# God Cost Engineering

> God-level FinOps and cloud cost engineering skill covering cost allocation and tagging strategies, AWS cost optimization (Reserved Instances, Savings Plans, Spot Instances, rightsizing, S3 storage tiering, data transfer costs), Azure cost management (Azure Reservations, Spot VMs, Advisor recommendations), GCP cost optimization (Committed Use Discounts, Preemptible VMs, sustained use discounts), Kubernetes cost management (Kubecost, cluster rightsizing, namespace cost allocation), unit economics (cost per request, cost per user, cost per ML inference), FinOps Foundation principles, cloud cost anomaly detection, and building a culture of cost ownership. Every engineer should know what their code costs to run.

- Skill: `ardurai/god-cost-engineering` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add ardurai/god-cost-engineering`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ardurai/god-cost-engineering/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: ArdurAI (https://skillmd.com/u/ardurai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ardurai/god-cost-engineering

---


# God-Level Cloud Cost Engineering (FinOps)

> You are a researcher-warrior. A 1-cent saving per API request × 1 billion requests = $10 million per year. You fight for every cent with data, not guesses. You never fabricate AWS pricing figures — cloud pricing changes constantly, and a wrong number costs trust and money. Every cost claim you make is accompanied by the official AWS/Azure/GCP pricing page URL so the reader can verify it themselves. You treat every architecture decision as a financial decision, because it is.

---

## Anti-Hallucination Rule: Pricing

**Never state specific per-unit prices for AWS, Azure, or GCP services in recommendations.** Prices change, vary by region, and are subject to negotiated discounts. Instead:
- Always link to the official pricing page for verification
- Use relative comparisons ("Graviton instances cost up to 20% less than comparable x86 instances" — a stated AWS claim, not a fabricated figure)
- Use cost pattern language: "data transfer out is significantly more expensive than data transfer in"
- For architectural cost estimates: use the AWS Pricing Calculator (https://calculator.aws/) or Azure Pricing Calculator (https://azure.microsoft.com/en-us/pricing/calculator/)

**Verified pricing pages:**
- AWS EC2: https://aws.amazon.com/ec2/pricing/on-demand/
- AWS S3: https://aws.amazon.com/s3/pricing/
- AWS Savings Plans: https://aws.amazon.com/savingsplans/pricing/
- AWS Data Transfer: https://aws.amazon.com/ec2/pricing/on-demand/ (Data Transfer section)
- AWS Graviton: https://aws.amazon.com/ec2/graviton/
- GCP pricing: https://cloud.google.com/pricing
- Azure pricing: https://azure.microsoft.com/en-us/pricing/

---

## 1. FinOps Foundation: The Framework

The FinOps Foundation (finops.org) defines FinOps as "an operational framework and cultural practice which maximizes the business value of cloud, enables timely data-driven decision making, and creates financial accountability through collaboration between engineering, finance, and business teams."

### Three Iterative Phases

FinOps is not a one-time project. It is a continuous cycle.

#### Phase 1: Inform (Visibility & Allocation)
**Goal**: Make cloud spend visible, allocated, and understandable.

Key activities:
- Ingest billing data from cloud providers (AWS Cost and Usage Report, Azure Cost Management exports, GCP Billing export to BigQuery)
- Allocate costs to teams, services, environments, and cost centers using tags and labels
- Build dashboards and reports that show spend by team, by service, by environment
- Calculate unit economics (cost per request, cost per user)
- Forecast future spend based on growth trends
- Benchmark against industry peers or internal teams

You cannot optimize what you cannot see. Teams that skip the Inform phase optimize the wrong things.

#### Phase 2: Optimize (Rates & Usage)
**Goal**: Identify and implement cost reduction opportunities.

Two types of optimization:
- **Rate optimization**: Pay less for the same resources (Reserved Instances, Savings Plans, Committed Use Discounts, negotiated EDP). Primarily owned by Finance/Procurement with Engineering input.
- **Usage optimization**: Use fewer resources for the same outcome (rightsizing, auto-scaling, spot instances, storage tiering, caching). Primarily owned by Engineering.

#### Phase 3: Operate (Continuous Improvement)
**Goal**: Build sustained organizational capability for cost accountability.

Key activities:
- Embed cost as a KPI for engineering teams alongside reliability and performance
- Automate waste detection and remediation (unattached EBS volumes, idle instances, empty load balancers)
- Mature allocation practices as cloud usage grows
- Run regular architecture reviews that include cost estimates
- Celebrate cost wins publicly to build cultural momentum

---

## 2. Cost Allocation: Tagging Strategy

### Why Tagging Is the Foundation

Without accurate tagging, you cannot allocate costs to the teams or services that generated them. Unallocated costs are a black box — you cannot optimize what you cannot attribute.

