Blog category
The standard FinOps loop is monthly: bill arrives, FinOps team flags variance, engineering investigates, fix lands the next sprint. Shift-left collapses that loop to minutes: cost estimation in PRs, per-team budget alarms in Slack, and cost ownership tags enforced at IaC time. The result is engineers making cost-aware decisions at design time.
Kevin W.KMS keys cost $1/month each, which is the easy number. The hidden bill is request volume at $0.03 per 10K calls, multi-region replicas that each bill $1/month independently, and asymmetric operations at 5× the symmetric rate. An S3 bucket with 100M SSE-KMS objects and an active read pattern can generate thousands per month in KMS requests alone.
Kevin W.SageMaker AI Savings Plans deliver up to 64% off SageMaker training, real-time inference, async inference, serverless inference, and processing jobs in exchange for 1-year or 3-year hourly commitment. Compute Savings Plans do NOT cover SageMaker, so this is a separate purchase. The break-even is much faster than RI-style commits for steady ML production workloads.
Kevin W.On June 9, 2026 AWS previewed FinOps Agent, a Bedrock-powered agent that investigates cost anomalies via CloudTrail, answers NL cost questions, and opens Jira tickets from Cost Optimization Hub. Free in preview; not a replacement for ownership or tagging.
Kevin W.A lift-and-shift migration copies on-prem specs sized for peak plus headroom, then the migration partner rolls off and nobody owns the bill. The waste is predictable: 30 to 60% of cost untagged, over-provisioned EC2/RDS, idle NAT Gateways and orphaned EBS, and commitments bought on top of all of it. This is the explicit migration-to-FinOps handoff: owner first, visibility second, right-size before you commit. It comes with a 30-day checklist and an optimization-backlog CSV.
Kevin W.Tag policies report; only an SCP prevents untagged spend. And ~21% of a typical bill (egress, inter-AZ transfer, Enterprise Support, shared platform services) carries no tag any tool can read. The post covers the two-layer enforcement model, the Cost Categories split-charge rules that replace the monthly allocation spreadsheet, and why you show back before you charge back.
Kevin W.Most "RI vs Savings Plan" content treats them as peers. In mid-2026 they are not. A 3-year All-Upfront Compute Savings Plan saves a composite ~$60k/mo SaaS roughly $864k over 3 years vs a 1-year No-Upfront plan, but breaks even at ~22 months and locks instance-family flexibility. Buy the wrong commitment and a Graviton migration strands the discount. This post gives the decision tree we use.
Kevin W.Most teams buy Bedrock Provisioned Throughput too early or too late. This is the break-even math, by token volume, model family, and traffic shape, that we use in real FinOps engagements to decide which Bedrock pricing mode wins.
Kevin W.An idle NAT Gateway in us-east-1 costs $36.50/month before any traffic: $32.85 in hours plus $3.65 for the public IPv4. A Regional NAT Gateway across three AZs still bills three hours, $109.50 idle.
Kevin W.Cheapest Spot pool is often the unstable one. July 2026: price-capacity-optimized + attribute-based selection, stability scoring, and interruption handling, before you chase $/hr.
Kevin W.The standard cost optimization checklist no longer cuts it. These 8 modern strategies, from unit economics to automated Savings Plans and cost observability, reflect how engineering teams are actually managing cloud spend in 2026.
Kevin W.AWS Cost Anomaly Detection uses machine learning to flag unusual spending patterns: runaway EC2 instances, unexpected Lambda spikes, or compromised credentials. This guide covers setup, alerting, and automation to prevent bill shock.
Kevin W.
