Terraform: AWS Budget + IAM Policy + Lambda Trigger

ork using infrastructure-as-code, event-driven automation, and policy enforcement.

Step 1: Enforce Cost Allocation at Deployment

Cost attribution fails when tagging is optional. Implement policy-as-code to reject deployments missing mandatory tags (environment, team, project, cost-center). Use Open Policy Agent (OPA) or native cloud policy engines to enforce this at the API level.

// Pulumi policy example: enforce required tags on all resources
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const requiredTags = ["environment", "team", "project", "cost-center"];

export const tagEnforcement = new aws.organizations.Policy("tag-enforcement", {
  type: "SERVICE_CONTROL_POLICY",
  description: "Enforce mandatory cost allocation tags",
  content: JSON.stringify({
    Statement: [{
      Effect: "Deny",
      Action: "ec2:RunInstances",
      Resource: "*",
      Condition: {
        StringNotEquals: requiredTags.reduce((acc, tag) => {
          acc[`aws:RequestTag/${tag}`] = [""];
          return acc;
        }, {} as Record<string, string[]>)
      }
    }]
  })
});

Step 2: Implement Continuous Cost Monitoring & Anomaly Detection

Static budgets trigger alerts too late. Deploy a Lambda function that queries AWS Cost Explorer, calculates rolling averages, and triggers remediation workflows when spend deviates beyond a threshold.

import { CostExplorerClient, GetCostAndUsageCommand } from "@aws-sdk/client-cost-explorer";
import { SNSClient, PublishCommand } from "@aws-sdk/client-sns";

const costClient = new CostExplorerClient({ region: process.env.AWS_REGION });
const snsClient = new SNSClient({ region: process.env.AWS_REGION });

export const handler = async () => {
  const params = {
    TimePeriod: { Start: "2024-01-01", End: "2024-02-01" },
    Granularity: "DAILY",
    Metrics: ["UnblendedCost"],
    GroupBy: [{ Type: "DIMENSION", Key: "SERVICE" }]
  };

  const command = new GetCostAndUsageCommand(params);
  const response = await costClient.send(command);

  const anomalies = response.ResultsByTime?.filter(day => {
    const cost = parseFloat(day.Total?.UnblendedCost?.Amount || "0");
    return cost > 150; // threshold for anomaly
  }) || [];

  if (anomalies.length > 0) {
    await snsClient.send(new PublishCommand({
      TopicArn: process.env.COST_ALERT_TOPIC,
      Message: JSON.stringify({ type: "COST_ANOMALY", data: anomalies })
    }));
  }
};

Step 3: Rightsizing & Scheduling

Analyze CloudWatch metrics (CPU, memory, network I/O, disk IOPS) to identify over-provisioned instances. Use AWS Compute Optimizer or custom scripts to generate rightsizing recommendations. Schedule non-production environments to terminate or stop during off-hours.

// Scheduled termination for dev environments via EventBridge + Lambda
import { EC2Client, StopInstancesCommand } from "@aws-sdk/client-ec2";

const ec2Client = new EC2Client({ region: process.env.AWS_REGION });

export const handler = async () => {
  const instances = await ec2Client.send(new StopInstancesCommand({
    InstanceIds: process.env.DEV_INSTANCE_IDS?.split(",") || [],
    Force: false
  }));
  
  console.log(`Stopped ${instances.StoppingInstances?.length} dev instances`);
};

Step 4: Commitment Management with Coverage Alerts

Purchase Savings Plans or Reserved Instances only after establishing a 30-day usage baseline. Monitor coverage ratios and set alerts when utilization drops below 80% to avoid overcommitment.

Step 5: Automated Cleanup & Lifecycle Policies

Deploy lifecycle policies for EBS volumes, S3 buckets, and RDS snapshots. Remove unattached volumes, idle load balancers, and abandoned NAT gateways. Use CloudFormation StackSets or Terraform workspaces to apply policies uniformly across accounts.

Architecture Decisions & Rationale

• Centralized FinOps Data Lake vs Distributed Dashboards: Centralized cost data enables cross-account correlation and unified policy enforcement. Distributed dashboards fragment visibility and delay remediation.
• Event-Driven vs Scheduled Jobs: Event-driven cleanup (e.g., CloudWatch Events triggering Lambda on volume detachment) reduces latency and compute overhead compared to cron-based polling.
• IaC as Single Source of Truth: All cost controls (tags, sizing, scheduling, commitments) must be codified. Manual console changes bypass governance and reintroduce drift.
• Policy-as-Code Enforcement: Blocking non-compliant deployments at the API layer prevents cost leakage at the source. Post-deployment remediation is always more expensive than prevention.