### Mandatory Tag Set

Enforce this minimum tag set across all cloud resources:

| Tag Key | Description | Example Values |
|---------|-------------|----------------|
| `team` | Owning team | `payments`, `search`, `ml-platform` |
| `service` | The specific service or workload | `checkout-api`, `recommendation-engine` |
| `environment` | Deployment environment | `production`, `staging`, `dev`, `ephemeral` |
| `cost-center` | Finance/accounting cost center | `CC-1042`, `engineering-r&d` |
| `managed-by` | Provisioning mechanism | `terraform`, `crossplane`, `manual` |

### Enforcement Mechanisms by Cloud

**AWS**: Service Control Policies (SCPs) can prevent resource creation if mandatory tags are absent. AWS Config Rules (`required-tags` managed rule) can flag untagged resources. Tag policies at the AWS Organizations level define allowed tag values.

**Azure**: Azure Policy can audit or deny resource creation without required tags (built-in policy: `Require a tag and its value on resources`). Tag inheritance from resource groups can reduce tagging burden.

**GCP**: Organization Policies can enforce label requirements. Budget alerts can be scoped to labeled resources.

> Enforcement must happen at creation time. Retroactive tagging campaigns fail. SCPs that deny creation without tags are the only reliable mechanism.

### Showback vs. Chargeback

| Model | Description | When to Use |
|-------|-------------|-------------|
| **Showback** | Teams see their costs but are not billed internally | Early FinOps maturity; building cost awareness culture |
| **Chargeback** | Teams are billed against an internal budget; overruns come from their P&L | Mature FinOps; teams have strong autonomy and budget ownership |

Start with showback. Teams that see their costs and understand unit economics will make better decisions. Chargeback without visibility first creates resentment, not accountability.

---

## 3. AWS Reserved Instances vs. Savings Plans

### Reserved Instances (RIs)

An RI is a billing discount applied when your actual usage matches the RI's specification. It is not a VM — it is a commitment.

**RI dimensions:**
- **Instance type**: Specific family and size (e.g., `m5.xlarge`). Standard RIs are tied to a specific instance type.
- **Region**: Specific AWS region (e.g., `us-east-1`)
- **OS**: Linux, Windows, RHEL, etc.
- **Tenancy**: Default (shared hardware) or Dedicated

**RI types:**
- **Standard RI**: Deepest discount (up to 72% vs. On-Demand per AWS). Least flexible. Cannot change instance type family. Can be sold in the AWS Marketplace.
- **Convertible RI**: Less deep discount (up to 66% vs. On-Demand per AWS). Can be exchanged for a different instance type, OS, or tenancy. Cannot be sold.

**Payment options (all three available for 1-year and 3-year terms):**
| Payment | Description | Total Cost Outcome |
|---------|-------------|-------------------|
| All Upfront | Full term cost paid at purchase | Lowest total cost |
| Partial Upfront | Portion upfront, rest as monthly | Middle |
| No Upfront | Monthly payments only (3-year not available for all types) | Highest total, but preserves cash |

**1-year vs. 3-year**: 3-year commitments provide larger discounts but require higher confidence in the workload's longevity. Only commit to 3-year terms for stable, well-understood workloads.

> **Pricing verification**: AWS RI pricing varies by instance type, region, and OS. Never quote specific RI prices from memory. Always use: https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/

### AWS Savings Plans

Savings Plans are a flexible commitment model introduced in 2019. Instead of committing to a specific instance type, you commit to a spend rate ($/hour) for 1 or 3 years.

**Four types of AWS Savings Plans:**

| Plan Type | Flexibility | Max Discount (AWS-stated) | Applies To |
|-----------|-------------|--------------------------|-----------|
| **Compute Savings Plans** | Any EC2 family, size, region, OS, tenancy; also Fargate and Lambda | Up to 66% | EC2, Fargate, Lambda |
| **EC2 Instance Savings Plans** | Any size/OS/tenancy within a committed instance family in a committed region | Up to 72% | EC2 only |
| **SageMaker Savings Plans** | Any SageMaker ML instance family, size, region | Up to 64% | SageMaker training, inference, notebooks |
| **Database Savings Plans** | Any supported DB engine, family, size, deployment option, region | Varies | RDS, Aurora, including serverless |

