devtocash

Posted on Jul 20 • Originally published at devtocash.com

FinOps Best Practices: Cloud Financial Management for Engineers

#finops #cloudcost #aws #costoptimization

💡 Originally published on devtocash.com — where this guide stays updated. I write hands-on DevOps/SRE deep-dives there weekly.

Introduction

Cloud costs are invisible until the bill arrives. Engineers provision resources with a few clicks, and three months later, the CFO asks why the AWS bill doubled. FinOps bridges this gap—it's a cultural practice that brings financial accountability to cloud spending.

FinOps isn't just a set of tools. It's a discipline where engineering, finance, and business teams collaborate to make data-driven spending decisions. This guide covers the practical implementation.

The Three Phases of FinOps

Phase 1: Inform (Visibility)

You can't optimize what you can't see. Start with cost visibility:

Tag everything. Without tags, cloud costs are a black box:

Environment: production | staging | dev
Team: backend | frontend | platform  
Service: api-gateway | worker | database
CostCenter: engineering-001

Enable cost allocation tags in AWS:

aws ce update-cost-allocation-tags-status \
  --cost-allocation-tags-status \
  TagKey=Environment,Status=Active

Build dashboards. Use AWS Cost Explorer, Grafana with CloudWatch data sources, or dedicated tools like Vantage and CloudZero. Make cost data as accessible as latency graphs.

Weekly cost reviews. 15-minute meeting looking at:

Week-over-week cost changes by team
Top 5 cost drivers
Any unexpected spikes

Phase 2: Optimize (Efficiency)

Once costs are visible, optimize systematically:

Commitment discounts:

Discount Type	Savings	Commitment	Flexibility
Savings Plans	Up to 72%	1-3 years, $/hr	Applies to EC2, Lambda, Fargate
Reserved Instances	Up to 72%	1-3 years, specific instance	Less flexible
Spot Instances	Up to 90%	None	Can be terminated anytime

Start with Compute Savings Plans—they offer the best flexibility-to-savings ratio.

Rightsizing automation:

# Find idle and underutilized resources daily
import boto3

ce = boto3.client('ce')
response = ce.get_rightsizing_recommendation(
    Service="AmazonEC2"
)
for rec in response['RightsizingRecommendationList']:
    current = rec['CurrentInstance']
    target = rec['ModifyRecommendationDetail']['TargetInstances'][0]
    savings = float(current['MonthlyCost']) - float(target['EstimatedMonthlySavings'])
    if savings > 100:  # Only flag >$100/month savings
        print(f"{current['ResourceId']}: {current['InstanceName']} -> "
              f"{target['Name']} saves ${savings:.0f}/month")

S3 lifecycle policies. Auto-transition to cheaper tiers:

{
  "Rules": [{
    "Id": "AutoTier",
    "Status": "Enabled",
    "Transitions": [
      {"Days": 30, "StorageClass": "STANDARD_IA"},
      {"Days": 90, "StorageClass": "GLACIER"}
    ]
  }]
}

Phase 3: Operate (Culture)

Tools optimize costs once. Culture optimizes costs continuously.

Showback before chargeback. Start by showing teams their cloud spend without billing them. Once visibility is established, move to chargeback where teams pay for what they use.

Cost per feature. Tag resources by feature, not just service:

Feature: checkout-v2
Feature: search-indexing

Now you can answer: "Does the new checkout feature cost more to run than the revenue it generates?"

Budget alerts:

aws budgets create-budget --account-id 123456789012 \
  --budget file://budget.json \
  --notifications-with-subscribers file://notifications.json

Alert at 50%, 80%, and 100% of monthly budget. Route to Slack, not just email.

Gamify savings. Track "money saved this month" alongside engineering velocity metrics. Recognize teams that reduce costs without compromising reliability.

