Budgets and Cost Allocation¶
Two questions matter for every pound or euro spent: is it within what was expected, and who is it for? Budgets answer the first, per subscription. The
FinOpsIdtag answers the second, per resource.
Status: budgets in place, cost allocation partly in place
Every vended subscription gets a budget with alerts. The FinOpsId tag is applied by Terraform, but the policy that checks it is audit-only. There is no cost allocation report yet.
Budgets (in place)¶
Subscription vending creates an Azure budget on every subscription through the terraform-azurerm-subscription-budget module.
| Setting | Value |
|---|---|
| Amount | budget_amount, set per subscription in the vending file. Defaults to 10 a month, in the billing currency. |
| Alerts | 80% actual, 100% actual and 100% forecast |
| Recipients | budget_alert_emails, set per subscription |
| Scope | The whole subscription |
Set the amount on purpose
The default of 10 suits a near-empty subscription. When a workload grows, set budget_amount from its expected monthly cost. A budget that always fires is ignored, and one that never fires is useless.
Budgets alert. They don't stop spending. Azure has no hard cap on pay-as-you-go subscriptions. The forecast alert is the early warning, so make sure its recipients act on it.
Cost allocation with FinOpsId¶
Subscription vending gives every subscription a FinOpsId: a random UUID that never changes, applied as a tag to the subscription's resources. In Cost Management, group by tag FinOpsId to see spending per subscription and workload, even if resources move or are renamed.
For this to work:
- Every resource needs the tag. Terraform modules apply it. Anything created by hand won't have it, and shows as untagged cost.
- Tags on resources, not only resource groups. Cost Management reports resource tags. Enable tag inheritance in Cost Management so resource group and subscription tags also apply to cost records.
- Keep a mapping from
FinOpsIdto a cost owner. A UUID doesn't say who pays. Keep a lookup of eachFinOpsIdto its workload, owner and cost centre, for example in the subscription vending repository or a finance sheet, so reports can be turned into chargeback.
Cost guardrail policies¶
Three FinOps initiatives are assigned through EPAC, audit-only today:
| Assignment | Checks |
|---|---|
psa-gen-FinOps |
Resource providers and types that shouldn't be used |
psa-st-FinOps |
Allowed storage SKUs and lifecycle settings |
psa-kv-FinOps |
Key Vault cost settings |
Monthly review¶
Once a month, the platform lead reviews:
- Spending per subscription against budget, and why any budget was exceeded.
- Untagged or wrongly tagged cost.
- Azure Advisor cost recommendations: idle resources, right-sizing, and commitment opportunities.
- Log Analytics ingestion trends.