Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Applies to this Azure Well-Architected Framework Cost Optimization checklist recommendation:
| CO:04 | Set spending guardrails. Guardrails should include release gates, governance policies, resource limits, and access controls. Prioritize platform automation over manual processes. |
|---|
Spending guardrails are controls that help manage costs within a defined budget, prevent unexpected or excessive spending, and promote cost-effective resource utilization. Without appropriate guardrails, workload costs can exceed budget expectations, resulting in unplanned expenses and increased financial risk.
This guide provides recommendations for establishing effective spending guardrails. It provides key strategies for determining when to use release gates, governance policies, resource limits, and access controls to manage costs and promote responsible resource utilization.
Definitions
| Term | Definition |
|---|---|
| Budget threshold | A predefined spending amount that triggers alerts or blocks deployments when approached or exceeded. |
| Commitment-based discounts | Reduced rates earned by committing to a specific amount of usage or spending over time, such as reservations, savings plans, or prepaid subscriptions. |
| Commitment utilization | The percentage of a commitment-based discount (such as a reservation or savings plan) that's consumed by eligible resource usage within a billing period. Low utilization means you're paying for committed capacity you aren't using. |
| Ephemeral environment | A short-lived infrastructure environment created on demand for development, testing, or staging, then destroyed when no longer needed. |
| Governance | A set of policies, processes, and controls that help ensure that the workload is managed effectively, securely, and in compliance with organizational and regulatory requirements. |
| Governance policies | A set of rules that enforce compliance and enable auditing of workload resources. |
| Infrastructure as code (IaC) | A descriptive model for defining and deploying infrastructure, including networks, virtual machines, load balancers, and connection topologies. |
| Release gate | A condition or checkpoint in a release pipeline that must be satisfied before the deployment can proceed. A release gate helps ensure that specific criteria are met before software is released. |
Use governance policies
Governance policies can act as spending guardrails on various aspects of resources such as resource types, configurations, tags, location, and data management. Use native services to automate the enforcement of governance policies. Also, set automated policies to control resource usage, enforce accountability, and eliminate spending on restricted resource types. Here are some of the policies you should consider enforcing:
Restricted resource types: Evaluate which resource types are allowed or disallowed by the organization, when designing your workload.
Resource limits: Establish appropriate limits on the number, size, and duration of resources to help prevent overprovisioning and excessive spending. For example, resource limits can reduce the financial impact of an unauthorized account breach used for crypto mining.
Risk: If you implement automatic scaling, set a maximum scaling threshold based on testing. Maximum thresholds can help avoid massive scaling spikes that cause cost overruns, but a threshold that you set too low might negatively affect performance. For more information, see Recommendations for optimizing scaling costs.Defined resource configurations: Identify resource configurations that can help optimize costs, such as automatic scaling and data archiving, and consider incorporating them into governance policies.
Restricted locations: Determine which regions or locations are appropriate for resource deployment. Consider restricting locations to avoid unnecessary data transfer costs and meet data sovereignty requirements.
Managed data: Use policies to enforce data management practices that help optimize costs. For example, you can implement policies that require the use of lower-cost storage tiers for less frequently accessed data or policies that define expiration rules for data retention.
Enforced metadata: Follow organizational requirements and consistency in metadata that tracks cost, allocation, and automated resource management. A consistent metadata policy helps align costs with spending guardrails.
Limited idle resources: Establish processes to identify and manage idle or underutilized resources. Consider using monitoring and lifecycle controls to stop, delete, or repurpose resources when they're no longer needed.
Configure access controls
Unrestricted access to resource provisioning is a common cause of cost overruns. Access controls can help limit who can create, modify, or delete resources and the scope of those permissions.
Assign access by responsibility: Define separate permissions for viewing cost data, managing budgets and alerts, and provisioning resources. Grant each role the access needed to perform its responsibilities.
Control changes to your workload's resources: Establish standard access control practices, including maintaining an audit trail, to help prevent unauthorized or accidental changes that can result in cost overruns.
Constrain automated pipelines: Limit deployment identities to the resources that they manage. Use safe deployment practices to implement guardrails into your deployment processes. Require cost approval gates for production deployments, where automated or human reviews check for reasonable resource types and configurations for the workload's requirements.
Use release gates
Release gates are checkpoints or conditions that must be met before a release or deployment can proceed. They can help ensure that deployments remain within budget and align with cost optimization goals. Release gates also provide a structured way to identify and address potential cost issues before they affect the workload. Consider the following practices when implementing release gates:
Establish release gate criteria and implement the release gates. Define the conditions that should be met before resources are released or deployed. Consider factors such as spending limits, resource utilization thresholds, and project milestones. Use your cost model as the baseline for gate thresholds and spending limits.