Anomaly Detection

Catch cost spikes before they become problems:

import boto3
ce = boto3.client('ce')
anomalies = ce.get_anomalies(
    MonitorArn='arn:aws:ce::123456789012:anomalymonitor/...',
    TotalImpact={'Start': {'Numeric': 100}}  # Only >$100 anomalies
)
for anomaly in anomalies['Anomalies']:
    print(f"Alert: ${anomaly['AnomalyScore']} spike in "
          f"{anomaly['DimensionValue']} - ${anomaly['Impact']['TotalImpact']}")

Cost Allocation Strategies That Actually Work

Tagging is the foundation of cost allocation, but most teams stop at basic resource tagging. A production-grade strategy requires three layers:

Layer 1: Technical Tags

Applied at resource creation -- hardest to retrofit, so automate them in IaC:

# Terraform example
tags = {
  Environment = var.environment
  Service     = var.service_name
  Team        = var.owning_team
  Provisioner = "terraform"
  CreatedBy   = data.aws_caller_identity.current.arn
  CostCenter  = var.cost_center
}

Layer 2: Business Tags

Added by the platform team after deployment:

Tag	Example	Purpose
Feature	checkout-v2	Cost per product feature
CustomerTier	enterprise	Infrastructure cost by tier
Compliance	pci	Resources under regulatory scope
Project	migration-2026	Track project-specific cloud spend

Layer 3: Automated Tag Enforcement

Use AWS Config or OPA policies to ensure tags exist:

required_tags = ["Environment", "Team", "CostCenter", "Service"]
for resource in resources:
    missing = [t for t in required_tags if t not in resource.tags]
    if missing:
        raise Exception(f"{resource.id} missing tags: {missing}")

Real AWS Cost Savings Cases

EBS Volume Rightsizing

A company running 200 gp3 volumes at 500GB each was paying $12,000/month. Analyzing utilization showed:

40% of volumes used less than 20GB (could be downsized to 50GB)
25% had zero IOPS utilization for 30+ days (snapshot and delete)
15% could use sc1 (cold HDD) instead of gp3

Result: $4,800/month savings by downsizing and transitioning cold data to S3.

Compute Savings Plans Migration

Scenario	On-Demand Cost	Savings Plan Cost	Monthly Savings
10x c6i.xlarge (24/7)	$1,460	$525 (64% off)	$935
5x r6g.large (24/7)	$365	$131 (64% off)	$234
Lambda (mixed workloads)	$2,100	$756 (64% off)	$1,344

Total monthly savings: $2,513

S3 Lifecycle Optimization

A data lake storing 50TB of logs:

Tier	Days	Cost/TB/Month	50TB Cost
S3 Standard	0-30	$23	$1,150
S3 Standard-IA	31-90	$12.50	$625
S3 Glacier Instant Retrieval	91-365	$4	$200
S3 Glacier Deep Archive	366+	$1	$50

Monthly savings vs keeping everything in Standard: $825

FinOps Tools Comparison

Tool	Best For	Pricing	Key Feature
AWS Cost Explorer	Free AWS native analysis	Included	Rightsizing + RI recommendations
Vantage	Startup/SMB teams	Free tier	Multi-cloud, anomaly alerts
CloudZero	Engineering teams	Per-engineer	Cost-per-feature attribution
Kubecost	Kubernetes cost allocation	Free tier	Per-namespace, per-pod costs
Infracost	Terraform cost preview	Free CLI	Shift-left: cost before deploy

Start with Cost Explorer and Kubecost, then graduate to Vantage or CloudZero as your bill crosses $50k/month.

Building a Cost-Aware Engineering Culture

Tools alone won't control costs. Culture does.

Cost dashboards in daily standups: Show team-specific cost trends for 30 seconds
Slack bot alerts: Route anomaly notifications to the owning team's channel
Monthly FinOps review: Engineering leads review top 10 cost drivers and approve optimization tickets
Gamification: Track "cost per deployment" as a team metric; recognize teams that reduce it

The goal is not to minimize cloud spend -- it is to maximize the business value per dollar spent.

Automated Cost Anomaly Detection

Manual cost monitoring doesn't scale beyond a few services. Automate anomaly detection with tools that analyze spend patterns and alert on deviations.

