Checklist · Cloud and DevOps
Cloud Cost Optimization Checklist
Opens with creditsA cloud cost checklist written for the engineers who create the spend, not only for finance. It covers seeing and allocating cost, budgets and anomaly alerts, rightsizing, autoscaling and scheduling, commitment discounts, storage lifecycle, data transfer, idle resources and unit cost metrics, each with a severity and a concrete way to verify it on AWS, Google Cloud or Azure.
What you will learn
9 chapters · about 18 min
1Visibility, tagging and allocationWhether engineers can see what their services cost, and every line of the bill traces back to an owner.6 checks · 3 min
- 1Engineers can see the daily cost of the services they own
- 2Detailed billing data is exported to a place you can query
- 3A short list of required tags or labels is defined and applied
- 4Missing required tags are blocked or flagged when resources are created
- 5Accounts, projects or subscriptions separate teams and environments
- 6Shared costs have an agreed method for splitting them
6 in this chapterOpen this chapter2Budgets and anomaly alertsWhether unexpected spend is caught within a day by the team that caused it, not at the end of the month by finance.5 checks · 3 min
- 1Each team, account or project has a budget with alerts
- 2Cost anomaly detection is turned on and covers every account
- 3Budget and anomaly alerts reach the owning team, not only finance
- 4Sandbox and experiment accounts have automatic spend guardrails
- 5New workloads have a cost estimate before launch
5 in this chapterOpen this chapter- RightsizingWhether the resources you pay for match what the workload actually uses.4 checks · 2 minOpens with credits
- Autoscaling and schedulingWhether capacity follows demand, and resources that only matter during working hours are off the rest of the time.4 checks · 2 minOpens with credits
- Commitment discountsWhether steady usage is covered by commitments that are actually used, without locking in waste.3 checks · 1 minOpens with credits
- Storage, logs and retentionWhether data moves to cheaper tiers or is deleted once it stops being useful, instead of growing forever.4 checks · 2 minOpens with credits
- Data transfer and egressWhether traffic between zones, regions and the internet is understood, and avoidable transfer is designed out.4 checks · 2 minOpens with credits
- Idle resources and decommissioningWhether resources are tracked over their lifetime and removed when the project, experiment or environment ends.3 checks · 1 minOpens with credits
- Unit costs and regular reviewWhether cost is measured against what the business gets for it, and reviewed often enough to steer.4 checks · 2 minOpens with credits
About this checklist
Cloud bills rarely grow because of one bad decision. They grow because a test cluster was never deleted, a log bucket keeps everything forever, a chatty service talks across zones all day, a dev database runs all weekend at production size, and nobody can say which team owns a third of the line items. Each is small on its own and invisible until the monthly invoice arrives. The fix is not a quarterly cost-cutting sprint. It is making cost visible to the people who create it, and building a few habits into how they design, deploy and clean up.
That is the idea behind FinOps, the practice described by the FinOps Foundation's framework. Its principles include that everyone takes ownership for their technology usage, that FinOps data should be accessible, timely and accurate, and that business value drives technology decisions. The cloud providers say the same in their own architecture guidance: the cost optimization pillars of the AWS Well-Architected Framework, the Google Cloud Well-Architected Framework and the Azure Well-Architected Framework all start with ownership and visibility before any specific saving.
This checklist turns that guidance into checks an engineer can run. The chapters move from seeing the money (tagging, allocation, budgets, anomaly alerts) to spending less of it (rightsizing, scaling and scheduling, commitments, storage, data transfer, idle resources) and finally to measuring it against what the business gets (unit cost metrics and regular reviews). The checks use each provider's own tools by name where that helps you find the setting, and none of them depend on current prices, which change too often to print.
Every check has a severity. A must is something whose absence lets spend grow unseen or unowned. A should is a common saving or safeguard most teams can add within a sprint. A nice adds depth once the rest is in place. Each check says how to verify it: a report to open, a policy to test or a query to run.
Common questions
What is FinOps?
FinOps is an operating model for managing cloud and technology spend, described by the FinOps Foundation. It brings engineering, finance and product together around shared cost data, with principles such as everyone owning their technology usage and business value driving technology decisions. Its framework groups the work into phases called Inform, Optimize and Operate.
Where should I start reducing cloud costs?
Start with visibility: required tags, a budget and anomaly alerts for every account, and cost data engineers can see daily. Then take the quick wins: idle and orphaned resources, non-production schedules, storage lifecycle rules and log retention. Rightsizing and commitments come after, once you know your steady usage.
Does a cloud budget stop spending when it is reached?
