Auto-Fix

Auto-Fix lets CostLens apply selected recommendations for you, automatically, as soon as they're found — so routine, low-risk waste is remediated without anyone clicking Approve. It is off by default, admin-managed, and deliberately limited to safe, reversible actions.

A good way to think about it: you tell CostLens "for these check types, anything small and routine — just fix it; leave the big, judgement-call changes for me."

Who can use it#

Role	Access
Admin	Full access — view and manage Auto-Fix rules
Operator / Viewer	No access — the page is hidden
Read-only organisations	Blocked — Auto-Fix cannot apply changes on a read-only plan

How it works#

1. CostLens analyses your accounts on its regular schedule (and after a sync).
2. For each new pending recommendation, it checks whether you've enabled an Auto-Fix rule for that check type.
3. If the recommendation passes your rule's guardrails, CostLens either:
   • Simulates it (dry-run) — no change is made, and you're notified to review; or
   • Applies it — the same action as approving the fix yourself, attributed to the admin who configured the rule.
4. Every action is written to your organisation's audit log and a notification is sent. Applied fixes remain roll-back-able for 24 hours.

Which recommendations are eligible#

Auto-Fix only ever runs reversible or non-destructive remediations:

Eligible check	What Auto-Fix does
EC2 Rightsizing	Resizes the instance to the recommended type
EBS gp2 → gp3 Migration	Migrates the volume type in place
EBS High Disk Usage	Expands the volume (and grows the filesystem)
EC2 Instance Scheduling	Applies the start/stop schedule
RDS Instance Scheduling	Applies the start/stop schedule
CloudWatch Log Retention	Sets a log-retention policy

Actions that permanently delete or release resources are never eligible for Auto-Fix and must always be applied manually:

• Unused EBS Volume (delete)
• Orphaned EBS Snapshots (delete)
• Unattached Elastic IP (release)
• Stopped EC2 Instance (terminate)

Configuring a rule#

Each eligible check has its own card. Turn it on, then set the controls.

Quick setup (presets)#

Not sure where to start? Use a one-click preset to fill the form with a safe baseline, then review and Save:

• Conservative — dry-run only (simulate, never change), small savings cap, longer observation window.
• Balanced — live apply with a moderate savings cap, an off-hours maintenance window, and a small per-run limit.
• Aggressive — live apply with no savings cap and a shorter observation window.

All presets keep production excluded by default. Presets just populate the controls — nothing is saved or applied until you click Save.

Auto-apply fixes saving up to ($/mo)#

The single "how big a change" lever, in plain dollars: Auto-Fix will only auto-apply a fix whose estimated monthly savings is at or below this amount — bigger fixes are left in the Recommendations list for you to review. Leave it blank to allow any size. (Larger savings generally mean larger changes, so this one number caps the blast radius.)

Maintenance window (UTC)#

Restrict live changes to a safe window: pick the days of the week (e.g. Sun, Sat) and a start/end hour in UTC. Outside the window, eligible fixes are deferred to the next run inside it. Simulations (dry-run) still run any time. Leave days unselected to mean "every day".

Dry-run only#

When on (the default for new rules), Auto-Fix simulates the fix and notifies you — it never changes anything in AWS. Turn it off to let Auto-Fix make real changes. Start with dry-run to see exactly what would happen before going live.

EBS expand increment (EBS High Disk Usage only)#

How much to grow the volume — the default (+20%), a custom percent, or a fixed number of GB.

Knowing what's in scope — Inclusion & Exclusion lists#

You don't have to enable a rule to see what it would affect. Each rule card has a Detected resources panel that scans your current findings and auto-sorts every matching resource into two lists:

• Inclusion — resources that would be auto-fixed. Each row shows the savings and the exact decision (would apply / would simulate / skipped — reason, e.g. above $/mo cap, risk guard, outside maintenance window).
• Exclusion — resources held back. Production-tagged resources land here automatically (with a prod badge).

