ricmmartins/azure-sre-agent-skills/04-finops-intelligence

FinOps Intelligence

Purpose

Unified cost intelligence skill that identifies savings opportunities, tracks cost trends, and generates chargeback/showback reports by team or project. Answers both "where can we save?" and "who spent what?"

When to use this skill

• User asks "why did our bill go up?"
• User asks for cost optimization or savings opportunities
• User asks "how much did team X spend this month?"
• User asks for chargeback, showback, or cost allocation report
• Monthly proactive cost review or FinOps cadence

Pre-check

Confirm with the user:

• Scope: Which subscriptions to scan (all or specific ones)
• Time range: For trend analysis (default: last 3 months)
• Allocation model (for chargeback): Which tag to use for cost splitting?
• cost-center tag (most common)
• owner or team tag
• application or project tag
• Resource group naming convention (e.g., rg-teamname-*)
• Exclusions: Dev/test subscriptions, sandbox resource groups

Analysis procedure

Step 1: Cost trend overview

Get the big picture using Azure Cost Management.

# Current month cost by service (last 30 days)
az costmanagement query --type ActualCost --timeframe MonthToDate \
  --scope "subscriptions/<sub-id>" \
  --dataset-aggregation '{"totalCost":{"name":"Cost","function":"Sum"}}' \
  --dataset-grouping name="ServiceName" type="Dimension" \
  -o table

# Previous month for comparison
az costmanagement query --type ActualCost --timeframe TheLastMonth \
  --scope "subscriptions/<sub-id>" \
  --dataset-aggregation '{"totalCost":{"name":"Cost","function":"Sum"}}' \
  --dataset-grouping name="ServiceName" type="Dimension" \
  -o table

If az costmanagement is unavailable, use the REST API:

az rest --method post \
  --url "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.CostManagement/query?api-version=2023-11-01" \
  --body '{"type":"ActualCost","timeframe":"MonthToDate","dataset":{"aggregation":{"totalCost":{"name":"Cost","function":"Sum"}},"grouping":[{"type":"Dimension","name":"ServiceName"}]}}'

Summarize:

• Total spend this month vs. last month (% change)
• Top 5 services by spend
• Top 5 resource groups by spend
• Any spending anomalies (day-over-day spikes > 20%)

Step 2: Orphaned resources (waste)

Find resources consuming cost with no active use.

Note on date handling: Use shell variable substitution for date comparisons:

• Linux/macOS: $(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%SZ)
• The SRE Agent sandbox runs Linux, so the above syntax is valid.

Step 3: Rightsizing opportunities

Identify over-provisioned resources.

1. VMs with low CPU (< 5% avg over 14 days):

Query Azure Monitor metrics for Percentage CPU across all VMs

1. VMs with low memory (< 10% avg):

Query Log Analytics for memory counters if available

1. Over-provisioned App Service plans:

Check CPU and memory % across the plan — if consistently < 20%, suggest downgrade

1. Over-provisioned databases:

Check DTU/vCore utilization — if < 20%, suggest lower tier

For each, calculate:

• Current SKU and monthly cost
• Recommended SKU and monthly cost
• Estimated monthly savings

Step 4: Reservation & savings plan opportunities

1. List VMs running 24/7 for > 30 days — candidates for Reserved Instances (up to 72% savings)
2. List databases running 24/7 — candidates for reserved capacity
3. Check if Azure Savings Plans could apply to compute spend

Step 5: Storage optimization

1. Check storage accounts for access tier usage:

``bash az storage account list --query "[].{name:name, accessTier:accessTier, kind:kind}" -o table ``

1. Identify blobs that haven't been accessed in 90+ days — candidates for Cool/Archive tier
2. Check for lifecycle management policies — suggest if missing
3. Check for redundancy over-provisioning (GRS when LRS would suffice for non-critical data)

Step 6: Cost allocation (chargeback/showback)

Group costs by the user's chosen allocation model.

By tag (preferred):

• Group all resources by the chosen tag value
• Aggregate costs per tag value
• Track untagged resources separately as "Unallocated"

By resource group (fallback):

• Parse resource group names for team/project identifiers
• Group and aggregate accordingly

Shared costs (identify and handle):

• Resources used by multiple teams (e.g., shared AKS cluster, shared networking)
• Flag these separately — suggest allocation keys (even split, usage-based, or headcount-based)

For each team/project:

• This period vs. previous period: $ change and % change
• Top cost driver (which service drove the change?)
• Flag anomalies (> 30% increase without known cause)

Step 7: Efficiency metrics

Calculate per-team efficiency indicators:

• Cost per resource: Total spend / number of resources
• Compute waste ratio: Cost of idle/underutilized resources / total compute cost
• Tag compliance: % of team's resources properly tagged

Accepted exceptions (optional)

If the user provides a list of accepted exceptions, do not flag those items. Instead, note them in the report as Accepted Exception with the reason provided.

Example format the user may provide:

When exceptions are provided:

• Skip the flagged checks in scoring
• List them in a separate "Accepted Exceptions" section at the end of the report
• Recalculate the overall score excluding excepted checks

Expected output

Report header (mandatory — use this exact format)

FinOps Cost Optimization & Chargeback Report

Savings breakdown table

Cost allocation table

Quick wins (implement today)

Top 3 actions that save the most with the least effort.

Requires planning

Actions that need architecture review or stakeholder approval.

Unallocated cost remediation

List untagged resources with suggested owner and tagging command:

az resource tag --ids <resource-id> --tags team=<team> cost-center=<cc>

Remediation guidance

For each cost finding, include in the output:

1. The specific az CLI command to remediate (suggest only — do not execute)
2. Use GetAzCliHelp to validate the command syntax before suggesting
3. The official Microsoft Learn documentation link

References

• Cost Management: https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/overview-cost-management
• Azure Advisor Cost: https://learn.microsoft.com/en-us/azure/advisor/advisor-cost-recommendations
• Reserved Instances: https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/save-compute-costs-reservations
• Orphaned Resources: https://learn.microsoft.com/en-us/azure/advisor/advisor-reference-cost-recommendations

Sample output

The following is a redacted example of what the report looks like when run against a subscription.

FinOps Cost Optimization & Chargeback Report

Savings breakdown table

Cost allocation table

Remediation guidance (sample)

# Delete unattached managed disks
az disk delete --name disk-old-backup-01 --resource-group rg-app-prod --yes
 
# Resize over-provisioned VM
az vm resize --name vm-batch-01 --resource-group rg-batch-prod --size Standard_B2ms
 
# Tag unallocated resources
az resource tag --ids /subscriptions/.../resourceGroups/rg-shared/providers/Microsoft.Storage/storageAccounts/stcontososhared --tags team=platform cost-center=CC-1234