Controls-based tools prevent cloud accounts from exceeding budget limits through proactive safeguards. The FinOps toolkit uses AWS control tools to implement these limits using accurate, NASA-specific cost information.

Setting Up Budget Limits

Limits can be established using:

• Allocated budgets: For accounts or specific user:cost tags with formal budget allocations.
• Artificial control budgets: For cost management without formal allocations (e.g., limiting consumption for a specific development period).

Configuring Alerts and Warnings

Alerts can be configured based on specific services (e.g., EC2, S3), individual cost tags, or a combination of both.

• Warning Thresholds: PIs can set up to 10 warning thresholds per alert (e.g., email notifications at 50%, 75%, 90%, and 100% of the budget).
• Note: The toolkit currently supports email notifications, with alternative messaging methods planned for the future.

Anomaly Detection

Beyond threshold alerts, the toolkit includes anomaly detection to identify spending patterns that fall outside historical expectations. This helps catch:

• Unexpected spikes in usage
• Services accidentally left running
• Configuration changes that dramatically increase costs

Access Controls and Resource Restrictions

When budget limits are exceeded, preventive controls can restrict or block resource access. Most restrictions are automated, but in cases where automation isn't possible, the Science Cloud operations team receives notifications to manually institute blocks.

What Can Be Controlled:

• Project-tagged resources: Prevent future use of resources tagged to specific projects.
• User access: Deny access to resources for specific tagged users.
• Shared resources: Make shared resources inaccessible.

Important: Access controls should be configured carefully to avoid disrupting critical work. PIs are encouraged to work with the Science Cloud FinOps team to design appropriate control strategies.