You stay in control: move any resource between the lists with one click — Include a production resource to auto-fix it, or Exclude a non-production one to protect it. Moves persist immediately to the rule's inclusion/exclusion lists (and a reset link reverts a resource to its automatic category). Manual ID lists are also available under Advanced safeguards for resources you want to pin without waiting for them to be detected.

The panel spans all of your connected AWS accounts and lists every auto-fixable category — including those with 0 matching findings right now (empty simply means the analysis hasn't produced pending recommendations of that type yet, not a scoping limit). It reflects your saved settings and refreshes after each change. After runs, the same actions appear in Fix History and notifications.

Setting it up#

Safety, audit & rollback#

• Reversible-only: Auto-Fix is restricted to a fixed allowlist of safe remediations; destructive actions are never automated.
• Guardrails: a per-fix savings cap bounds how large a change Auto-Fix can make unattended, and production resources are auto-excluded by default.
• Dry-run default: new rules simulate until you explicitly enable live apply.
• 24-hour rollback: auto-applied fixes can be undone from Fix History within 24 hours, exactly like manually applied fixes.
• Automatic rollback on regression: for EC2 right-sizing, CostLens watches the instance after the change and reverts automatically if it degrades (see below).
• Audit trail: every rule change and every auto-applied fix is recorded in your organisation's audit log (look for Fix Auto-Applied and Auto-Fix Rule entries).
• Notifications: admins are notified each time Auto-Fix applies or simulates fixes on an account.

Safeguards for right-sizing & scaling#

Beyond the core controls, Auto-Fix applies a set of safeguards to every eligible check (EC2, RDS scheduling, EBS, CloudWatch, …) — not just one resource type. Configure them under Advanced safeguards on each rule.

• Decision-time data rigor — set a minimum observation window (e.g. 14–30 days) so Auto-Fix never acts on a short-lived spike or dip. Utilization-driven checks should be judged on peak/p95/p99, not just averages.
• Dependency & risk guards — Auto-Fix automatically skips changes that could break interconnected systems: EC2 instances in an Auto Scaling Group (resize the launch template instead), cross-architecture resizes (Intel ↔ Graviton/ARM), CPU-only signals where memory metrics are missing, and (for any future RDS class change) non-Multi-AZ instances or those with read replicas.
• Production excluded by default — resources detected as production (by Environment/env tag, an environment of prod/production, or a prod in the name) are automatically left out of Auto-Fix. They show as "skipped — production" in the preview. To auto-fix a specific production resource, add its ID to the inclusion list; to allow all production resources for a rule, turn on Allow production.
• Inclusion & exclusion lists — detected resources are auto-sorted into these two lists (production → Exclusion); move any resource between them from the Detected resources panel, or pin IDs manually under Advanced safeguards. The inclusion list opts a resource back in (overriding the production default); the exclusion list opts it out permanently (and always wins).
• Tag-based scoping — instead of listing individual IDs, scope by AWS tag: Exclude by tag (e.g. team=payments, or a bare temporary) hard-excludes any matching resource; Include by tag (e.g. tier=batch) opts matching resources back in over the production default. Precedence: ID-exclude → ID-include → tag-exclude → production default (liftable by include-tag or Allow production).
• Maintenance window — restrict live changes to off-hours (UTC); simulations still run any time.
• Staged rollout — cap fixes per run so changes roll out gradually rather than all at once.
• Backup awareness — for stateful changes, take your own snapshot/backup first; CostLens shows the warning and never assumes responsibility for your data.

Where to see results#

• Impact summary — at the top of the Auto-Fix page: realised monthly savings attributable to Auto-Fix, fixes applied, simulations, rollbacks (including automatic ones), success rate, and estimated analyst-hours saved.
• Fix History (/fixes) — every auto-applied fix appears here with its before/after state and a Rollback button while it's within the 24-hour window.
• Notifications — a summary is sent after each run that applies or simulates fixes, and whenever a change is auto-rolled-back.
• Audit Log — rule changes, auto-applied fixes, and auto-rollbacks are recorded for compliance.