Usually not. On Google Cloud an alerts-only budget does not cap usage or spending, and AWS and Azure budgets also alert by default. To stop spend automatically you need to configure budget actions or programmatic notifications that apply a policy or shut resources down, which is best kept for sandbox accounts.
Should we buy Reserved Instances or Savings Plans before rightsizing?
Do enough rightsizing and cleanup to know your real steady baseline, then commit to that baseline. The FinOps framework warns that committing first can lock in waste and double count savings, but also that waiting for perfect optimization usually costs more than buying a sensible commitment now.
What is a unit cost metric?
It is spend divided by a measure of what the spend produces, such as cost per customer, per transaction or per GB stored. Tracking it over time shows whether the system is getting more efficient as it grows, which total spend alone cannot tell you.
Sources (8)
Checked against these, last on 13 October 2026.
- FinOps Framework, FinOps Foundationwww.finops.org/framework/
- Allocation, FinOps Foundationwww.finops.org/framework/capabilities/allocation/
- Rate Optimization, FinOps Foundationwww.finops.org/framework/capabilities/rate-optimization/
- Unit Economics, FinOps Foundationwww.finops.org/framework/capabilities/unit-economics/
- Cost Optimization Pillar: Design principles, AWS Well-Architecteddocs.aws.amazon.com/wellarchitected/latest/cost-optimization-pillar/design-principles.html
- Detecting unusual spend with AWS Cost Anomaly Detection, AWS docsdocs.aws.amazon.com/cost-management/latest/userguide/manage-ad.html
- Create, edit, or delete budgets and budget alerts, Google Cloud docsdocs.cloud.google.com/billing/docs/how-to/budgets
- Design review checklist for Cost Optimization, Microsoft Azure Well-Architected Frameworklearn.microsoft.com/en-us/azure/well-architected/cost-optimization/checklist
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allCheat sheets
See allBest practices
See all- Kubernetes Best PracticesRun workloads on Kubernetes that schedule well, survive restarts and node drains, and stay locked down: resources, probes, PDBs, Pod Security and RBAC.
- Terraform Best PracticesWrite Terraform that teams can review and change safely: file layout, version pinning, remote state with locking, secrets, modules, refactoring and tests.
Checklists
See all- AWS Account Security ChecklistLock down an AWS account: root user, IAM Identity Center, roles instead of keys, CloudTrail, GuardDuty, S3 Block Public Access, IMDSv2 and guardrails.
- Incident Response ChecklistPrepare for and handle production incidents: on-call, severity levels, declaring, roles, mitigation, security containment, status updates and blameless postmortems.
- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
Project structures
See all- Terraform project structureAn infrastructure repository for a small app on AWS: reusable modules, one folder per environment with its own remote state, pinned providers, tests and security scans, with plan on every pull request and apply from CI. For students who have finished the Terraform tutorials and want to know how a real team lays out the files. The same layout works unchanged with OpenTofu.
- Kubernetes with Helm project structureA Helm chart repository for one app: the chart that
helm creategives you, grown into a tested, versioned package with per-environment values, unit tests, install tests in a kind cluster and releases to an OCI registry. For students who can write a Deployment by hand and want to know how a team organises charts. It is about the repo layout and what each file does, not about cluster design. - Firebase (Cloud Functions and security rules) project structureFor students building an app on Firebase who need a real backend: Cloud Functions (2nd gen) in TypeScript, Firestore and Storage security rules with tests, and the Local Emulator Suite. The tree starts from
firebase initand grows into feature folders of callables, triggers and scheduled jobs, then adds CI deploys, environments, contract tests and runbooks.
Career questions
See all- Which cloud should I learn first: AWS, Azure or GCP?If you have no reason to choose otherwise, start with AWS: it has the largest market share and the most learning material. Choose Azure if the employers you want run on Microsoft, and GCP if you are heading into data and ML work at companies that use it. The concepts transfer, so the first cloud matters less than learning it properly.
- How do I practise on AWS, Azure or Google Cloud without getting a surprise bill?Use the free offer that fits you, set a budget alert before you create anything, tag every resource, build and destroy your labs with code, and run a five-minute check for the usual culprits, such as NAT gateways, load balancers, databases and public IPs, before you close your laptop.
- Are certifications like AWS or Google Cloud worth it for getting a tech job?It depends on the role. For cloud, DevOps, security and some data roles, a respected certification can help you get shortlisted, especially combined with a real project. For general software engineering roles, projects and skills matter far more. Do the certification to structure your learning, not as a replacement for building.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com