FinOps Basics Cheat Sheet
Introduces FinOps principles, the crawl-walk-run maturity model, cost allocation via tagging, and key cost optimization levers.
FinOps Core Principles
Foundational tenets of the FinOps Framework.
- Teams need to collaborate- Engineering, finance, and business work together on cloud spend decisions
- Decisions driven by business value- Cost trade-offs are evaluated against the value delivered, not cost alone
- Everyone takes ownership- Engineers are accountable for the cost of what they build and run
- FinOps data should be accessible and timely- Near real-time cost visibility, not month-old invoices
- A centralized team drives FinOps- A dedicated function sets rate optimization and governance practices
- Take advantage of the variable cost model- Cloud's pay-as-you-go nature enables continuous optimization, unlike fixed CapEx
Key Cost Optimization Levers
Common techniques to reduce cloud spend.
- Rightsizing- Matching instance/resource size to actual observed utilization
- Reserved Instances / Savings Plans- Commit to usage over 1-3 years for a significant discount vs on-demand
- Spot Instances- Use spare capacity at steep discounts for fault-tolerant, interruptible workloads
- Tagging / Cost Allocation- Tag resources by team/project/environment to attribute spend accurately
- Idle Resource Cleanup- Identify and terminate unattached volumes, unused elastic IPs, idle load balancers
AWS Cost Explorer CLI Query
Retrieve daily cost grouped by service for the last 7 days.
aws ce get-cost-and-usage \ --time-period Start=2026-07-01,End=2026-07-08 \ --granularity DAILY \ --metrics "UnblendedCost" \ --group-by Type=DIMENSION,Key=SERVICE
Compute Cost-Per-Unit Metrics
Mature FinOps ties spend to a business unit (cost per request, per customer, per transaction) rather than tracking raw dollars in isolation.
-- Blend a cost export (e.g. AWS CUR in Athena/BigQuery) with usage metricsSELECT DATE_TRUNC('day', usage_date) AS day, SUM(unblended_cost) AS total_cost, SUM(request_count) AS total_requests, SUM(unblended_cost) / NULLIF(SUM(request_count), 0) AS cost_per_requestFROM billing.daily_costs cJOIN app.request_metrics m USING (day, service_name)WHERE service_name = 'checkout-api'GROUP BY 1ORDER BY 1 DESC;
AWS Budgets with Anomaly Alerting
Combine a hard budget threshold with ML-based cost anomaly detection to catch both gradual overspend and sudden spikes (e.g. a runaway job).
aws budgets create-budget \ --account-id 123456789012 \ --budget '{"BudgetName":"monthly-eng","BudgetLimit":{"Amount":"50000","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \ --notifications-with-subscribers '[{"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":80},"Subscribers":[{"SubscriptionType":"EMAIL","Address":"[email protected]"}]}]'aws ce create-anomaly-monitor \ --anomaly-monitor '{"MonitorName":"service-spend","MonitorType":"DIMENSIONAL","MonitorDimension":"SERVICE"}'
Enforce Cost-Allocation Tags via SCP
A Service Control Policy that denies resource creation without required FinOps tags, preventing untagged spend from entering the environment.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyUntaggedEC2Launch", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "Null": { "aws:RequestTag/cost-center": "true", "aws:RequestTag/environment": "true" } } } ]}
Crawl-Walk-Run Maturity Signals
Concrete indicators of how far a FinOps practice has progressed beyond the basic principles, used to gauge organizational maturity.
- Crawl: allocation- Less than 80% of spend is tagged/allocated; cost reports are monthly and manually assembled
- Crawl: commitments- No Reserved Instances or Savings Plans purchased; everything runs on-demand
- Walk: unit economics- Cost-per-customer or cost-per-transaction dashboards exist and are reviewed sprint-over-sprint by engineering
- Walk: automated rightsizing- Scheduled jobs auto-stop dev/test environments outside business hours and flag oversized instances
- Run: real-time chargeback- Engineering teams see near-real-time cost dashboards scoped to their own services and are budget-accountable
- Run: unified commitment strategy- A central FinOps function manages Savings Plans/CUDs/Reservations as a portfolio across all teams to maximize coverage and minimize waste
FinOps for Kubernetes Specifics
Cluster cost allocation is harder than VM cost allocation because many workloads share the same underlying nodes.
- Bin-packing waste- Requested-but-unused CPU/memory (the gap between resource requests and actual usage) is invisible in cloud billing but is real wasted spend
- Namespace-level allocation- Tools like OpenCost/Kubecost attribute shared node cost to namespaces/labels proportional to resource requests, enabling per-team chargeback
- Cluster overhead- System pods, DaemonSets, and unschedulable headroom for spikes and drains consume capacity that must be allocated back into the cost model, not ignored
- Spot for stateless workloads- Combine cluster autoscaling with spot/preemptible node pools for fault-tolerant workloads to cut compute cost 60-90% versus on-demand
Enforce mandatory cost-allocation tags (team, environment, project) at resource-creation time via IaC policy — retrofitting tags onto untagged legacy resources is far more expensive than preventing untagged spend up front.
