Governance and Compliance¶

📖 FinOps Capabilities - Cloud Policy and Governance - Governance capability

Overview¶

This document covers FinOps governance, compliance, organizational alignment, and cultural practices. Governance ensures that cost optimization efforts are sustainable and aligned with organizational policies and regulatory requirements.

Cloud Governance Framework¶

Governance Layers¶

Account/Subscription Structure¶

Organization (root)
  ├── Management Account (billing consolidated)
  ├── Production OU
  │     ├── prod-platform
  │     ├── prod-data
  │     └── prod-ml
  ├── Non-Production OU
  │     ├── dev-platform
  │     ├── staging-platform
  │     └── sandbox
  └── Shared Services OU
        ├── networking
        ├── security
        └── logging

Benefits of Account Separation¶

• Clear cost attribution per business unit
• Blast radius isolation for security
• Independent resource quotas per account
• Simplified budget tracking and alerts
• Service control policies per organizational unit

Policy Enforcement¶

Preventive Controls¶

AWS Service Control Policies¶

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyLargeInstances",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "ForAnyValue:StringLike": {
          "ec2:InstanceType": ["*.12xlarge", "*.16xlarge", "*.24xlarge", "*.metal"]
        }
      }
    },
    {
      "Sid": "DenyUntaggedResources",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "rds:CreateDBInstance"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/team": "true"
        }
      }
    }
  ]
}

Azure Policy Examples¶

{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "not": {
            "field": "tags['team']",
            "exists": "true"
          }
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

Detective Controls¶

• Cost anomaly monitoring
• Untagged resource reports
• Unused resource detection
• Budget variance alerts
• Commitment utilization tracking

Corrective Controls¶

• Auto-stop idle dev instances
• Auto-tag resources from metadata
• Auto-remediate policy violations
• Auto-scale based on utilization
• Auto-archive old storage

Budgeting and Forecasting¶

Budget Types¶

Budget Process¶

1. Historical analysis (what did we spend last quarter?)
2. Growth projection (what business growth is expected?)
3. New initiatives (what new projects are planned?)
4. Optimization targets (what savings are expected?)
5. Buffer (10-15% contingency)
6. Approval (finance + engineering + business)
7. Monitor (weekly tracking against budget)
8. Adjust (quarterly reforecast)

Forecasting Inputs¶

• Historical spend patterns (12+ months preferred)
• Known upcoming changes (new services, migrations)
• Business growth projections
• Planned optimization savings
• Commitment expiration/renewal dates
• Seasonal patterns (holiday traffic, year-end processing)

FinOps Operating Model¶

Team Structure Options¶

FinOps Cadence¶

Communication Framework¶

Executive Report (Monthly):
- Total spend vs budget
- Month-over-month trend
- Top 3 cost drivers
- Key optimization achievements
- Risks and action items

Team Report (Weekly):
- Team spend vs budget
- Right-sizing recommendations
- Waste identified
- Action items from last week
- Optimization wins

Engineering Digest (Daily/Weekly):
- Anomaly alerts
- New optimization recommendations
- Resource utilization summaries
- Quick win opportunities

Compliance Considerations¶

Regulatory Requirements¶

Compliance Impact on Cost¶

• Data residency requirements may prevent cost-optimal region selection
• Security controls (encryption, monitoring) add infrastructure cost
• Compliance auditing requires dedicated logging and storage
• Separation of environments (PCI vs non-PCI) increases overhead
• Retention requirements impact storage costs

FinOps and Sustainability¶

• Cloud sustainability is an emerging FinOps concern
• Right-sizing reduces energy consumption
• Region selection affects carbon footprint
• Providers offer carbon footprint tools:
• AWS: Customer Carbon Footprint Tool
• Azure: Emissions Impact Dashboard
• GCP: Carbon Footprint

Stakeholder Management¶

Building FinOps Culture¶

1. Start with visibility - Share cost data openly
2. Celebrate wins - Recognize teams that optimize
3. Gamify - Leaderboards for cost efficiency
4. Educate - Training on cloud pricing and optimization
5. Incentivize - Include cost metrics in engineering goals
6. Embed - Cost as part of architecture review process

Handling Resistance¶

Success Metrics¶