Free | `leftsize-unattached-disk` |
| [Underutilized App Service Plans](https://leftsize.com/rules/azure/idle-app-service-plan/) | Free | `leftsize-idle-app-service-plan` |
| [Underutilized Redis Caches](https://leftsize.com/rules/azure/redis-cache-underutilized/) | Free | `leftsize-redis-cache-underutilized` |
| [Unused public IPs](https://leftsize.com/rules/azure/unused-public-ip/) | Free | `leftsize-unused-public-ip` |
| [VMs in regions with an 8–17% price increase from Feb 1, 2027](https://leftsize.com/rules/azure/vm-regional-price-increase-2027/) | Free | `leftsize-vm-regional-price-increase-2027` |
| [Windows VMs without Azure Hybrid Benefit](https://leftsize.com/rules/azure/hybrid-benefit-missing/) | Free | `leftsize-hybrid-benefit-missing` |

### Azure deprecations & retirements (38)

| Rule | Plan | Rule ID |
|---|---|---|
| [Accounts of retired Azure AI services (LUIS, QnA Maker, Anomaly Detector, Metrics Advisor, Personalizer) - already retired](https://leftsize.com/rules/azure/ai-services-retired/) | Team | `leftsize-ai-services-retired` |
| [AKS clusters on Kubernetes versions out of support or ending by Nov 30, 2026](https://leftsize.com/rules/azure/aks-outdated-version/) | Team | `leftsize-aks-outdated-version` |
| [AKS clusters using kubenet networking — migrate to Azure CNI Overlay before Mar 31, 2028](https://leftsize.com/rules/azure/aks-kubenet-retirement/) | Team | `leftsize-aks-kubenet-retirement` |
| [AKS clusters using the Open Service Mesh add-on — retired Sep 30, 2027](https://leftsize.com/rules/azure/aks-open-service-mesh-retirement/) | Team | `leftsize-aks-open-service-mesh-retirement` |
| [AKS clusters with Azure Linux 2.0 node pools — images removed from Oct 31, 2026](https://leftsize.com/rules/azure/aks-azure-linux-2-node-pools/) | Team | `leftsize-aks-azure-linux-2-node-pools` |
| [AKS clusters with node pools on VM sizes that retire between March 2027 and November 2029](https://leftsize.com/rules/azure/aks-node-pool-retiring-size/) | Team | `leftsize-aks-node-pool-retiring-size` |
| [AKS clusters with Ubuntu 20.04 node pools — images deleted Mar 17, 2027](https://leftsize.com/rules/azure/aks-ubuntu-2004-node-pools/) | Team | `leftsize-aks-ubuntu-2004-node-pools` |
| [AKS clusters with Ubuntu 22.04 node pools — unsupported Jun 30, 2027](https://leftsize.com/rules/azure/aks-ubuntu-2204-node-pools/) | Team | `leftsize-aks-ubuntu-2204-node-pools` |
| [AKS clusters with unsupported Windows node pools (WS2019 / Annual Channel) — migrate to Windows Server 2022/2025](https://leftsize.com/rules/azure/aks-windows-unsupported-node-pools/) | Team | `leftsize-aks-windows-unsupported-node-pools` |
| [Application Gateways still on the retired V1 SKU (retired Apr 28, 2026) — migrate to V2 now](https://leftsize.com/rules/azure/appgateway-v1-deprecated/) | Team | `leftsize-appgateway-v1-deprecated` |
| [Application Gateways using legacy WAF configuration — upgrade to WAF policy before Mar 15, 2027](https://leftsize.com/rules/azure/appgateway-waf-config-retirement/) | Team | `leftsize-appgateway-waf-config-retirement` |
| [Azure Cache for Redis Enterprise caches — migrate to Azure Managed Redis before Mar 31, 2027](https://leftsize.com/rules/azure/redis-enterprise-retirement/) | Team | `leftsize-redis-enterprise-retirement` |
| [Azure Cache for Redis instances — migrate to Azure Managed Redis before Sep 30, 2028](https://leftsize.com/rules/azure/redis-cache-retirement/) | Team | `leftsize-redis-cache-retirement` |
| [Azure CDN Standard from Microsoft (classic) profiles — migrate to Front Door before Sep 30, 2027](https://leftsize.com/rules/azure/cdn-classic-retirement/) | Team | `leftsize-cdn-classic-retirement` |
| [Azure Front Door (classic) profiles — migrate to Standard/Premium before Mar 31, 2027](https://leftsize.com/rules/azure/front-door-classic-retirement/) | Team | `leftsize-front-door-classic-retirement` |
| [Azure Spring Apps instances - service retires Mar 31, 2028, migrate to Azure Container Apps](https://leftsize.com/rules/azure/spring-apps-retirement/) | Team | `leftsize-spring-apps-retirement` |
