/ledger

Cost Governance

Purpose: Operational design for budget alerts, CI/CD cost gates, tag enforcement, and ongoing cost management. Read when: Building out cost governance mechanisms.

Budget Alert Design

Alert Escalation Matrix

Budget Configuration Template

# AWS Budget example
budget:
  name: "team-{team_name}-monthly"
  amount: 10000  # USD
  time_unit: MONTHLY

  notifications:
    - threshold: 50
      type: ACTUAL
      subscribers: ["team-slack-webhook"]
    - threshold: 75
      type: ACTUAL
      subscribers: ["team-lead@example.com"]
    - threshold: 90
      type: ACTUAL
      subscribers: ["eng-manager@example.com"]
    - threshold: 100
      type: FORECASTED
      subscribers: ["finops-team@example.com"]

  cost_filters:
    tags:
      team: ["{team_name}"]

CI/CD Cost Gate Integration

Infracost PR Gate

# .github/workflows/cost-gate.yml
name: Cost Gate
on: [pull_request]

jobs:
  cost-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: infracost/actions/setup@v3
        with:
          api-key: ${{ secrets.INFRACOST_API_KEY }}

      - name: Generate cost diff
        run: |
          infracost diff \
            --path . \
            --compare-to infracost-base.json \
            --format json \
            --out-file /tmp/infracost.json

      - name: Check threshold
        run: |
          DIFF=$(jq -r '.diffTotalMonthlyCost' /tmp/infracost.json)
          THRESHOLD="${COST_THRESHOLD:-100}"
          if (( $(echo "$DIFF > $THRESHOLD" | bc -l) )); then
            echo "COST_EXCEEDED=true" >> $GITHUB_ENV
          fi

      - name: Comment on PR
        uses: infracost/actions/comment@v3
        with:
          path: /tmp/infracost.json
          behavior: update

Cost Gate Thresholds

Tag Enforcement

Required Tags

Tag Policy Enforcement

# AWS SCP for tag enforcement
resource "aws_organizations_policy" "require_tags" {
  name    = "require-cost-tags"
  type    = "TAG_POLICY"
  content = jsonencode({
    tags = {
      team        = { tag_key = { "@@assign" = "team" }, enforced_for = { "@@assign" = ["ec2:*", "rds:*", "s3:*"] } }
      environment = { tag_key = { "@@assign" = "environment" }, enforced_for = { "@@assign" = ["ec2:*", "rds:*", "s3:*"] } }
      service     = { tag_key = { "@@assign" = "service" }, enforced_for = { "@@assign" = ["ec2:*", "rds:*", "s3:*"] } }
    }
  })
}

Continuous Cost Review Cadence

FinOps Maturity Model

Automated Remediation Patterns