**Savings Plans vs. RIs — when to use each:**

Use **Savings Plans** when:
- Your workload mix changes over time (shifting from C5 to M6i, or from EC2 to Fargate)
- You want flexibility without managing RI exchanges
- You use multiple instance families or regions

Use **Reserved Instances** when:
- Your workload is extremely stable and predictable on specific instance types
- You want to maximize savings and know exactly what you'll run
- You want the option to sell unused capacity on the RI Marketplace (Standard RIs only)

**ROI Calculation Approach:**
```
Baseline: Current On-Demand hourly spend for the workload
Committed rate: Savings Plan hourly commitment
Break-even: Hours per month the workload must run for the SP to be worthwhile
ROI = (On-Demand cost - SP cost) / SP cost × 100%

Example structure (use actual prices from AWS calculator):
If On-Demand = $X/hr and SP rate = $Y/hr:
Monthly savings = (X - Y) × running_hours
Breakeven hours/month = SP monthly commitment / (X - Y)
```

---

## 4. AWS Spot Instances

Spot Instances are spare EC2 capacity offered at steep discounts (historically up to 90% off On-Demand, though discounts vary). The tradeoff: AWS can reclaim the instance with a 2-minute warning.

> **Pricing**: Spot prices fluctuate based on supply and demand per availability zone and instance type. Current prices at: https://aws.amazon.com/ec2/spot/pricing/

### The 2-Minute Interruption Warning

When AWS needs to reclaim a Spot Instance, it provides an interruption notice two minutes before the action (terminate, stop, or hibernate). The notice is available via:

1. **Amazon EventBridge**: Event type `"EC2 Spot Instance Interruption Warning"` from source `aws.ec2`
2. **Instance metadata (IMDSv2)**:
   ```bash
   TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
     -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
   curl -H "X-aws-ec2-metadata-token: $TOKEN" \
     http://169.254.169.254/latest/meta-data/spot/instance-action
   # Returns: {"action": "terminate", "time": "2024-01-15T08:22:00Z"}
   # HTTP 404 if no interruption scheduled
   ```

Poll the metadata endpoint every 5 seconds. On interruption notice: checkpoint work, drain connections, save state.

**Hibernation exception**: If interruption behavior is set to `hibernate`, the instance hibernates immediately on interruption — there is no 2-minute usable window. Use `terminate` or `stop` behavior if you need the 2-minute grace period.

### Which Workloads Suit Spot

| Workload Type | Spot-Suitable? | Notes |
|---------------|---------------|-------|
| ML training jobs | ✅ Yes | Checkpoint to S3 every N minutes; restart on interruption |
| Batch processing | ✅ Yes | Idempotent jobs that can be re-queued |
| CI/CD workers | ✅ Yes | Jobs are ephemeral; retry on failure |
| Stateless web tier | ✅ Yes (with care) | Use multiple AZs; load balancer handles draining |
| Databases | ❌ No | State loss on interruption is unacceptable |
| Stateful services | ❌ No | Session loss, data corruption risk |
| Single-instance critical services | ❌ No | No redundancy to absorb interruption |

### Spot Fleet and Auto Scaling

- **Spot Fleet**: Request capacity across multiple instance types and AZs. Diversification reduces interruption probability.
- **EC2 Auto Scaling mixed instances policy**: Combine On-Demand base capacity with Spot for additional capacity. Specify multiple instance types (`instance-distribution`) so Auto Scaling can find available Spot capacity.
- **Capacity-optimized allocation strategy**: Launches Spot from the pool with most available capacity — reduces interruption frequency at the cost of potentially slightly higher price vs. `lowest-price` strategy.

---

## 5. EC2 Rightsizing

### Metrics to Analyze

Before rightsizing, collect at least 2 weeks of CloudWatch metrics:

| Metric | Namespace | Threshold Indicating Oversizing |
|--------|-----------|--------------------------------|
| `CPUUtilization` | `AWS/EC2` | Consistently < 20% (average) suggests overprovisioning |
| `NetworkIn` / `NetworkOut` | `AWS/EC2` | Low relative to instance network bandwidth |
| `mem_used_percent` | `CWAgent` (requires CloudWatch agent) | < 30% average suggests memory overprovisioning |
| `disk_used_percent` | `CWAgent` | Very low disk utilization on large EBS volumes |

> **Critical**: Memory metrics require the CloudWatch Agent. EC2 hypervisor cannot see inside the guest OS for memory usage. Deploy the CloudWatch Agent before rightsizing analyses are meaningful.

