Cloud Cost Engineering and Open Source FinOps
Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
Landing zone and account vending: what each new account costs
A landing zone makes new accounts safe and consistent. It also gives every new account a baseline bill before a single workload lands. Multiply a 120 dollar baseline by 80 accounts and the landing zone becomes a major line item. Here is how to size and trim it.
Blast radius vs cost: how far to split accounts and subscriptions
More accounts means smaller blast radius and cleaner attribution. It also means more baselines, more egress paths, more cross-account traffic, and more discount fragmentation. The right number is the one where isolation value exceeds the separation tax. Here is how to calculate it.
Terraform remote backend cost compared: object storage, locking, and scale
A remote state backend is one of the cheapest things a platform team runs, right up until it is not. Locking tables, versioning, request volume, and hundreds of workspaces turn a rounding error into a real line. Here is what each backend option costs at scale.
CI runner fleet cost: self-hosted fleet vs managed minutes
Managed CI minutes are simple and priced per minute. A self-hosted fleet is cheaper per minute and comes with idle capacity, autoscaling, caching, and maintenance. The crossover depends on utilization more than volume. Here is how to run the numbers for your fleet.
Build cache cost tradeoff: storage and egress versus compute minutes
A remote build cache turns compute minutes into storage and transfer charges. That trade is usually excellent and occasionally terrible, depending on hit rate, object size, and where the cache lives relative to the runners. Here is the arithmetic.
Artifact registry retention: what keeping every build costs
Registries are append only by default, so every build ever produced is still there. At a few hundred megabytes per image and dozens of builds a day, storage compounds quietly for years. Here is how retention policies change the number.
Container image size and the real cost of every pull
A 1.2 GB image feels harmless until you multiply it by every node, every deploy, every autoscale event, and every CI job. Image size shows up as transfer charges, slower scaling, and longer pipelines. Here is what shrinking an image is actually worth.
Secrets management cost at scale: per secret fees meet per environment sprawl
Secrets pricing looks trivial at 0.40 dollars per secret per month, then you multiply by 40 services, 5 environments, and rotation versions. Add API call charges from pods that fetch on every start and the bill stops being trivial. Here is how it scales.
DR standby environment cost: cold, warm, and hot compared
Disaster recovery cost is a direct function of how fast you need to recover. Cold standby is nearly free and slow, hot standby is instant and doubles the bill. Most teams buy hot when warm meets their actual recovery objective. Here is the comparison.
Blue-green vs canary deployment cost: what the safety buys and bills
Blue-green doubles capacity for the length of a deploy. Canary adds a small slice plus the routing and analysis machinery to run it. Which is cheaper depends on fleet size, deploy frequency, and how long the old version lingers. Here are the numbers.
Infrastructure test environments: paying to test the infrastructure itself
Testing Terraform means creating real resources, and real resources bill by the minute. A module test suite that provisions databases and load balancers can cost more than the infrastructure it validates. Here is how to test thoroughly without paying for it twice.
Sandbox account budgets that actually stop the spending
Sandbox accounts exist so engineers can experiment without asking permission. They also produce the most spectacular surprise bills, because nothing stops a forgotten GPU instance. Here is how to enforce a budget rather than merely alerting on one.
How to cut your AWS bill by 30 percent: the ordered playbook
A 30 percent AWS reduction is achievable on most untouched accounts, and the order of the levers matters more than the list. Delete first, resize second, commit last. Here is the sequenced playbook with expected savings per step.
How to cut your Azure bill: a sequenced reduction playbook
Azure reductions come from a different shape of waste than AWS: premium disks, orphaned NICs and public IPs, oversized VMs, and Log Analytics ingestion. Here is the ordered playbook with real meter prices and expected savings.
How to cut your GCP bill: the ordered reduction playbook
GCP has its own waste profile: idle persistent disks, unattached external IPs, snapshot sprawl, oversized machine types, and BigQuery scans. Here is the sequenced playbook with real rates and expected savings per lever.
The first 30 days of a cloud cost reduction program
A cost program that starts with a tool selection stalls. One that starts with a baseline, a hit list, and a weekly number delivers in the first month. Here is a day by day plan for the first 30 days with expected outcomes.
Reducing dev and test cloud spend without slowing engineers down
Non-production is typically 30 to 40 percent of a cloud bill and used for 30 percent of the hours. The savings are large and safe, but only if the changes do not add friction. Here is the playbook that cuts spend without cutting velocity.
Weekend and overnight shutdown: how much it actually saves
A week has 168 hours and most non-production workloads need about 45. Turning things off for the rest is the highest ratio saving in cloud. Here is the arithmetic, the implementation, and the resources that keep billing anyway.
The zombie resource hunt: finding what bills but does nothing
Zombie resources are alive on the invoice and dead in production: disks with no instance, clusters with no pods, gateways with no traffic. Here is the hunt playbook, the detection query for each type, and how to delete safely.
The cloud storage cleanup playbook: cutting object and block spend
Storage rarely spikes, it creeps, which is why it is the least audited line on most bills. Here is a five step cleanup covering tier policy, incomplete uploads, versioning, replication, and block storage, with real per GB rates.
Snapshot and backup cleanup: cutting the line that only grows
Backups are the one cost line with no natural ceiling: a daily schedule with no expiry runs forever. Here is how to audit snapshot spend, set retention that satisfies compliance, and cut 50 to 80 percent without losing recoverability.
The two week right-sizing sprint: a repeatable playbook
Right-sizing stalls when it becomes a permanent backlog. Running it as a time boxed sprint with a ranked list, a batch cadence, and a rollback rule ships 30 to 60 resources in two weeks. Here is the sprint plan.
Migrating to ARM for cost: a staged playbook with real numbers
ARM based instances price 10 to 20 percent below their x86 equivalents and often deliver better price performance than the headline rate suggests. Here is the staged migration playbook, the workloads that port cleanly, and the ones that do not.
The commitment purchase playbook: buying discounts without regret
A commitment is the only cost lever you cannot undo. Buy it at the wrong time or the wrong size and you have converted fixable waste into a three year obligation. Here is the sizing method, the timing rule, and the coverage targets.