Open-source tool · ARG

Azure Resource Guardian

Discover. Govern. Optimize.

ARG is a self-hosted, Docker-based Azure governance platform that gives you one view across your Azure estate. It scans subscriptions with read-only access and turns the results into findings, savings estimates and reports. You can run the full stack with Docker, or run it from your own workstation with your az login session and no database at all.

View on GitHub ↗Quick start

Version: 0.2
Scanners: 63
License: MIT
Stack: Python 3.12, FastAPI, React, PostgreSQL, Redis

Why it exists

Questions it answers

What is costing money unnecessarily?

Cost optimisation engine using Azure Cost Management data.

Which resources are orphaned?

20+ orphan and idle checks across compute, network, storage, database and cost.

Which resources break governance standards?

Governance module with CAF and Zero Trust alignment scoring.

Which Entra ID objects are a security risk?

Microsoft Graph hygiene analysis of apps, users, guests and privileged roles.

What is not managed by Terraform?

Drift detection that compares Terraform state with the live inventory.

What can be safely deleted?

Findings with generated remediation scripts for review. ARG never runs them.

Features

What it does

Orphan detection

Unattached disks, old snapshots, deallocated VMs
Unused public IPs, orphaned NICs and NSGs, empty load balancers
Unused storage accounts, checked against 7-day transaction metrics
Idle SQL databases, Cosmos DB accounts and IoT Hubs, empty resource groups

Cost optimisation

Per-resource monthly and annual savings estimates
Top 10 cost-saving opportunities
Previous-generation App Service plans and legacy Hyperscale storage meters
Budgets exceeded month after month, and Advisor reservation opportunities

Security and identity

Public storage accounts, SQL servers and Key Vaults
RDP or SSH open to the internet, end-of-support OS images
Expired app secrets and certificates, dormant and never-signed-in guests
Permanent Global Admins, excess subscription Owners, privileged service principals

Governance and reporting

Tag, naming and region rules, with a Governance Score from 0 to 100
Environment tag and name mismatches, Log Analytics caps that drop data
Terraform drift with generated import commands
Executive PDF, technical CSV, Excel and JSON exports

How it fits together

Architecture

01React dashboard
02FastAPI backend
03Celery workers and Redis
04Scanner plugins
05Azure APIs: Resource Graph, Cost Management, Microsoft Graph, Policy

Quick start

Try it

Local analysis from your workstation (no Docker)

az login
python -m scripts.subscription_analysis --all --parallel 3
python -m scripts.local_portal   # http://127.0.0.1:8765

Full stack from Docker Hub

curl -O https://raw.githubusercontent.com/jahmed-cloud/ARG/main/docker-compose.hub.yml
curl -O https://raw.githubusercontent.com/jahmed-cloud/ARG/main/.env.example
cp .env.example .env   # set POSTGRES_PASSWORD, SECRET_KEY, ENCRYPTION_KEY, ADMIN_PASSWORD
docker compose -f docker-compose.hub.yml up -d
# UI at http://localhost:3000

Connect Azure subscriptions

az login
python -m scripts.connect_azure --scan

The full setup guide is in the README on GitHub.

Before you start

Permissions needed

Resource discovery, policy, posture checks	Reader
Cost analysis	Cost Management Reader
Security	Security Reader
Entra ID hygiene (optional)	Microsoft Graph read permissions

Good to know

All access is read-only. Remediation scripts are generated for review and are never run against Azure by ARG. Client secrets are encrypted with AES-256-GCM before they are stored.