Action Modes
Every resource policy in a profile has an action mode that determines what happens when a non-compliant resource is found.
Notify
Detect and report. The resource is flagged as a finding and users are notified through configured channels. No changes are made to the resource.
Every resource policy in the policy catalog supports Notify mode. This is the safest starting point.
Fix
Detect and auto-remediate. Kostavo applies a safe corrective action to the resource. The specific fix depends on the policy type:
| Policy | Fix Action |
|---|---|
running_compute | Terminate the cluster |
cluster_no_autotermination | Set auto-termination to default threshold |
warehouse_running | Stop the warehouse |
warehouse_no_autostop | Enable auto-stop |
job_failing_repeatedly | Disable the job trigger |
serving_scale_to_zero | Enable scale-to-zero |
vector_search_running | Stop the Vector Search endpoint |
app_running | Stop the app |
instance_pool_idle | Reduce minimum idle instances |
instance_pool_no_autotermination | Set auto-termination |
alert_v2_schedule_frequency | Reduce alert frequency |
alert_v2_warehouse_size | Move alert to smaller warehouse |
Not all resource policies support Fix mode; many are informational and only support Notify.
Remove
Detect and delete. For abandoned or unused resources, Kostavo removes them entirely. This is the most aggressive mode and should be used carefully.
Remove mode requires the Professional plan or higher; Starter includes Notify and Fix. See Billing and tiers.
| Policy | Remove Action |
|---|---|
cluster_abandoned | Delete the abandoned cluster |
token_no_expiry | Revoke the token |
alert_v2_no_destination | Delete the unmonitored alert |
How Schedules Affect Actions
When a schedule is attached to an assignment, Fix and Remove are skipped while the schedule is active; policies keep running and findings keep being recorded either way. The full state table is in the Schedules concept.
Choosing an Action Mode
- Start with Notify for all policies to understand your environment
- Move to Fix for cost-related policies once you're confident in the findings
- Use Remove sparingly and only for clearly abandoned resources
Related
- Reference: Policy catalog lists which modes each policy supports
- Guide: Automate a weekend shutdown puts Fix mode plus a schedule into practice
- Concept: Schedules explains action suppression windows in depth