finops-review

FinOps Review

Ortak Doktrin

agents/shared/severity-rubric.md ve agents/shared/escalation-matrix.md default-load sayılır (agents/coordination.md §11). Bu skill'in çıktısı Critical / High / Medium / Low + kanıt formatında olmak zorunda — spekülatif Critical yasak. Sahiplik dışı bulgu ilgili agent'a delege; karar yetkisi eşiği aşılırsa kullanıcı onayı zorunlu.

Felsefe

• Maliyet = mühendislik kararı. "Finance bakar" anti-pattern; mühendis her resource'un cost etkisini bilir.
• Görünürlük → sahiplenme → optimizasyon sırası.
• Trade-off transparent: hız vs cost, perf vs verim — yazılı karar.
• Continuous: tek seferlik review değil; anomaly alert + monthly retro.

Ne Zaman Kullanılır

• Quarterly cost review
• Cloud bill jump (anomaly tetiklendi)
• Yeni servis prod gate (cost projection)
• Architecture review (cost trade-off değerlendir)
• FinOps olgunluk seviyesi yükseltme (Crawl → Walk → Run)
• Reserved Instance / Savings Plan refresh (1y dolmadan)
• Cost optimization sprint
• M&A entegrasyon (yeni hesap takip)

Workflow

1) Mevcut durum tespit

Veri kaynağı	İçerik
AWS Cost Explorer / GCP BigQuery billing / Azure Cost Mgmt	aylık + 90 gün trend
Cost & Usage Report (CUR)	line-item detay (resource bazlı)
Trusted Advisor / Compute Optimizer / Recommender API	otomatik right-sizing önerisi
Tag report	untagged % + tag coverage
Reserved/Savings Plan utilization	mevcut commit'ten yararlanma
Forecast	sonraki ay tahmini

Snapshot:

Last 30 days: $48,200
- EC2 + EBS: $19,400 (40%)
- RDS: $11,500 (24%)
- S3: $4,800 (10%)
- Egress: $5,200 (11%)
- ALB + NAT GW: $3,100 (6%)
- Other: $4,200 (9%)

Forecast next 30: $52,000 (+8%)
Untagged: 12%
RI/SP coverage: 28% (baseline 60%+ hedef)
RI utilization: 91% (good)

2) FinOps maturity assessment

Boyut	Crawl	Walk	Run	Mevcut
Görünürlük	Aylık PDF	Cost Explorer	Real-time + ML	Walk
Sahiplenme	Tartışmalı	Tag policy	Otomasyon	Crawl-Walk
Optimizasyon	Manuel	RI plan	Continuous	Crawl
Anomaly	"Fatura geldi"	Alert	Forecast	Crawl
Sahiplik	Finance	Eng + Finance	FinOps team	Eng + Finance

Hedef: 6 ayda Walk → Run.

3) Tag policy review

# AWS untagged resource
aws resourcegroupstaggingapi get-resources --tag-filters Key=Owner,Values= \
  --query 'ResourceTagMappingList[].ResourceARN' \
  | wc -l   # tagged
aws resourcegroupstaggingapi get-resources \
  --query 'ResourceTagMappingList[?!(Tags[?Key==`Owner`])].ResourceARN' \
  | wc -l   # untagged

Hedef:

• Zorunlu tag: Environment, Service, Owner, CostCenter, ManagedBy.
• Untagged < 5%.
• Tag enforcement: SCP / Org Policy / Azure Policy + Terraform common_tags.

4) Right-sizing

Compute:

• CPU/memory utilization 7d ortalama < %30 → downsize.
• AWS Compute Optimizer / GCP Recommender otomatik öneri (free).
• Burst workload → t/e2 family.

RDS:

• CPU < %30 sustained + connection < %50 → instance class küçült.
• IOPS < provisioned %50 → gp3 (3000 IOPS baseline) yeter.
• Read replica read-heavy.
• PgBouncer önünde — instance class küçültme imkanı.

Storage:

• S3 Intelligent-Tiering otomatik (en düşük çaba).
• EBS gp2 → gp3 ($0.10 → $0.08/GB-ay).
• EBS unattached → sil (snapshot al).

5) Reserved / Savings Plan

# AWS RI utilization (last 30d)
aws ce get-reservation-utilization \
  --time-period Start=2026-04-10,End=2026-05-10

Karar:

• Baseline %80'i Savings Plan / RI. Üzeri esneklik için on-demand.
• 1y commit stable workload ✓; 3y commit sadece kesin stable (örn. core platform).
• Coverage gap: %28 → hedef %60-80.

6) Spot / Preemptible

Uygun workload (Crawl → Walk geçişi):

• CI/CD runner.
• Batch ETL.
• Stateless worker.
• ML training (checkpoint + restart).
• Dev/staging cluster (gece kapalı).

Uygun değil: prod web tier, primary DB, latency-sensitive.

7) Egress optimizasyon

# AWS data transfer cost (last 30d)
aws ce get-cost-and-usage \
  --filter file://egress-filter.json \
  --time-period Start=2026-04-10,End=2026-05-10 \
  --metrics BlendedCost \
  --granularity DAILY

Mitigation:

• VPC Endpoint (S3, DynamoDB, ECR): NAT GW bypass.
• Cross-region replication sadece DR (gerekli).
• CDN (CloudFront / Cloud CDN) — egress %30-60 düşer.
• Compression (gzip/zstd) on egress.
• Private Link multi-account.