### AWS Compute Optimizer

AWS Compute Optimizer analyzes CloudWatch metrics and provides machine-learning-based rightsizing recommendations for:
- EC2 instances (including idle instance detection)
- EC2 Auto Scaling groups
- EBS volumes (unattached, oversized)
- RDS instances (including Graviton migration recommendations)

Compute Optimizer also provides Graviton migration recommendations — it flags instances that would benefit from switching to an ARM-based Graviton instance type.

### Graviton Instances

AWS Graviton processors (ARM-based, designed by AWS) deliver cost savings for many workloads:

- **AWS-stated cost advantage**: Up to 20% less expensive than comparable x86-based EC2 instances
- **Energy efficiency**: AWS states up to 60% less energy for the same performance

Not all workloads benefit equally. Graviton works well for: Java, Go, Python, Node.js, .NET Core, containerized workloads, and most web/API services. Workloads with x86-specific native code or Windows (not supported on Graviton) cannot use it.

> **Verify**: https://aws.amazon.com/ec2/graviton/

**Graviton instance families** (example, not exhaustive — verify current availability):
- General purpose: `m8g`, `m7g`, `m6g`
- Compute optimized: `c8g`, `c7g`, `c6g`
- Memory optimized: `r8g`, `r7g`, `r6g`

> Always verify current Graviton instance families at https://aws.amazon.com/ec2/instance-types/ — new generations are released regularly.

---

## 6. S3 Cost Optimization

### Storage Classes

| Storage Class | Retrieval Latency | Min Storage Duration | Use Case |
|---------------|------------------|---------------------|---------|
| S3 Standard | Milliseconds | None | Frequently accessed data |
| S3 Intelligent-Tiering | Milliseconds to hours (configurable) | None | Unknown/changing access patterns; auto-tiering |
| S3 Express One Zone | Single-digit milliseconds | 1 hour | Latency-sensitive, highest-performance ML/analytics |
| S3 Standard-IA | Milliseconds | 30 days | Infrequently accessed, millisecond retrieval needed |
| S3 One Zone-IA | Milliseconds | 30 days | Infrequent access, re-creatable data, 20% cheaper than Standard-IA |
| S3 Glacier Instant Retrieval | Milliseconds | 90 days | Archive accessed a few times/year, instant retrieval |
| S3 Glacier Flexible Retrieval | Minutes to 12 hours | 90 days | Backup/archive, occasional access, minutes-to-hours retrieval acceptable |
| S3 Glacier Deep Archive | 12-48 hours | 180 days | Long-term regulatory archive (7-10+ years); lowest cost storage |

> **Verify current pricing**: https://aws.amazon.com/s3/pricing/

### S3 Intelligent-Tiering

Intelligent-Tiering monitors access patterns and moves objects automatically between tiers:
- **Frequent Access tier**: Default for newly uploaded objects
- **Infrequent Access tier**: Objects not accessed for 30 days — saves up to 40% vs. Standard (per AWS)
- **Archive Instant Access tier** (optional): Objects not accessed for 90 days — saves up to 68%
- **Deep Archive Access tier** (optional): Objects not accessed for 180 days — saves up to 95%

A small monthly monitoring and automation charge applies per object. No retrieval charges within Intelligent-Tiering. No minimum storage duration. Best for data lakes and large datasets with unpredictable access.

### Lifecycle Policies

Define rules to automatically transition or expire objects:
```json
{
  "Rules": [{
    "ID": "archive-old-logs",
    "Status": "Enabled",
    "Filter": {"Prefix": "logs/"},
    "Transitions": [
      {"Days": 30, "StorageClass": "STANDARD_IA"},
      {"Days": 90, "StorageClass": "GLACIER_IR"},
      {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}
    ],
    "Expiration": {"Days": 2555}
  }]
}
```

### Data Transfer Costs: The Hidden Killer

Data transfer costs are frequently the largest unoptimized cost center after compute:

- **Inbound data transfer**: Free (data into AWS)
- **Outbound to internet**: Charged per GB, tiered by volume. First 100 GB/month free per account (per AWS free tier).
- **Cross-AZ data transfer**: Charged in both directions. This is the "hidden" cost that destroys microservices architectures where services are naively deployed without AZ awareness.
- **Within same AZ**: Free when using private IPs
- **Cross-region**: Charged; varies by region pair

> Always verify current data transfer prices: https://aws.amazon.com/ec2/pricing/on-demand/ (Data Transfer section)

**VPC Endpoints eliminate gateway costs**: S3 and DynamoDB can be accessed via VPC Gateway Endpoints (free) instead of through the NAT Gateway (charged per GB). Switching high-volume S3 traffic to a VPC Gateway Endpoint can eliminate significant NAT Gateway data processing costs.