Pitfall Guide

1. Blind Commitment Purchasing: Buying Savings Plans without analyzing usage patterns leads to 20–30% wasted commitments. Always validate with a 30-day rolling average before purchasing.
2. Ignoring Data Transfer & Egress Costs: Compute optimization often masks network spend. Inter-AZ traffic, NAT gateway processing, and cross-region replication can dominate bills. Route optimization and VPC endpoints reduce egress by 40%+.
3. Over-Reliance on Spot Instances for Stateful Workloads: Spot instances offer 60–90% savings but terminate with 2-minute warnings. Using them for stateful databases or long-running transactions causes data loss and SLA breaches. Reserve spot for fault-tolerant, batch, or horizontally scalable workloads.
4. Tagging Sprawl Without Enforcement: Creating 50+ tag keys without mandatory enforcement creates noise and breaks cost allocation. Standardize to 4–5 core tags and enforce via policy-as-code.
5. Optimizing Compute While Ignoring Storage/Network: EBS gp2 vs gp3, snapshot retention, and unattached IPs are silent budget drains. Storage optimization typically yields 15–25% savings with zero performance impact.
6. Manual Optimization Processes: Spreadsheet tracking and console click-throughs do not scale. Automation must handle rightsizing, scheduling, cleanup, and commitment monitoring. Manual processes introduce latency and human error.
7. Treating Cost Optimization as a One-Time Project: Cloud economics change with traffic patterns, feature releases, and architectural shifts. Optimization requires continuous feedback loops, not quarterly audits.

Best Practices from Production:

• Implement showback/chargeback to align engineering incentives with cost efficiency.
• Use infrastructure blueprints with pre-optimized defaults (right-sized AMIs, gp3 volumes, VPC endpoints).
• Monitor coverage ratios for commitments, not just absolute spend.
• Integrate cost alerts into CI/CD pipelines to catch cost regressions before deployment.

Production Bundle

Action Checklist

• Define mandatory cost allocation tags and enforce via policy-as-code at deployment
• Deploy centralized cost monitoring with anomaly detection and SNS/Slack alerts
• Analyze 30-day CloudWatch metrics to generate rightsizing recommendations
• Schedule non-production environments to stop during off-hours using EventBridge
• Purchase commitments only after validating usage baseline and setting coverage alerts
• Implement lifecycle policies for EBS, S3, RDS snapshots, and unattached network resources
• Integrate cost regression checks into CI/CD pipelines to prevent budget drift

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
Startup / Rapid Experimentation	Observability-Driven Scaling + Lifecycle Policies	Unpredictable traffic requires elasticity; commitments lock capital prematurely	25–40% reduction
Enterprise / Steady-State Workloads	Commitment Purchasing + Rightsizing	Predictable usage justifies discounts; rightsizing eliminates baseline waste	30–45% reduction
Batch Processing / Data Pipelines	Spot Instances + Auto-Scaling Groups	Fault-tolerant workloads absorb interruptions; auto-scaling matches compute to job queue	60–80% reduction
Multi-Tenant SaaS / Variable Load	Policy-as-Code + Automated Scheduling + Egress Optimization	Tenant isolation requires strict tagging; off-hours scheduling and VPC endpoints cut silent costs	20–35% reduction

Configuration Template

# Terraform: AWS Budget + IAM Policy + Lambda Trigger
resource "aws_budgets_budget" "cost_alert" {
  name              = "monthly-cost-alert"
  budget_type       = "COST"
  limit_amount      = "5000"
  limit_unit        = "USD"
  time_unit         = "MONTHLY"

  notification {
    comparison_operator = "GREATER_THAN"
    threshold           = 80
    threshold_type      = "PERCENTAGE"
    notification_type   = "ACTUAL"
    subscriber_email_list = ["finops@company.com"]
  }
}

resource "aws_iam_role_policy" "cost_monitor_policy" {
  name = "cost-monitor-policy"
  role = aws_iam_role.lambda_exec.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "ce:GetCostAndUsage",
          "ce:GetCostForecast",
          "cloudwatch:GetMetricData",
          "sns:Publish"
        ]
        Resource = "*"
      }
    ]
  })
}

resource "aws_lambda_function" "cost_anomaly_detector" {
  function_name = "cost-anomaly-detector"
  handler       = "dist/handler.handler"
  runtime       = "nodejs18.x"
  role          = aws_iam_role.lambda_exec.arn
  timeout       = 30
  memory_size   = 256

  environment {
    variables = {
      COST_ALERT_TOPIC = aws_sns_topic.cost_alerts.arn
    }
  }
}

resource "aws_cloudwatch_event_rule" "daily_cost_check" {
  name                = "daily-cost-check"
  schedule_expression = "cron(0 2 * * ? *)"
}

resource "aws_cloudwatch_event_target" "lambda_target" {
  rule      = aws_cloudwatch_event_rule.daily_cost_check.name
  target_id = "Lambda"
  arn       = aws_lambda_function.cost_anomaly_detector.arn
}

Quick Start Guide

1. Deploy Tag Enforcement Policy: Apply the OPA or SCP template to your management account. Test by attempting to provision a resource without mandatory tags; deployment should fail.
2. Initialize Cost Monitoring: Upload the TypeScript Lambda to your account, configure the SNS topic, and attach the IAM policy. Verify CloudWatch logs show successful Cost Explorer queries.
3. Schedule Off-Hours Automation: Create an EventBridge rule targeting your dev/test instance IDs. Run a dry-run stop command during business hours to validate permissions and rollback behavior.
4. Validate & Iterate: Check cost allocation reports after 7 days. Confirm tags populate correctly, anomalies trigger alerts, and scheduled jobs execute without impacting production workloads. Adjust thresholds based on actual traffic patterns.