8) Idle resource detection

Resource	Detection	Aksiyon
Unattached EBS	aws ec2 describe-volumes --filter Name=status,Values=available	snapshot + sil
Unused EIP	aws ec2 describe-addresses --filter Name=association.allocation-id,Values=null	release
Idle ALB (0 traffic 7d)	CloudWatch RequestCount 0	sil
Unused RI / SP	utilization < %50	exchange / sat
Old snapshot (> 90 gün)	tag age	lifecycle policy
Stopped EC2 (> 30 gün)	terminate veya sil	terminate
Untagged dev resource	resourcegroupstaggingapi	sahip bul, tag veya sil

Auto-suspend dev/staging:

• RDS scheduler: gece 19:00-07:00 + hafta sonu kapalı (saving %50+).
• EC2 scheduler veya aws-nuke Friday cleanup.

9) Container / image retention

# AWS ECR untagged image lifecycle
aws ecr put-lifecycle-policy --repository-name api-svc \
  --lifecycle-policy-text '{"rules":[
    {"rulePriority":1,"description":"untagged > 7d","selection":
      {"tagStatus":"untagged","countType":"sinceImagePushed","countUnit":"days","countNumber":7},
     "action":{"type":"expire"}},
    {"rulePriority":2,"description":"PR < 30d","selection":
      {"tagStatus":"tagged","tagPrefixList":["pr-"],"countType":"sinceImagePushed","countUnit":"days","countNumber":30},
     "action":{"type":"expire"}}
  ]}'

10) Cost anomaly + budget alert

# AWS Budget per-service
aws budgets create-budget \
  --account-id $ACCOUNT \
  --budget '{"BudgetName":"api-svc-monthly","BudgetLimit":{"Amount":"3000","Unit":"USD"},
             "TimeUnit":"MONTHLY","BudgetType":"COST",
             "CostFilters":{"TagKeyValue":["user:Service$api-svc"]}}'

# Cost Anomaly Detection
aws ce create-anomaly-monitor --anomaly-monitor file://monitor.json

Slack/PagerDuty integration:

• %20+ daily jump → ticket.
• Forecast > budget %110 → alert.
• New service appeared → review.

11) Action plan

Quick win (≤ 30 gün):

• Untagged cleanup.
• Unattached EBS / Unused EIP.
• ECR lifecycle policy.
• Dev RDS scheduler.
• gp2 → gp3 EBS.

Medium (≤ 90 gün):

• RI/SP plan baseline %60.
• VPC Endpoint S3/DynamoDB.
• Spot CI runner.
• Cost anomaly alert.

Strategic (≤ 1 yıl):

• FinOps team / role.
• Continuous right-sizing automation (Spot.io / Densify).
• Multi-account organization (Cost allocation).
• Architecture refactor (egress reduction).

Checklist

• Mevcut spend snapshot (30d, 90d trend)
• Untagged < 5%; zorunlu tag policy enforced
• Right-sizing fırsat (compute, DB, storage)
• RI/SP coverage %60-80 baseline
• Spot uygun workload tespit
• Egress mitigation (VPC Endpoint, CDN, compression)
• Idle resource detection + cleanup automation
• Image registry lifecycle policy
• Cost anomaly + budget alert
• FinOps maturity Phase + 6 ay hedef
• Action plan: quick win + medium + strategic
• Trend: 90 gün rolling cost + forecast deviation
• Architecture trade-off (cost vs perf) yazılı

Antipattern

• Tagless resource prod'da.
• aws_instance console click (IaC dışı).
• Idle resource ignore "küçük" multiply.
• latest image tag prod (registry kontrolsüz).
• Cross-region replication ad-hoc.
• NAT GW her zone dev'de.
• Public IP her instance (SSM session manager + private subnet).
• Old snapshot retain forever.
• 3y commit stable olmayan workload.
• Cost dashboard yok — sahiplenme imkansız.
• "Performance > cost" ad-hoc — trade-off yazılı + onay.
• Reserved Instance/SP unused — exchange / sat / kullan.
• CI runner on-demand (spot uygun).
• Dev cluster 7/24 (scheduler + hafta sonu kapat).

Örnek Agent Davranışı

User: /cost-review
Agent (iac-engineer):
1. Cost Explorer son 30d: $48,200; trend +8%/ay.
2. Tag coverage: %88 (Untagged 12% — Critical).
3. Right-sizing:
   - 4 EC2 t3.large CPU avg %18 → t3.medium (-$200/ay).
   - RDS db.r5.xlarge CPU %22 → db.r5.large (-$340/ay).
4. RI/SP coverage %28 → baseline %60 plan = -$1100/ay.
5. Egress $5200 (11%):
   - 60% cross-region replication ad-hoc → ZRS yeter, region azalt.
   - VPC Endpoint S3 (40% NAT GW egress azalır).
6. Idle: 12 unattached EBS ($240), 3 unused EIP ($11), 2 idle ALB ($60).
7. Image registry: untagged 4.2 GB → lifecycle 7d.
8. Anomaly alert: yok → AWS Cost Anomaly Detection setup.
9. FinOps maturity: Crawl-Walk → Walk hedef (6 ay).
10. Output: 18 action item, $2400/ay tasarruf potansiyeli (= %5 toplam).

Çıktı Formatı

# Cost Review: <account / scope>

## Spend Snapshot
- 30d / 90d / forecast / trend

## FinOps Maturity
- Phase + hedef

## Critical / High / Medium / Low

## Right-Sizing
- compute / DB / storage

## RI / SP Coverage
- mevcut % / hedef / saving potansiyel

## Egress
- breakdown + mitigation

## Idle Resources
- liste + saving potansiyel

## Anomaly + Budget
- alert kurulumu

## Action Plan
| P | Aksiyon | Saving | Sahip | Bitiş |
| Quick (30d) | ... |
| Medium (90d) | ... |
| Strategic (1y) | ... |

## Toplam Saving Potansiyeli
- $X/ay (= %Y toplam)