**CloudFront for egress optimization**: Serving content via CloudFront reduces direct S3 egress costs because CloudFront-to-origin transfer is priced differently from public internet egress. CloudFront also caches at edge, reducing origin requests.

---

## 7. RDS Cost Optimization

### Instance Rightsizing

Apply the same CloudWatch analysis as EC2: CPU utilization, memory (via Enhanced Monitoring or Performance Insights), connections, I/O. Compute Optimizer now provides RDS rightsizing recommendations including Graviton migration paths.

**Multi-AZ vs. Single-AZ**: Multi-AZ doubles instance cost (standby replica). Evaluate: does the staging environment need Multi-AZ? Likely not. Cost savings: ~50% on RDS instance cost for non-production environments.

### Aurora Serverless v2

Aurora Serverless v2 scales capacity in fine-grained increments (0.5 ACU steps) from a minimum to maximum ACU range. For variable workloads (batch analytics, dev/test environments, low-traffic APIs), it can significantly reduce cost vs. a fixed instance that's idle most of the time.

**When Aurora Serverless v2 fits:**
- Variable load with unpredictable peaks
- Dev/staging environments with overnight idle periods
- Applications that can tolerate slight scaling latency (millisecond scale-up)

**When it doesn't fit:**
- Sustained high-load production databases where a fixed instance is more cost-effective
- Workloads requiring features not yet supported in Serverless v2

> Verify Aurora Serverless v2 pricing at: https://aws.amazon.com/rds/aurora/pricing/

### Read Replicas vs. Caching

Serving read traffic from a read replica still costs money (a full RDS instance). For read-heavy, cacheable data patterns:
- Add a caching layer (ElastiCache Redis/Memcached) for frequently accessed, slowly changing data
- Cache hit rates of 80%+ can dramatically reduce database load and allow downsizing the primary instance
- Cost model: ElastiCache node cost vs. (additional read replica cost + reduced primary sizing opportunity)

---

## 8. Kubernetes Cost Management

### Namespace-Level Cost Attribution with Kubecost

Kubecost uses the OpenCost specification to allocate cluster costs to Kubernetes entities. At the namespace level, it tracks:

| Cost Dimension | What It Measures |
|----------------|-----------------|
| CPU | Greater of CPU requested and CPU used, priced via cloud billing APIs |
| RAM | Greater of memory requested and memory used |
| GPU | GPUs requested (for GPU node pools) |
| Persistent Volume (PV) | Storage claimed by PersistentVolumeClaims in the namespace |
| Network | Egress costs (cross-zone, internet) when network cost integration enabled |
| Load Balancer | Cloud load balancer cost allocated to the namespace |
| Shared overhead | Idle node cost distributed proportionally (configurable) |

**Cost efficiency metric**: `(actual CPU + memory usage) / (CPU + memory requested) × 100%`. Values well below 100% indicate overprovisioning in requests relative to actual usage.

### Pod Rightsizing with VPA

The Vertical Pod Autoscaler (VPA) analyzes historical resource usage and recommends updated `requests` and `limits`. Use VPA in `Off` mode (recommendations only, no automatic updates) first — auto-update mode can cause pod restarts at inconvenient times.

Workflow:
1. Deploy VPA in `Recommend` mode for all workloads
2. Review VPA recommendations in Kubecost or directly via `kubectl describe vpa`
3. Update deployment manifests with recommended values (automate via a pipeline)
4. Re-review after 2 weeks of data

### Cluster Bin-Packing

Idle node costs (paying for nodes with low utilization) are often the largest K8s waste category. Improve bin-packing by:
- **Removing CPU/memory slack**: VPA-based right-sizing of pod requests
- **Karpenter**: Node provisioner that selects instance types to optimally fit the pending pod requests. Replaces Cluster Autoscaler for bin-packing efficiency. Supports Spot instance diversification natively.
- **Consolidation**: Karpenter's `consolidation` feature terminates underutilized nodes and repacks pods onto fewer nodes

### Spot Node Groups for Non-Critical Workloads

Separate workloads by criticality using node selectors and taints:
- **On-Demand node group**: Critical production services, stateful workloads, databases
- **Spot node group**: CI/CD workers, batch jobs, non-critical background processing, dev/staging

Label Spot nodes with a taint and require tolerations for non-critical workloads — this prevents critical services from accidentally scheduling on Spot nodes.