Incorporate the release gates into the deployment pipeline. Use automation tools or custom scripts to ensure that resource deployments are subject to the defined criteria.
Monitor spending. Continuously monitor spending and resource usage against the defined criteria. If the workload exceeds spending thresholds, the release gates should prevent further deployments until the issue is addressed.
For guidance on collecting cost data to support release gate thresholds, see Collect and review cost data.
Configure cost alerts
Cost alerts provide visibility into cloud spending and can support proactive cost management. Consider using alerts for budgets, cost anomalies, and commitment-based discount utilization. Keep notification recipients up to date so that alerts reach the stakeholders responsible for managing costs.
Budget alerts: Configure actual-cost alerts to notify stakeholders when spending reaches defined thresholds. Consider using forecasted-cost alerts to provide early warning when projected spending is likely to exceed a budget threshold.
Cost anomaly alerts: Use anomaly alerts to identify unexpected changes in actual or forecasted costs that could indicate inefficiencies or abnormal spending patterns. When an anomaly is detected, investigate the underlying cause and take corrective action as needed.
Commitment-based discount utilization alerts: Monitor the utilization of commitment-based discounts, such as reservations or savings plans, to help maximize their value. Consider setting alerts when utilization falls below a desired threshold so that stakeholders can review and optimize committed resources. For strategies to optimize commitment-based discount utilization and purchasing, see Get the best rates.
Use IaC
Infrastructure as code (IaC) provides a structured and repeatable way to manage and provision infrastructure using code-based templates. Define infrastructure in code, store templates in version control to track changes, and use parameters to make templates reusable across environments.
Consider the following cost-focused IaC practices:
Estimate costs before deployment: Include cost estimation in IaC pipelines as a spending guardrail. Use a cost-estimation tool or pricing data to evaluate proposed resources. Parameterize expensive resource types with allowed values that exclude costly tiers.
Use ephemeral environments: Create development, testing, and staging environments on demand and destroy them when no longer needed. IaC makes ephemeral environments practical — spin up environments for testing and tear them down automatically to avoid paying for idle infrastructure.
Monitor deployed resources: Regularly monitor your resources and their costs to ensure compliance with your spending policies. Use monitoring and alerting tools to identify deviations from your defined guardrails and take corrective actions as needed. Check for unused resources and delete them, preferably with automation.
Azure facilitation
Using governance policies: Use Azure Policy to enforce allowed resource types, SKUs, locations, configurations, and tags. Azure Policy provides built-in policy definitions for common guardrails, including allowed resource types, allowed virtual machine size SKUs, allowed locations, and required tags.
Use Azure Policy to enforce supported storage-account SKUs and access-tier settings. Use Azure Storage lifecycle management to move eligible blobs to cool or archive tiers and apply data expiration rules.
Use Azure Advisor and the Cost Optimization workbook to identify idle and underutilized resources. Auto-shutdown schedules support off-hours shutdown for virtual machines in nonproduction environments. Azure Automation supports custom start and stop schedules.
Configuring access controls: Use Cost Management roles to separate access to cost data, budgets, alerts, and invoices. Use Azure RBAC to scope resource-provisioning permissions to workload boundaries. Use resource locks to protect approved production configurations from accidental deletion or modification.
Using release gates: Azure Pipelines approvals and checks support manual and automated deployment checkpoints for cost, security, and compliance criteria.
Using infrastructure as code: Azure Resource Manager templates, Bicep, and Terraform provide declarative infrastructure definitions. Azure provides templates for Azure resources. Use ARM template what-if operations or Terraform plan to identify proposed resource changes, and use a cost-estimation tool or pricing data to estimate the cost of those changes.
Configuring cost alerts: Use Microsoft Cost Management to create budgets with actual-cost and forecasted-cost conditions. Set thresholds that align with the workload's spending limits and escalation process. Budget action groups can trigger automated responses when thresholds are reached. Use anomaly detection to surface unexpected cost changes and reservation utilization alerts to identify underused commitments.
Organizational alignment
Coordinate with central governance teams, such as a cloud center of excellence (CCoE) team, to understand the organizational spending policies, approved exceptions, and shared guardrails that apply to your workload. Incorporate these requirements into workload design and deployment processes. For guidance about implementing policy-driven guardrails across an organization, see Adopt policy-driven guardrails.
Related links
Cost optimization checklist
Refer to the complete set of recommendations.