Cloud Sleuth

Cloud Sleuth positions itself as a live map of your cloud estate. You connect AWS accounts and Azure subscriptions in read-only mode, and the service draws an inventory of everything running, from EC2 instances and S3 buckets to unattached disks and shared VPCs. The emphasis is on visibility across multiple accounts and subscriptions rather than on provisioning or deployment.

The core capability is ownership resolution. Beyond reading tags, Cloud Sleuth infers owners from CloudTrail creator events, Terraform state and resource naming, then labels each resource as owner-inferred, safe-to-remove, no-owner or shared. A scan summary reports how many resources were inventoried, how many owners came from tags versus inference, and how much spend remains unallocated.

Queries can be issued in SQL, plain English or through an AI agent, which makes ad-hoc questions about cost and ownership practical without writing custom scripts. A free CLI handles local scans, while the hosted Cloud product is flat-priced, so cost does not scale with resource count.

It fits platform engineers, cloud operations and FinOps analysts who need to answer who owns this and can we delete it across several accounts. Teams should start with a read-only scan of one account to validate inference accuracy before rolling out broadly, and treat findings as a starting point for cleanup rather than automatic deletion.