Capability 03 · Cleanup

Safe Cleanup

Remove idle and orphaned cloud resources without the outage: dependencies, last activity and owner sign-off first, then a plan that snapshots, stops before deleting and can be undone.

? Answers: Is it safe to remove?

Get early access CLI vs. Cloud pricing

Cloud Sleuth CLI: A safe-to-remove list for your own accounts, each with its owner, dependencies, last activity and estimated monthly saving.
Cloud Sleuth Cloud: Owner approvals in Slack and Jira, cleanup plans with snapshots, stop-before-delete and undo, and savings tracked over time.
Roadmap: Phase 1: safe-to-remove list with evidence · Phase 2: approvals, snapshots, undo and savings tracking

Finding unused, untagged and zombie resources is where tools in this market most clearly pay for themselves: some reviewers of one popular cloud visibility tool report cutting cloud spend by 20–30%. But the step after finding them is where cleanup stalls. Nobody wants to be the person who deleted the volume a forgotten batch job depended on, and automation that changes things silently makes it worse. One governance tool’s reviewers complain that it “does not provide feedback when it intervenes.”

Cloud Sleuth’s safe cleanup is built for the step after finding: proving a resource is safe to remove, getting the owner’s yes, and doing it in a way that can be undone.

How it works

Evidence for every candidate. Each resource on the safe-to-remove list shows its owner, what connects to it, when it was last used, whether IaC manages it and what it costs each month.
Intent, not just idleness. A resource that is quiet on purpose, such as disaster-recovery capacity or a shared platform service, can carry an exception with a reason and an expiry date, so it doesn’t come back every week and doesn’t stay excused forever.
The owner decides. In Cloud Sleuth Cloud, the cleanup plan goes to the resource’s owner in Slack or Jira. They approve, postpone or reject it in one click.
Reversible by default. Plans snapshot first, stop or scale to zero before anything is deleted, and keep an undo window. Every step is previewed and logged.
Read-only until you say so. Cloud Sleuth works with read-only access. Carrying out approved plans uses a separate, narrowly scoped role that you grant only if you want it to, and you can always export the plan and run it yourself.
Savings you can show. Removed resources and their monthly cost are tracked, so the saving is a number, not an anecdote.

Illustrative example - format not final:

plan: remove ec2 etl-legacy-02 (team-data, $412/mo)
  evidence   no inbound connections in 61 days · not in IaC state
  approval   requested from #team-data
  steps      snapshot vol-0f3c → stop for 14 days → terminate
  undo       restore from snapshot until 2026-11-21

Why it matters

Cost tools tell you a resource looks idle. Without an owner and the evidence, that recommendation gets ignored, because the risk of being wrong is an outage and the reward is a line item. Safe cleanup changes the trade: the owner sees the evidence, approves it in the place they already work, and nothing is permanent until the undo window closes.

For engineering managers, this is the difference between a list of cleanup candidates and knowing which of them are actually safe to remove.

Cloud Sleuth CLI vs. Cloud Sleuth Cloud

The Cloud Sleuth CLI produces a safe-to-remove list for your own AWS accounts and Azure subscriptions, with the evidence and estimated saving for each, and nothing leaves your environment. Cloud Sleuth Cloud is planned to add owner approvals in Slack and Jira, cleanup plans with snapshots, stop-before-delete and undo, and savings tracking.

Both are pre-launch. Get early access to hear first when they are ready.