---

## 9. ML/AI Cost Optimization

ML workloads are the fastest-growing cost category in most engineering organizations.

### GPU Instance Selection

**Training workloads:**
- Use Spot Instances for training where possible — training jobs are typically fault-tolerant if you checkpoint to S3 every N steps (standard practice with PyTorch Lightning, Hugging Face Trainer, JAX)
- Verify current GPU Spot instance availability and pricing: https://aws.amazon.com/ec2/spot/instance-advisor/
- `p4d`, `p5`, `g5`, `g6` families are the primary GPU families on AWS (verify current offerings — new families are added regularly)

**Inference workloads:**
- Reserved Instances or Savings Plans for stable, predictable inference endpoints
- Model serving on Spot is possible with multi-instance redundancy and load balancing to absorb interruptions
- Consider Graviton (`c7g`, `m7g`) for CPU-bound inference (e.g., smaller models, embedding generation) — up to 20% cheaper

### Model Quantization to Reduce Compute

Quantizing model weights (FP32 → FP16 → INT8 → INT4) can reduce:
- GPU memory footprint (allowing larger batch sizes or smaller GPU instances)
- Inference latency
- Cost per inference

INT8 quantization with tools like NVIDIA TensorRT, bitsandbytes, or ONNX Runtime typically preserves 95-99% of model accuracy for most production use cases while reducing compute cost. Measure accuracy degradation on your specific task before deploying quantized models.

### Batching Inference Requests

Serving each inference request individually wastes GPU utilization. Batching multiple requests in a single forward pass is one of the highest-leverage optimizations:
- KServe, NVIDIA Triton Inference Server, and Ray Serve all support dynamic batching
- Even a batch size of 8-16 can reduce cost-per-inference significantly
- Latency/throughput trade-off: measure P99 latency with your batch size and SLA

### Caching Embeddings

For semantic search, RAG pipelines, and recommendation systems:
- Cache embedding vectors in Redis, Pinecone, Weaviate, or Qdrant
- A cache hit costs ~$0.001 (Redis query) vs. a cache miss that requires GPU inference
- Embedding cache hit rates of 60-80% are achievable for many production query distributions
- Significant cost reduction for high-volume embedding workloads

---

## 10. Unit Economics

Unit economics translate cloud cost into business-meaningful metrics. The goal: every engineer knows what their code costs per unit of business value delivered.

### Core Unit Metrics

| Metric | Formula | Collection Method |
|--------|---------|------------------|
| Cost per API request | Monthly service cost / Monthly request count | Kubecost namespace cost + APM request count |
| Cost per ML inference | GPU instance cost / Inference count | Inference serving logs + instance cost |
| Cost per active user (DAU) | Total cloud cost / Daily active users | Cloud billing + product analytics |
| Cost per GB processed | Data pipeline cost / GB processed | EMR/Glue cost + job metadata |
| Cost per transaction | Service cost / Transaction count | Billing + payment metrics |

### How to Calculate and Track

1. **Tag precisely**: Every compute resource tagged with `service` and `team` (see Section 2)
2. **Export billing data**: AWS Cost and Usage Report (CUR) exported to S3 + Athena for querying, or directly to a data warehouse
3. **Join with product metrics**: Join CUR data with your product database (request counts, user counts, transaction counts) on date and service dimensions
4. **Build dashboards**: Unit cost dashboards in Grafana, Tableau, or your BI tool of choice, visible to every engineering team

**Target visibility**: Every engineering team should be able to answer "what does my service cost per request today?" within 5 minutes, without asking the platform or finance team.

---

## 11. Cost Anomaly Detection

### AWS Cost Anomaly Detection

AWS Cost Anomaly Detection uses machine learning to identify unusual spend patterns. Configure monitors for:
- Individual services (EC2, RDS, S3)
- Linked accounts
- Cost allocation tag values (e.g., monitor per-team spend)

Alert thresholds: Set absolute ($) and percentage (%) thresholds. Alert when spend exceeds expected by more than X% or $Y.

> AWS Cost Anomaly Detection: https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/

### Budget Alerts

AWS Budgets allows setting alerts on:
- Actual spend vs. budget
- Forecasted spend vs. budget
- Reserved Instance / Savings Plan coverage (alert when coverage drops below target)
- Utilization (alert when RI/SP utilization drops below target)

Set at minimum: a monthly budget per team/service with alerts at 80% and 100% of budget.

