GuideAdvanced
Finops And Cost Guardrails
Puts a price and a budget on the Andes Cargo project the four prior AWS Cloud guides already built and secured: same case, same LocalStack at $0, same GitHub Actions pipeline. A clean `plan`, a secure pipeline, and a successful `apply` say nothing about whether a decision is financially sustainable — this guide teaches FinOps as a discipline (Inform, Optimize, Operate) and uses Infracost to produce a real dollar estimate of a `terraform plan` before it's applied, with no AWS account required. From there it builds a hand-rolled cost gate in the PR (two scans, a delta computed with `jq`, a threshold that stops the `apply`) as a third pipeline lane, independent from the existing security gate; cost-allocation tagging policies evaluated with `conftest` in their own directory; budgets and billing alarms taken as far as LocalStack lets you verify them, with the exact technical reason when it doesn't; and rightsizing measured with real Infracost numbers, not rules of thumb, to decide between `PAY_PER_REQUEST` and `PROVISIONED` for DynamoDB. It closes with a capstone that runs the cost gate and the security gate in parallel on the same pipeline, never merging them.
- 64
- lessons
- 8
- modules
- English · Spanish
- available in
- Yes
- certificate
- Free
- access
Outcomes
What you'll be able to do
- Apply the FinOps Foundation's three phases (Inform, Optimize, Operate) and model the real cost of Andes Cargo's three billable services (S3, Lambda, DynamoDB)
- Install Infracost and produce the first real dollar estimate of a `terraform plan`, with no AWS account or credentials
- Build an `infracost-usage.yml` with monthly volume assumptions to price usage-based resources (Lambda, DynamoDB on-demand, S3 per-request)
- Stand up a cost gate in the PR: two `infracost scan --json` runs, a delta computed with `jq`, and a threshold script that fails the job before `apply`
- Write cost-allocation tagging policies with `conftest`, in a directory (`cost-policy/`) that's always a sibling of the security one, never nested inside it
- Declare `aws_budgets_budget` and a CloudWatch alarm on `EstimatedCharges`, documenting exactly how far LocalStack lets you verify each
- Understand what `Cost Explorer` and cost anomaly detection answer, and build a DIY anomaly check from Infracost's history as a $0 substitute
- Decide with real numbers between `PAY_PER_REQUEST` and `PROVISIONED` for a DynamoDB table, price S3 lifecycle policies, and tune a Lambda function's memory and duration
- Wire the three cost jobs (`cost-estimate`, `cost-check`, `cost-tags`) into the existing `ci.yml`, running in parallel to the security jobs without depending on them
- Produce the cost gate's portfolio deliverables: `COST-PROFILE.md`, `cost-breakdown.json`, `infracost-usage.yml`, `cost-policy/`, and the budget and cost-visibility plans
Before you start
What you need to bring
It's for you if...
- Backend, DevOps, or Cloud engineers who already completed the AWS Core Services, Terraform and IaC, CI/CD and GitOps, and Cloud Security guides and want to add spend control to the pipeline they already built
- Teams with a green, secure pipeline that never measured whether an infrastructure change spikes the bill before it's applied
- Devs evaluating a paid FinOps tool who want to first build and understand the $0 version with Infracost and `conftest`
- Professionals preparing for roles where FinOps is in the job title, not just a bullet in the responsibilities
Requirements and materials
- AWS Core Services, Terraform and IaC, CI/CD and GitOps on AWS, and Cloud Security and Guardrails guides completed (or equivalent: the `andes-cargo-infra/` project, the `.github/workflows/` pipeline running under `act`, and the security gate with `conftest`/Trivy/`cosign` already working)
- LocalStack, Terraform, and `act` installed and working locally
- Free Infracost account (no card required) to run `infracost scan`
- Familiarity with HCL, GitHub Actions, and the command line
Content
The syllabus, module by module
Open any of them to see its lessons.
- 1. Introduction to the guide: from "secure" to "sustainable"
- 2. What FinOps is: Inform, Optimize, Operate
- 3. Green does not mean cheap
- 4. Hands-on: reading what Andes Cargo actually bills
- 5. How S3, Lambda, and on-demand DynamoDB are priced
- 6. The Free Tier and its 2026 trap, revisited
- 7. Hands-on: writing the cost profile document
- 8. Project: Andes Cargo's cost map
- 1. Introduction: from "how much will it cost" to "how much would it cost, measured"
- 2. What Infracost does and does not need
- 3. Hands-on: installing Infracost and a free account
- 4. Hands-on: your first scan
- 5. Hands-on: scanning Andes Cargo's `plan`
- 6. Usage-based resources and the usage file
- 7. Hands-on: a real dollar estimate for Andes Cargo
- 8. Project: Andes Cargo's cost breakdown report
- 1. Module introduction: the same engine, a different domain
- 2. What a cost-allocation tag is
- 3. Andes Cargo's tag taxonomy
- 4. Hands-on: the required tags policy
- 5. Hands-on: running `conftest` against the plan
- 6. Hands-on: tagging Andes Cargo's real resources
- 7. Hands-on: the `cost-tags` job in `ci.yml`
- 8. Project: Andes Cargo's cost tag policy
- 1. Module introduction: from "surviving" to "budgeting"
- 2. What AWS Budgets is
- 3. Hands-on: a budget, as far as LocalStack goes
- 4. Hands-on: a real billing alarm
- 5. Hands-on: the $0 alternative — a scheduled cost ceiling check
- 6. Savings Plans, Reserved Instances, and consolidated billing, named
- 7. Hands-on: writing the budget and alarms plan
- 8. Project: Andes Cargo's budget plan
- 1. Introduction: the question no pre-deploy estimate answers
- 2. What `Cost Explorer` answers
- 3. What cost anomaly detection is
- 4. Hands-on: `Cost Explorer`, as far as LocalStack goes
- 5. Hands-on: a DIY anomaly check with Infracost history
- 6. Reading a real `Cost Explorer` report
- 7. Hands-on: writing the cost visibility map
- 8. Project: Andes Cargo's cost visibility map
- 1. Introduction: from estimating to deciding
- 2. Compute Optimizer, named
- 3. Hands-on: `PAY_PER_REQUEST` vs. `PROVISIONED` for `Shipments`, with real numbers
- 4. Hands-on: S3 lifecycle policies, priced
- 5. Savings Plans, Reserved Instances, and Spot, named
- 6. Hands-on: tuning Lambda memory and duration
- 7. Hands-on: applying Andes Cargo's rightsizing decisions
- 8. Project: Andes Cargo's optimization report
- 1. Capstone introduction
- 2. Architecture review: two lanes, one pipeline
- 3. Hands-on: chaining the cost gate into `ci.yml`
- 4. End-to-end: a change that crosses both gates
- 5. End-to-end: a change the cost gate stops
- 6. What this guide left representative, final honesty
- 7. What Andes Cargo still needs
- 8. Final project: Andes Cargo's cost gate as a deliverable
Common questions
What people usually ask
No limit. It's a free guide: come in whenever you like, as often as you like.
No. Modules run from easier to harder, but you can jump to the one you need. Progress is saved per lesson.
Whatever is needed is listed under “What you need to bring”, above. If nothing is listed there, you can start from zero.
In the Club's WhatsApp group, and every two weeks there's a live with an instructor where questions get worked through.
Yes. It's issued automatically once you finish every lesson, with a verifiable code you can share on LinkedIn.
Start whenever you like
What students say
These reviews are from enrolled students who completed at least 50% of the course. We moderate reviews only on content grounds (spam, offensive language, personal data), never for being critical or negative.
No approved reviews yet.
Be the first to share your experience!