Managing Multiple Cloud Accounts
Principal Investigators (PIs) often manage multiple cloud accountsControls-based tools prevent cloud accounts from exceeding budget limits through proactive safeguards. The FinOps toolkit uses AWS control tools to implement these limits using accurate, NASA-specific cost information.
Setting Up Budget Limits
Limits can be established using:
- Allocated budgets: For accounts or specific
user:costtags with formal budget allocations. - Artificial control budgets: For cost management without formal allocations (e.g., limiting consumption for a specific development period).
Configuring Alerts and Warnings
provides unified visibility, allowing PIs to view all accounts collectively on one screen or drill down into each individual account's metrics.
If you manage multiple accounts, you can transfer obligated funds between them, provided they are on the same cloud provider (e.g., moving funds from one AWS account to another AWS account). Transferring funds between different commercial clouds Alerts can be configured based on specific services (e.g., EC2, S3), individual cost tags, or a combination of both.from AWS to Azure) is possible, but requires manual support from ARC.
Cross‑Account Independence: It is important to note that separate cloud accounts operate independently and do not share costs. If you transfer funds to a receiving account, the usage in that receiving account will never affect the transferring account’s remaining balance.
Allocating Funds to Subprojects
Within a single Linked Account, PIs can carve out specific budgets for sub-teams using user:Project tags.
When teams share common resources, PIs can choose how those shared costs are distributed among the subprojects:
- Fixed percentage: You define exact splits Warning Thresholds: PIs can set up to 10 warning thresholds per alert
- (e.g., email notifications at 50%, 75%, 90%, and 100% of the budget).
- Note: The toolkit currently supports email notifications, with alternative messaging methods planned for the future.
Anomaly Detection
Beyond threshold alerts, the toolkit includes anomaly detection to identify spending patterns that fall outside historical expectations. This helps catch:
- Unexpected spikes in usage
- Services accidentally left running
- Configuration changes that dramatically increase costs
Access Controls and Resource Restrictions
When budget limits are exceeded, preventive controls can restrict or block resource access. Most restrictions are automated, but in cases where automation isn't possible, the Science Cloud operations team receives notifications to manually institute blocks.
What Can Be Controlled:
- Project-tagged resources: Prevent future use of resources tagged to specific projects.
- User access: Deny access to resources for specific tagged users.
- Shared resources: Make shared resources inaccessible.
...
- Project A pays 60%, Project B pays 40%).
- Equal distribution: Costs are split evenly across all involved projects.
- Proportional allocation: Costs are divided dynamically based on each project's share of the total tagged costs.
Allocation Limits & Avoiding Tag Overlap
When setting up subproject budgets, the toolkit actively safeguards against accounting errors:
- Limits: If you attempt to allocate more than your total obligated funds, a warning will appear. The system automatically reduces your available allocation amount based on funds already assigned to other tags or any negative balances.
- Overlapping Tags: You must avoid creating overlapping tags that result in double-deductions. For example, if a specific user works exclusively on a specific project, you should not allocate separate funds to both their
user:Usertag and theiruser:Projecttag. - To maintain clean accounting, PIs should avoid creating new tags after subproject allocations have already been set for the cycle.