Setting Up AWS Anomaly Detection

AWS Cost Anomaly Detection monitors your spend and uses ML to detect outliers:

# Create a cost anomaly monitor
aws ce create-anomaly-monitor \
    --monitor-name "production-services" \
    --monitor-type DIMENSIONAL \
    --monitor-dimension SERVICE

# Create a subscription for alerts
aws ce create-anomaly-subscription \
    --subscription-name "finops-alerts" \
    --monitor-arn arn:aws:ce::123456789012:anomalymonitor/... \
    --subscribers Type=SNS,Address=arn:aws:sns:us-east-1:123:finops-alerts

Kubecost for Kubernetes cost allocation

Cloud billing tells you the EC2 and EBS total, but not which Kubernetes namespace, team, or deployment spent it. On a shared cluster, that gap is where FinOps dies. Kubecost closes it: it joins your live Prometheus resource metrics (CPU, memory, GPU, storage, network) with cloud billing prices and gives you cost broken down by namespace, deployment, label, or annotation — including the idle cost of capacity you're paying for but not using.

Install it with Helm:

# Install Kubecost (free tier works on a single cluster)
helm repo add kubecost https://kubecost.github.io/cost-analyzer/
helm install kubecost kubecost/cost-analyzer \
    --namespace kubecost --create-namespace \
    --set kubecostToken="your-token"

# Open the UI locally
kubectl port-forward -n kubecost svc/kubecost-cost-analyzer 9090:9090
# then browse http://localhost:9090

Don't stop at the dashboard — the real power is the Allocation API, which you can script into showback reports and CI checks. This pulls last-week cost per namespace, aggregated:

kubectl port-forward -n kubecost svc/kubecost-cost-analyzer 9090:9090 &
curl "http://localhost:9090/model/allocation" \
  --data-urlencode "window=7d" \
  --data-urlencode "aggregate=namespace" \
  --data-urlencode "accumulate=true" -G | jq '.data'

Each namespace comes back with cpuCost, ramCost, pvCost, networkCost, and — the number most teams ignore — efficiency (how much of what you provisioned was actually used). Namespaces sitting at 15% efficiency are your fastest savings: rightsize the requests and the idle cost disappears. Set budget alerts per namespace so teams self-regulate instead of waiting for the monthly bill.

One accuracy gotcha: out of the box Kubecost estimates from public list prices. To reflect your real rates — Savings Plans, RIs, negotiated EDP discounts — wire up the cloud billing integration (an AWS CUR export, or the GCP/Azure equivalent). Without it, your allocation percentages are correct but the absolute dollars will be off.

Kubecost vs OpenCost: which do you need?

They share a core, so the choice confuses people. OpenCost is the CNCF-sandbox, vendor-neutral cost-allocation spec and engine that Kubecost open-sourced and donated — it's Apache-licensed, runs as a lightweight pod, and exposes the same allocation model as Prometheus metrics and a basic API. Kubecost is the product built on top: the polished UI, savings recommendations, alerts, multi-cluster views, and enterprise features.

Want free, GitOps-friendly, API-first allocation you'll graph in your own Grafana? Run OpenCost.
Want a turnkey UI with rightsizing suggestions and budget alerts on a single cluster? Run Kubecost free tier (full-featured, but metric retention is capped at ~15 days).
Multi-cluster, unlimited retention, SSO, and RBAC across teams? That's Kubecost Enterprise (paid).

Install OpenCost standalone if you'd rather stay lean:

helm repo add opencost https://opencost.github.io/opencost-helm-chart
helm install opencost opencost/opencost --namespace opencost --create-namespace

For the cluster-side tactics that turn these numbers into an actually smaller bill — VPA, Spot node groups, and namespace quotas — see the Kubernetes cost optimization guide and the Kubernetes-specific FinOps walkthrough.

Building Custom Budget Dashboards in Grafana

Connect Prometheus metrics from Kubecost to Grafana for real-time dashboards:

-- Example PromQL for per-service cost
sum(
  node_cost_per_hour * on(instance) group_left()
  kube_pod_labels{label_team!=""}
) by (label_team)

This shows cost per team in real-time, refreshed every 30 seconds. Pair it with Slack alerts when a team's daily spend exceeds 120% of the daily budget.