| [Basic Load Balancers — retired Sep 30, 2025, unsupported with no SLA](https://leftsize.com/rules/azure/basic-loadbalancer-deprecated/) | Team | `leftsize-basic-loadbalancer-deprecated` |
| [Basic SKU public IPs still in use (retired Sep 30, 2025) — upgrade to Standard](https://leftsize.com/rules/azure/basic-public-ip-retired/) | Team | `leftsize-basic-public-ip-retired` |
| [Cloud Services (extended support) deployments - retires Mar 31, 2027, no extensions](https://leftsize.com/rules/azure/cloud-services-extended-support-retirement/) | Team | `leftsize-cloud-services-extended-support-retirement` |
| [Content Moderator accounts - service retires Mar 15, 2027, migrate to Azure AI Content Safety](https://leftsize.com/rules/azure/content-moderator-retirement/) | Team | `leftsize-content-moderator-retirement` |
| [Function apps on language versions out of support by Nov 10, 2026](https://leftsize.com/rules/azure/functions-linux-language-end-of-support/) | Team | `leftsize-functions-linux-language-end-of-support` |
| [Function apps on the .NET in-process model - support ends Nov 10, 2026](https://leftsize.com/rules/azure/functions-dotnet-inprocess-end-of-support/) | Team | `leftsize-functions-dotnet-inprocess-end-of-support` |
| [GPv1 / legacy Blob Storage accounts retired Oct 13, 2026 — upgrade to GPv2](https://leftsize.com/rules/azure/storage-legacy-account-retirement/) | Team | `leftsize-storage-legacy-account-retirement` |
| [HDInsight clusters on 4.0/5.0 — retired Mar 31, 2025, migrate to 5.1](https://leftsize.com/rules/azure/hdinsight-retired-version/) | Team | `leftsize-hdinsight-retired-version` |
| [Linux Consumption Functions plans - migrate to Flex Consumption before Sep 30, 2028](https://leftsize.com/rules/azure/functions-linux-consumption-retirement/) | Team | `leftsize-functions-linux-consumption-retirement` |
| [MariaDB servers still present — service retired Sep 19, 2025, export data now](https://leftsize.com/rules/azure/mariadb-deprecated/) | Team | `leftsize-mariadb-deprecated` |
| [MySQL flexible servers in or entering paid extended support (5.7 billed since Oct 1, 2026; 8.0 from Feb 1, 2027)](https://leftsize.com/rules/azure/mysql-flexible-extended-support/) | Team | `leftsize-mysql-flexible-extended-support` |
| [NSGs with NSG flow logs — migrate to VNet flow logs before Sep 30, 2027](https://leftsize.com/rules/azure/nsg-flow-logs-retirement/) | Team | `leftsize-nsg-flow-logs-retirement` |
| [OS disks using Standard HDD — migrate before Sep 8, 2028](https://leftsize.com/rules/azure/hdd-os-disk-retirement/) | Team | `leftsize-hdd-os-disk-retirement` |
| [PostgreSQL flexible servers in or entering paid extended support (PG 11–13 billed since Sep 1, 2026; PG 14 from Feb 1, 2027)](https://leftsize.com/rules/azure/postgresql-flexible-extended-support/) | Team | `leftsize-postgresql-flexible-extended-support` |
| [VM scale sets on VM sizes that retire between March 2027 and November 2029](https://leftsize.com/rules/azure/vmss-retiring-size/) | Team | `leftsize-vmss-retiring-size` |
| [VMs on Av2/B/F/Fsv2/G/Lsv2 sizes retiring November 15, 2028](https://leftsize.com/rules/azure/vm-series-retirement-2028-11/) | Team | `leftsize-vm-series-retirement-2028-11` |
| [VMs on D/Ds/Dv2/Dsv2/Ls sizes retiring May 1, 2028](https://leftsize.com/rules/azure/vm-series-retirement-2028-05/) | Team | `leftsize-vm-series-retirement-2028-05` |
| [VMs on Dv3/Dsv3/Ev3/Esv3 sizes retiring November 15, 2029](https://leftsize.com/rules/azure/vm-v3-series-retirement-2029/) | Team | `leftsize-vm-v3-series-retirement-2029` |
| [VMs on M192i*_v2 sizes retiring March 31, 2027](https://leftsize.com/rules/azure/vm-m192i-v2-retirement/) | Team | `leftsize-vm-m192i-v2-retirement` |
| [VMs on NP/HC/HBv2 sizes retiring May 31, 2027](https://leftsize.com/rules/azure/vm-hpc-fpga-retirement-2027/) | Team | `leftsize-vm-hpc-fpga-retirement-2027` |
| [VMs on retired NVv3/NVv4 sizes (retired Sep 30, 2026) — resize required](https://leftsize.com/rules/azure/nvv4-series-retirement/) | Team | `leftsize-nvv4-series-retirement` |
| [VMs still on unmanaged disks (retired Mar 31, 2026) — convert to managed disks](https://leftsize.com/rules/azure/unmanaged-disks-retirement/) | Team | `leftsize-unmanaged-disks-retirement` |