### Cost Spike Investigation Methodology

When a cost spike is detected:
1. **Identify the service**: Which AWS service is spiking? (Cost Explorer, grouped by service)
2. **Identify the resource**: Which specific resource? (Cost Explorer, grouped by resource ID if CUR resource-level enabled)
3. **Identify the tag/owner**: Which team? (Cost Explorer, grouped by tag)
4. **Correlate with deployments**: Check deployment history in the same time window — did a new service version launch, a new feature flag enable high-traffic code, or a new environment get created?
5. **Check for waste**: Unattached EBS volumes, idle EC2 instances, forgotten load balancers, oversized RDS instances
6. **Remediate and document**: Fix the root cause, document in a cost post-mortem, add monitoring to detect recurrence

---

## 12. Azure and GCP Cost Optimization (Overview)

### Azure

**Azure Reservations**: Equivalent to AWS Reserved Instances. Commit to 1 or 3 years for a specific VM size, region, and OS. Discounts vary by VM family and region — verify at https://azure.microsoft.com/en-us/pricing/reserved-vm-instances/

**Azure Spot VMs**: Equivalent to AWS Spot Instances. Eviction notices provided with approximately 30 seconds warning (much shorter than AWS's 2 minutes). Design for rapid eviction.

**Azure Advisor**: The Azure equivalent of AWS Compute Optimizer. Provides cost recommendations including rightsizing, Reserved Instance recommendations, and idle resource identification.

**Azure Cost Management + Billing**: Built-in cost visibility tool. Export billing data to Azure Blob Storage or connect to Power BI. Supports cost allocation by subscription, resource group, and tag.

### GCP

**Committed Use Discounts (CUDs)**: Commitment to use a minimum amount of vCPU and memory for 1 or 3 years in a specific region. Two types:
- **Resource-based CUDs**: Commit to vCPU/memory — applies to N2, C2, M2 families
- **Spend-based CUDs**: Commit to a minimum spend ($/hour) — applies to Cloud SQL, Cloud Run, and other services

**Preemptible VMs / Spot VMs**: GCP's equivalent to AWS Spot. Preemptible VMs have a maximum 24-hour lifetime and can be reclaimed with a 30-second notice. GCP Spot VMs are the successor — no 24-hour limit but still preemptible.

**Sustained Use Discounts**: GCP automatically applies discounts when VMs run for more than 25% of a month. No commitment required. Discounts increase as usage percentage increases up to 30% off for full-month usage. Applies to N1, N2, C2, N2D instance families. Does not apply to E2 or preemptible instances.

> Verify GCP pricing: https://cloud.google.com/compute/pricing

---

## 13. FinOps Culture: Building Cost Ownership

### Unit Cost Dashboards Visible to Developers

Engineers make cost decisions daily (instance type choices, caching decisions, query design). If they can't see the financial impact, they make decisions blindly. Requirements:
- Unit cost dashboard per service, accessible from the developer portal (Backstage or equivalent)
- Dashboard updates at least daily (ideally near-real-time via CUR + streaming)
- Contextual: shows cost per request, not just total monthly cost

### Cost as a Feature Team KPI

Cost is a software quality dimension, the same as performance and reliability. Feature teams should:
- Include cost estimates in architecture review documents (not just technical design)
- Have a quarterly cost target per service (alongside SLO targets)
- Be acknowledged/celebrated for cost reduction wins, not just feature launches

### Architecture Reviews Including Cost Estimates

Before building:
1. Estimate monthly cost using AWS Pricing Calculator for the proposed architecture
2. Document the cost per unit metric at expected load
3. Identify the highest-cost components and explore alternatives
4. Define the cost monitoring strategy for post-launch

This takes 30 minutes and can prevent architectural decisions that are 10x more expensive than alternatives.

### Build vs. Buy Cost Analysis

Managed services cost more in direct fees but often less in total cost:
- Engineering time to operate a self-managed database (patching, backup, HA, monitoring)
- On-call burden and incident cost
- Opportunity cost of engineering time not spent on product features

**Example framework:**
```
Self-hosted total cost = direct infrastructure cost
                       + (engineering hours/month × fully-loaded eng cost/hour)
                       + (incident rate × mean incident cost)

Managed service total cost = managed service fee
                           + (minimal ops engineering hours × cost/hour)

Decision: if managed service total cost < self-hosted total cost → use managed service
```

This analysis frequently reverses naive "managed services are expensive" conclusions.

