Cost Intelligence Dashboard
A serverless FinOps platform that answers who owns the spend, where it is wasted, what it costs per unit, and what it will be next month, not just what each service cost. Cost allocation by tag, unit economics, a waste scan, reservation coverage, budgets, anomaly detection, and FOCUS normalization for multi-cloud chargeback, with least-privilege isolation at every layer.
/01Problem
Cost tools answer what you spent by service. A FinOps practice needs the harder questions: who owns this spend, where is it being wasted, and what will it be next month. Tag-based allocation is the mechanism for the first, but it fails quietly, a tag applied with the wrong casing, a tag never activated in Cost Explorer, or resources that escape tagging entirely.
The goal was a platform that ingests cost data and layers on the controls that make it actionable: allocation by owner, waste detection, reservation coverage, budgets, and anomalies surfaced before the billing period closes.
/02Approach
- A Lambda ingester pulls 90 days of Cost Explorer data into a DynamoDB single-table store daily, grouped by service and, in a second query, by the Project cost allocation tag so spend maps to an owner. Untagged spend is surfaced explicitly rather than hidden.
- The same ingester pulls RI and Savings Plans coverage and scans EC2 for waste: unattached EBS volumes, unassociated Elastic IPs, and gp2 volumes that should be gp3, each with an estimated monthly dollar cost.
- A z-score analyzer flags per-service spend beyond 2.5σ of a 30-day rolling baseline and forecasts 14 days out by linear regression. An AWS Budget (80% actual / 100% forecast) and an optional AWS-managed anomaly monitor run alongside it, so detection never rides on a single detector.
- Unit economics: the LLM ingester aggregates request counts, input/output tokens, and cache hits per provider and writes cost per inference, cost per 1k tokens, and cache hit rate. This is the FinOps Run metric, cost per thing that scales with the business rather than cost per calendar day.
- FOCUS normalization: a /focus endpoint maps daily records to the FOCUS open cost-and-usage schema (ProviderName, ServiceCategory, BilledCost, EffectiveCost, and so on). The Azure sibling emits the same columns, so the two clouds join on one schema for cross-provider chargeback.
- EventBridge Scheduler triggers ingestion at 01:00 UTC and analysis at 02:00 UTC; SNS carries both anomaly and budget alerts.
/03The tagging bug worth telling
The original design applied tags in lowercase but the compliance scanner checked for TitleCase with an exact match, so every resource reported as non-compliant even though everything was tagged. The fix made TitleCase the single canonical casing, moved it into provider default_tags so nothing is created untagged, and aligned the required list to match. A governance check is only as good as its agreement with what actually gets applied.
Deploying surfaced two real AWS limits: a cost allocation tag can only be activated once Cost Explorer has seen it in billing data, and an account allows only one dimensional anomaly monitor. Both are gated behind default-off variables rather than left to break a fresh apply.
/04Outcome
Deployed 44 resources, invoked the pipeline live, and verified the endpoints: coverage returned real RI and Savings Plans data, cost-by-tag correctly surfaced untagged spend, the waste scan ran clean, unit economics computed exactly ($0.40 per inference and $0.20 per 1k tokens against seeded traffic), and /focus returned FOCUS-conformant rows (EC2 to Compute, S3 to Storage, LLM to AI and Machine Learning). Then torn down to keep spend near zero.
Results are served through an API Gateway HTTP API to a React frontend on S3 behind CloudFront with Origin Access Control. Four separate IAM execution roles enforce least privilege at each layer; Terraform runs on an S3 backend with native state locking, deployed via GitHub Actions OIDC.