### Azure security (14)

| Rule | Plan | Rule ID |
|---|---|---|
| [AKS clusters with local accounts enabled](https://leftsize.com/rules/azure/aks-local-accounts-enabled/) | Team | `leftsize-aks-local-accounts-enabled` |
| [Defender plans turned off](https://leftsize.com/rules/azure/defender-for-cloud-disabled/) | Team | `leftsize-defender-for-cloud-disabled` |
| [Key Vaults without purge protection](https://leftsize.com/rules/azure/keyvault-purge-protection-disabled/) | Team | `leftsize-keyvault-purge-protection-disabled` |
| [Managed disks not using a customer-managed key](https://leftsize.com/rules/azure/unencrypted-disks/) | Team | `leftsize-unencrypted-disks` |
| [Network security groups allowing internet traffic to sensitive ports](https://leftsize.com/rules/azure/open-network-ports/) | Team | `leftsize-open-network-ports` |
| [SQL servers open to the whole internet](https://leftsize.com/rules/azure/sql-server-open-to-internet/) | Team | `leftsize-sql-server-open-to-internet` |
| [SQL servers without auditing](https://leftsize.com/rules/azure/sql-auditing-disabled/) | Team | `leftsize-sql-auditing-disabled` |
| [Storage accounts accepting unencrypted HTTP](https://leftsize.com/rules/azure/storage-http-allowed/) | Team | `leftsize-storage-http-allowed` |
| [Storage accounts allowing anonymous blob access](https://leftsize.com/rules/azure/anonymous-blob-access/) | Team | `leftsize-anonymous-blob-access` |
| [Storage accounts allowing Shared Key access](https://leftsize.com/rules/azure/storage-shared-key-access-enabled/) | Team | `leftsize-storage-shared-key-access-enabled` |
| [Storage accounts reachable from all networks](https://leftsize.com/rules/azure/storage-public-network-access/) | Team | `leftsize-storage-public-network-access` |
| [Storage accounts with a minimum TLS version below 1.2](https://leftsize.com/rules/azure/storage-outdated-tls/) | Team | `leftsize-storage-outdated-tls` |
| [Web apps accepting plain HTTP](https://leftsize.com/rules/azure/webapp-https-only-disabled/) | Team | `leftsize-webapp-https-only-disabled` |
| [Web apps allowing TLS 1.0 or 1.1](https://leftsize.com/rules/azure/webapp-outdated-tls/) | Team | `leftsize-webapp-outdated-tls` |

### Azure governance (8)

| Rule | Plan | Rule ID |
|---|---|---|
| [Attached disks on Standard HDD (Standard_LRS)](https://leftsize.com/rules/azure/standard-lrs-attached-disk/) | Team | `leftsize-standard-lrs-attached-disk` |
| [Key Vault certificates expiring soon](https://leftsize.com/rules/azure/keyvault-cert-expiring/) | Team | `leftsize-keyvault-cert-expiring` |
| [Resources missing ownership tags: AKS clusters](https://leftsize.com/rules/azure/missing-ownership-tags-aks/) | Team | `leftsize-missing-ownership-tags-aks` |
| [Resources missing ownership tags: managed disks](https://leftsize.com/rules/azure/missing-ownership-tags-disk/) | Team | `leftsize-missing-ownership-tags-disk` |
| [Resources missing ownership tags: resource groups](https://leftsize.com/rules/azure/missing-ownership-tags-resourcegroup/) | Team | `leftsize-missing-ownership-tags-resourcegroup` |
| [Resources missing ownership tags: SQL servers](https://leftsize.com/rules/azure/missing-ownership-tags-sql/) | Team | `leftsize-missing-ownership-tags-sql` |
| [Resources missing ownership tags: storage accounts](https://leftsize.com/rules/azure/missing-ownership-tags-storage/) | Team | `leftsize-missing-ownership-tags-storage` |
| [Resources missing ownership tags: virtual machines](https://leftsize.com/rules/azure/missing-ownership-tags-vm/) | Team | `leftsize-missing-ownership-tags-vm` |

## Skipping rules

Use the rule ID with the `exclude-policies` input, or limit a scan to categories with `include-policies`. See [Can I exclude specific rules?](faq.md#can-i-exclude-specific-rules).