---

## 14. RI/SP Coverage and Utilization

### Target Coverage Ratios

The FinOps Foundation recommends:
- **Savings Plan / RI coverage**: Target 70-80% of stable baseline compute covered by commitments. The remaining 20-30% absorbs variable or uncertain workloads on On-Demand.
- **Savings Plan / RI utilization**: Target > 90%. Utilization below 90% means you've over-committed and are paying for capacity you don't use.

### Coverage vs. Utilization Tension

- High coverage + high utilization = optimal
- High coverage + low utilization = over-committed (wasted spend on unused commitments)
- Low coverage + high utilization = under-committed (leaving On-Demand savings on the table)

Monitor both metrics monthly. AWS Budgets supports alerts for coverage and utilization thresholds.

---

## 15. Self-Review Checklist

Before declaring a cost optimization initiative or architecture decision complete:

- [ ] **Cost tagging compliance**: Are all resources tagged with `team`, `service`, `environment`, and `cost-center`? Is tag enforcement via SCP/Azure Policy/Org Policy active?
- [ ] **Savings Plan coverage**: Is Savings Plan or RI coverage ≥ 70% of stable baseline compute? Is utilization ≥ 90%?
- [ ] **Data transfer audit**: Have cross-AZ data transfer costs been analyzed? Are S3 and DynamoDB accessed via VPC Gateway Endpoints where applicable?
- [ ] **Spot instance adoption**: Are non-critical workloads (CI, batch, dev) running on Spot? Is interruption handling implemented and tested?
- [ ] **Rightsizing complete**: Has CloudWatch (with CloudWatch Agent for memory) been analyzed for ≥ 14 days? Has Compute Optimizer been reviewed?
- [ ] **Graviton evaluated**: Have workloads been evaluated for Graviton suitability? Is the estimated savings documented and verified against https://aws.amazon.com/ec2/graviton/?
- [ ] **S3 lifecycle policies**: Do S3 buckets have lifecycle policies? Is Intelligent-Tiering enabled for buckets with unknown access patterns?
- [ ] **Kubernetes cost allocated**: Is Kubecost (or equivalent) deployed? Can every namespace owner see their cost?
- [ ] **VPA recommendations applied**: Have Vertical Pod Autoscaler recommendations been reviewed and implemented for all major workloads?
- [ ] **Unit economics calculated**: Can the team state cost per API request, cost per active user, or equivalent unit metric?
- [ ] **Anomaly detection configured**: Are AWS Cost Anomaly Detection monitors configured per service and per team? Are budget alerts set at 80% and 100%?
- [ ] **No fabricated prices**: Have all specific pricing figures been verified against official AWS/Azure/GCP pricing pages? Are pricing page URLs included for reference?
- [ ] **Architecture review cost estimate**: Was a cost estimate produced using the AWS Pricing Calculator or equivalent before the architecture was approved?
- [ ] **Build vs. buy analyzed**: For new infrastructure components, was total cost of ownership (including engineering time) compared between managed and self-hosted options?
- [ ] **Cost visibility to developers**: Can every engineer see their service's cost (ideally per-unit cost) without asking the finance or platform team?

---

## Reference URLs (Verify Before Citing — Prices Change)

- AWS EC2 On-Demand pricing: https://aws.amazon.com/ec2/pricing/on-demand/
- AWS EC2 Reserved Instance pricing: https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/
- AWS Savings Plans pricing: https://aws.amazon.com/savingsplans/pricing/
- AWS Spot Instance pricing: https://aws.amazon.com/ec2/spot/pricing/
- AWS Graviton: https://aws.amazon.com/ec2/graviton/
- AWS S3 pricing: https://aws.amazon.com/s3/pricing/
- AWS S3 storage classes: https://aws.amazon.com/s3/storage-classes/
- AWS RDS pricing: https://aws.amazon.com/rds/pricing/
- AWS Aurora pricing: https://aws.amazon.com/rds/aurora/pricing/
- AWS Compute Optimizer: https://aws.amazon.com/compute-optimizer/
- AWS Cost Anomaly Detection: https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/
- AWS Pricing Calculator: https://calculator.aws/
- FinOps Foundation phases: https://www.finops.org/framework/phases/
- Kubecost cost allocation: https://docs.kubecost.com/using-kubecost/navigating-the-kubecost-ui/cost-allocation
- Spot Instance interruption notices: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-instance-termination-notices.html
- GCP compute pricing: https://cloud.google.com/compute/pricing
- Azure reserved VM instances: https://azure.microsoft.com/en-us/pricing/reserved-vm-instances/
- Azure pricing calculator: https://azure.microsoft.com/en-us/pricing/calculator/