Skip to content

Cloud Cost Optimization and FinOps Toolkit

Reproducible cost analysis over a billing export, plus Terraform guardrails

Working portfolio implementationImplemented & validated locally

Basis: Portfolio implementation over synthetic data, informed by CV work on rightsizing, resource tuning and snapshot/volume lifecycle. No production savings are claimed.

Overview

A local, dependency-free toolkit that reads a FOCUS-style billing export and produces cost allocation, rightsizing and Graviton candidates, Savings Plans sizing, a budget gate and a forecast — with Terraform for AWS Budgets and anomaly detection.

Problem

Cost reviews are often a monthly spreadsheet exercise: untagged spend is unexplained, commitments are bought on gut feel, and nobody notices a budget breach until the invoice.

Solution

Make cost analysis a repeatable command that runs in CI: allocation by tag, explicit rules for rightsizing, commitments sized from the baseline rather than the average, and a budget check that fails the pipeline when forecast spend crosses a threshold.

Architecture

  1. Source

    • Billing export

      FOCUS / CUR → S3

    • Utilization

      CPU / memory

  2. Analyze

    • allocate

    • rightsize

    • commitments

    • forecast

  3. Act

    • Report

      Markdown / HTML

    • budget gate

      non-zero exit in CI

  4. Guardrails

    • AWS Budgets

    • Anomaly Detection

    • SNS alerts

Billing data flows one way into a report and a CI gate; guardrails alert independently.

Technology stack

  • Python (stdlib)
  • FOCUS billing schema
  • AWS Budgets
  • Cost Anomaly Detection
  • Data Exports
  • S3
  • Terraform
  • GitHub Actions

Implementation

  • Deterministic synthetic data generator so every result in the README can be reproduced.
  • Commitment recommendation from a percentile of the hourly on-demand baseline, which avoids over-committing to peaks.
  • Graviton suggestions are flagged as needing compatibility testing, not presented as free savings.
  • Terraform module for budgets, anomaly monitoring and an encrypted export bucket, validated without touching an account.

Security

  • Read-only IAM policy for the export bucket.
  • Export bucket encrypted, public access blocked, write access only for the billing service.

Reliability

  • The budget command is designed as a CI gate with explicit exit codes.

Cost

  • The guardrails themselves cost close to nothing: budgets and anomaly detection have minimal or no charge; storage is the main cost.

Results

No quantified results are published for this project. Figures from client work are confidential, and this portfolio only shows numbers that can be verified or reproduced.

Code & documentation

View on GitHub

Lessons learned

  • Tag hygiene is the prerequisite for every other FinOps practice.
  • Prices change — keep them in one table and label them illustrative.