Unable to use AWS profiles

[aflatto]

When managing more then 1 account, there is no way to indicate which of the AWS CLI profiles to use.

The application should be able to take as a parameter for the "--provider aws" --profile so it will allow to specify which environment to scan.

example:

With provider indicated:
cleancloud scan --provider aws --provider bla --all-regions

If not indicated it should fill the parameter with default
cleancloud scan --provider aws --provider default --all-regions

[sureshcsdp]

Hi @aflatto

Thanks for raising this - this is a good improvement for multi-account AWS setups.

I agree CleanCloud should support selecting a specific AWS CLI profile.

Proposed syntax:

cleancloud scan --provider aws --profile prod --all-regions

If --profile is omitted, CleanCloud will continue using the default AWS credential resolution chain (environment variables, IAM roles, default profile, etc.) to preserve existing behaviour and CI/CD compatibility.

Also, could you please share any findings that the scan command reported in your environment?

Any feedback on the quality/usefulness of the findings would be really valuable as well.

[aflatto]

When I try to use the scan option, i get this error:

cleancloud scan --provider aws
Provider 'aws' SDK is not installed.
Install it with: pip install 'cleancloud[aws]'

And when I try to do the installation , this is what i get:
...
~$ pip install 'cleancloud[aws]'
error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
python3-xyz, where xyz is the package you are trying to
install.

If you wish to install a non-Debian-packaged Python package,
create a virtual environment using python3 -m venv path/to/venv.
Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
sure you have python3-full installed.

If you wish to install a non-Debian packaged Python application,
it may be easiest to use pipx install xyz, which will manage a
virtual environment for you. Make sure you have pipx installed.

See /usr/share/doc/python3.12/README.venv for more information.

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.
...
I am using Ubuntu
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.4 LTS"

[sureshcsdp]

This is caused by the newer Debian/Ubuntu Python packaging protections, where the OS prevents installing packages directly into the system Python environment.

Recommended installation methods are:

Using pipx (recommended for CLI tools):

sudo apt install pipx -y
pipx install 'cleancloud[aws]'

Or using a virtual environment:

python3 -m venv .venv
source .venv/bin/activate
pip install 'cleancloud[aws]'

I'll update the installation documentation to make this clearer.

[aflatto]

Doing what you recommended gave this intercation:
...
sudo apt install pipx -y
[sudo] password for :
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
pipx is already the newest version (1.4.3-1).
0 upgraded, 0 newly installed, 0 to remove and 5 not upgraded.
$ pipx install 'cleancloud[aws]'
'cleancloud' already seems to be installed. Not modifying existing installation in '/home/aflatto/.local/share/pipx/venvs/cleancloud'. Pass '--force' to
force installation.
...

Using the --force did solve the issue, but it feels incorrect to need to use that option.

[sureshcsdp]

You’re correct - --force is not normally required just to pull the latest version.

The issue here is slightly different: the existing pipx environment was probably created without the optional [aws] dependencies, and pipx install does not automatically reconfigure an existing environment’s extras.

So:

pipx upgrade cleancloud

is the normal way to upgrade versions.

Whereas:

pipx install --force 'cleancloud[aws]'

effectively recreates the environment with the AWS extras included.

I'll improve the docs around provider extras and pipx usage since this is definitely not very intuitive.

Thanks for reporting.

[sureshcsdp]

Hi @aflatto did you get a chance to run scan or doctor commands in your environments and any feedback based on that ?
Thanks

[aflatto]

I was able to run a scan.
Most of the results were for untagged resources and log groups retention, so not much in saving aspect.
The summery of the possible waste is a very good touch.

[sureshcsdp]

Thanks for trying it out - really appreciate the feedback.

Right now CleanCloud includes a mix of hygiene, governance, and direct waste-detection rules, so depending on the environment you may see more tagging/log-retention findings than pure cost-saving opportunities.

The main focus going forward is expanding deeper waste detection, especially around AI/ML resources, idle compute, storage lifecycle gaps, unattached resources, and other deterministic high-confidence savings opportunities across AWS, Azure, and GCP.

Glad the waste summary was useful - trying to make the output actionable without adding dashboard noise.