Best Practice: Brownfield Cost Optimization

#!/bin/bash
# scripts/cost-baseline.sh – AWS Cost Baseline

echo "=== Cost Baseline Report ==="
echo ""

# Total costs for the last 3 months
echo "--- Total Costs (last 3 months) ---"
aws ce get-cost-and-usage \
  --time-period Start=$(date -d '3 months ago' +%Y-%m-01),End=$(date +%Y-%m-01) \
  --granularity MONTHLY \
  --metrics "BlendedCost" \
  --query 'ResultsByTime[].{Month:TimePeriod.Start, Cost:Total.BlendedCost.Amount}' \
  --output table

echo ""
echo "--- Top-10 Cost Drivers (Service) ---"
aws ce get-cost-and-usage \
  --time-period Start=$(date -d '1 month ago' +%Y-%m-01),End=$(date +%Y-%m-01) \
  --granularity MONTHLY \
  --metrics "BlendedCost" \
  --group-by Type=DIMENSION,Key=SERVICE \
  --query 'sort_by(ResultsByTime[0].Groups, &Keys[0])[-10:] | reverse(@)[].{Service:Keys[0], Cost:Metrics.BlendedCost.Amount}' \
  --output table

echo ""
echo "--- Untagged Costs ---"
aws ce get-cost-and-usage \
  --time-period Start=$(date -d '1 month ago' +%Y-%m-01),End=$(date +%Y-%m-01) \
  --granularity MONTHLY \
  --metrics "BlendedCost" \
  --filter '{"Not":{"Tags":{"Key":"workload","Values":[""],"MatchOptions":["ABSENT"]}}}' \
  --query 'ResultsByTime[0].Total.BlendedCost.Amount' \
  --output text

#!/bin/bash
# scripts/waste-discovery.sh – Identify common waste sources

echo "=== S3 Buckets Without Lifecycle Policy ==="
aws s3api list-buckets --query "Buckets[].Name" --output text | \
  tr '\t' '\n' | while read BUCKET; do
    LIFECYCLE=$(aws s3api get-bucket-lifecycle-configuration --bucket "$BUCKET" 2>/dev/null)
    if [ -z "$LIFECYCLE" ]; then
      SIZE=$(aws s3api list-objects-v2 --bucket "$BUCKET" \
        --query "sum(Contents[].Size)" --output text 2>/dev/null || echo "0")
      echo "NO LIFECYCLE: $BUCKET (${SIZE} bytes)"
    fi
  done

echo ""
echo "=== CloudWatch Log Groups Without Retention ==="
aws logs describe-log-groups \
  --query 'logGroups[?retentionInDays==`null`].{Name:logGroupName, StoredBytes:storedBytes}' \
  --output table

echo ""
echo "=== Unused Elastic IPs ==="
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==`null`].{AllocationId:AllocationId, PublicIp:PublicIp}' \
  --output table

echo ""
echo "=== Unused EBS Volumes ==="
aws ec2 describe-volumes \
  --filters Name=status,Values=available \
  --query 'Volumes[].{VolumeId:VolumeId, Size:Size, CreateTime:CreateTime}' \
  --output table

#!/bin/bash
# scripts/tagging-audit.sh – Check tagging compliance

MANDATORY_TAGS=("cost-center" "owner" "environment" "workload")
NON_COMPLIANT=0
TOTAL=0

# Check EC2 instances
echo "=== EC2 Tagging Compliance ==="
aws ec2 describe-instances \
  --query 'Reservations[].Instances[]' \
  --output json | \
  jq -r '.[] | {id: .InstanceId, tags: ([.Tags[]? | {(.Key): .Value}] | add)} |
    select(.tags["cost-center"] == null or .tags["owner"] == null or
           .tags["environment"] == null or .tags["workload"] == null) |
    "NON-COMPLIANT: \(.id)"'

# Immediate action: budget alert for all accounts
resource "aws_budgets_budget" "monthly_total" {
  name         = "monthly-total-budget"
  budget_type  = "COST"
  limit_amount = var.monthly_budget_limit
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.finops_team_email]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.finops_team_email, var.engineering_manager_email]
  }
}

# docs/cost-debt-register.yml – Brownfield start
version: "1.0"
last_reviewed: "2025-03-01"
status: "initial-population"

note: >
  Initial population from Brownfield Discovery Phase (Jan–Mar 2025).
  All entries need owner confirmation by 2025-04-01.

entries:
  - id: CD-2025-INIT-001
    title: "DISCOVERY: S3 buckets without lifecycle (23 buckets, ~2 TB)"
    category: "infinite-retention"
    description: "Discovery phase identified 23 S3 buckets without lifecycle policy."
    detected: "2025-03-01"
    owner: "TBD - owner identification in progress"
    estimated_annual_impact_eur: 3600
    status: "monitoring"
    paydown_plan: "Lifecycle policies for all 23 buckets by Q2 2025"
    target_resolution: "2025-06-30"
    related_controls: [WAF-COST-040]

  - id: CD-2025-INIT-002
    title: "DISCOVERY: 12 CloudWatch Log Groups without retention"
    category: "infinite-retention"
    detected: "2025-03-01"
    owner: "infrastructure-team"
    estimated_annual_impact_eur: 800
    status: "paydown"
    paydown_plan: "Terraform config for all 12 log groups - Sprint 2025-03-2"
    target_resolution: "2025-04-01"
    related_controls: [WAF-COST-040, WAF-COST-070]

#!/bin/bash
# Identify resources without a clear owner
aws ec2 describe-instances \
  --query 'Reservations[].Instances[?!Tags[?Key==`owner`]].{
    InstanceId: InstanceId,
    LaunchTime: LaunchTime,
    InstanceType: InstanceType,
    Name: Tags[?Key==`Name`].Value|[0]
  }' \
  --output table