Commitment Discount Strategy: A Step-by-Step Plan

Most teams overpay because they buy Reserved Instances (RIs) speculatively. Here is a data-driven approach:

Run on-demand for 30 days to establish baseline usage patterns
Analyze usage data with Cost Explorer Rightsizing Recommendations and determine which instance families have consistent 24/7 usage
Start with Compute Savings Plans (3-year, partial upfront) for the most flexibility. Compute Savings Plans apply to EC2, Lambda, and Fargate automatically
Add EC2 Instance Savings Plans for workloads with predictable instance families (e.g., all c6i for your API tier)
Use Spot Instances for everything else: Stateless workers, batch jobs, CI runners, and canary deployments
Review quarterly: Usage patterns change. Sell unused RIs on the AWS RI Marketplace and adjust coverage

A typical company running $100k/month on AWS saves $30k-$50k/month by following this plan.

Measuring FinOps Success

Track these metrics monthly to measure your FinOps program:

Metric	Target	Why It Matters
Tag Coverage	>95% of resources	Without tags, you cannot allocate costs
Savings Plan Coverage	>60% of eligible spend	Underutilized commitments waste money
Spot Usage %	>30% of compute	Spot instances save 60-90% over on-demand
Cost per Transaction	Trending down	Absolute cost is less meaningful than unit cost
Anomaly Response Time	<4 hours	Slow response to spikes = wasted spend

If your tag coverage is below 80%, stop everything and fix it first. Every other optimization depends on knowing who spent what.

Frequently Asked Questions

What is Kubecost? Kubecost is a Kubernetes cost-monitoring tool that joins your cluster's Prometheus resource metrics with cloud billing data to show cost per namespace, deployment, label, and team — including the idle cost of unused capacity. It's the standard way to answer "which workload spent this?" on a shared cluster.

Is Kubecost free? Yes, the free tier is fully featured on a single cluster, with metric retention capped at about 15 days. Multi-cluster views, unlimited retention, SSO, and team RBAC require Kubecost Enterprise. The underlying engine, OpenCost, is free and open-source with no cap.

Kubecost vs OpenCost — what's the difference? OpenCost is the open-source, CNCF-sandbox allocation engine (API + Prometheus metrics) that Kubecost donated; Kubecost is the commercial product built on it, adding a UI, savings recommendations, alerts, and enterprise features. Use OpenCost if you want a lean, API-first core to graph yourself; use Kubecost for a turnkey dashboard.

Are Kubecost's dollar figures accurate? The allocation percentages are accurate out of the box, but absolute costs default to public list prices. Connect your cloud billing export (AWS CUR, or the GCP/Azure equivalent) so Savings Plans, RIs, and negotiated discounts are reflected in the numbers.

Conclusion

FinOps transforms cloud costs from a surprise expense into a managed resource. Start with Phase 1: tag everything, make costs visible, and hold weekly reviews. Once you can answer "who spent what," move to optimization and cultural change.

The metric that matters: not total cloud spend, but cost per transaction or cost per customer. If your costs grow linearly with users, you're doing it right.

📌 Read the latest version of this guide — plus the full library of DevOps, SRE, Kubernetes, observability & cloud-cost guides — on devtocash.com.

Top comments (1)

Luis Cruz • Jul 20

I appreciated the emphasis on the three phases of FinOps, particularly the 'Inform' phase, where tagging and cost allocation are crucial for visibility. The example of using aws ce update-cost-allocation-tags-status to enable cost allocation tags in AWS is especially helpful. I've found that implementing a similar tagging strategy in my own projects has significantly improved our team's ability to track and manage costs. One potential addition to this phase could be exploring the use of machine learning models to predict cost trends and identify areas for optimization. Have you considered integrating predictive analytics into your FinOps workflow to further enhance cost management capabilities?

DEV Community