FinOps Policies

This policy recommends enabling automatic key rotation on AWS Key Management Service (AWS KMS) customer managed keys. Rotation generates new cryptographic material for a key on a recurring schedule, limiting how long any single piece of key material stays in use and reducing the impact if it were ever exposed. Use this policy on any symmetric encryption customer managed key that protects long-lived data, especially keys tied to compliance frameworks that require periodic key rotation.

Enabling CloudWatch log exports on an Amazon RDS cluster means setting the enabled_cloudwatch_logs_exports attribute on the aws_rds_cluster Terraform resource so the cluster streams its audit, error, general, or slow query logs into Amazon CloudWatch Logs automatically. Without this attribute set, cluster logs stay on local instance storage, which slows down incident diagnosis and leaves audit and compliance requirements unmet. This policy applies to any Aurora MySQL or Aurora PostgreSQL cluster where a team needs centralized, queryable log history for monitoring, auditing, or incident response.

This FinOps policy requires every Amazon S3 access point to be created with all four S3 Block Public Access settings enabled. Amazon S3 does not support changing an access point's block public access configuration after it has been created, so an access point created with any setting disabled stays exposed for its entire lifecycle unless it is deleted and recreated. Apply this policy to every aws_s3_access_point resource in Terraform, independent of whether the underlying bucket is expected to hold sensitive data.

This FinOps policy flags Amazon Relational Database Service (Amazon RDS) instances still running on General Purpose SSD (gp2) storage and recommends migrating to General Purpose SSD (gp3), the newer general-purpose volume type. gp3 storage costs up to 20% less per GiB than gp2, and it decouples IOPS and throughput from allocated storage size, so teams stop paying for extra capacity they only added to reach a performance target. This applies to any RDS instance on MySQL, MariaDB, PostgreSQL, Oracle, Db2, or SQL Server that is still configured with storage_type = "gp2".

Storage autogrow for Azure Database for PostgreSQL Flexible Server automatically increases a server's provisioned storage when free space runs low, instead of requiring a manually sized disk from day one. Enabling it on non-production servers lets teams start with a smaller disk and avoid paying for storage capacity that may never be used. This policy applies to non-production PostgreSQL Flexible Server instances, such as development, staging, and QA environments, where usage patterns are still uncertain.

This FinOps policy recommends disabling public network access on an Azure Storage Account, restricting access to private endpoints and approved virtual networks only. By default, an Azure Storage Account accepts connections from any public IP address, which widens the attack surface for data exfiltration and unauthorized use. This applies to any Storage Account holding data that has no legitimate need to be reachable directly from the internet.

Disabling associate_public_ip_address in an AWS EC2 launch template stops new instances from receiving a public IPv4 address automatically at launch. Every public IPv4 address attached to a running instance carries an hourly charge and adds a direct path from the internet to that instance, so removing the automatic assignment reduces both cost and attack surface. This applies to any launch template backing an Auto Scaling group or standalone instance that doesn't need to accept unsolicited inbound traffic from the public internet.

This policy recommends upgrading Amazon EMR cluster storage from the older gp2 EBS volume type to gp3, which costs less per GB and includes a higher baseline performance tier at no extra charge. gp2 ties IOPS to volume size, so smaller EMR instance group volumes can be significantly under-provisioned on performance while still paying a higher per-GB rate. Teams provisioning or resizing EMR master, core, or task instance group storage should default to gp3 unless a specific workload has a documented reason to stay on gp2.

This FinOps policy recommends setting a deliberately low automated backup retention count for Cloud SQL for PostgreSQL instances in non-production projects, rather than leaving the default in place or copying a production-sized value. Backup storage is billed per GB every month a backup is retained, so a nonproduction instance holding weeks of backup history accumulates ongoing storage charges long after most of that history has any practical recovery value. This policy applies to nonproduction Cloud SQL for PostgreSQL instances such as staging, development, and QA, where a short recovery window is normally sufficient.