A name on every dollar

Every resource on a cloud bill has to belong to someone. Clouds give you two ways to say who. The hierarchy: accounts on AWS, subscriptions and resource groups on Azure, projects on Google Cloud. And tags (labels on Google Cloud): key-value pairs like team=search stuck on each resource.

The hierarchy is the stronger of the two, because a resource can’t exist outside an account, while a tag can be forgotten. Give each team its own accounts and most of the bill allocates itself. Tags then do the finer work: product, environment, cost centre, and everything in the accounts teams share.

What’s left after both is the pile. Rules at ingestion time can clear part of it, mapping names like search-* to a team. The honest measure is coverage by cost, not by count: ninety percent of resources tagged can still leave half the money unexplained, if the untagged ones are the big databases.

Switch the measure from “count” to “cost” with tags only. Then add the account structure.

Tagging campaigns all follow the same curve. Someone sends a spreadsheet of untagged resources, coverage jumps, and six months later it has drifted back, because new resources keep arriving without tags. Coverage is a flow problem, not a cleanup problem.

The fixes that last move the tag to the moment a resource is born. A tag policy rejects deployments without the required tags (AWS tag policies and service control policies, Azure Policy, organisation policies on Google Cloud). Infrastructure as code sets default tags once per module. Inheritance copies a team’s tags from its account or resource group to everything inside.

None of this is a FinOps team’s job alone. It’s a platform decision: the paved road should make the tagged path the easy one, and the reports should point at the few teams still off it.

Run the monthly report alone, then add the deploy gate. Which one is still climbing after a year?

Some costs have no single owner: the shared Kubernetes platform, the enterprise support fee, the observability stack, the network that connects everything. No tag can fix that. You need a split rule, and every rule has a team that hates it.

An even split is simple and punishes the smallest team. Proportional to direct spend is what most support fees deserve, since the provider prices them as a share of spend anyway. A usage driver, like CPU requested or requests served, is the fairest for a platform, if you can measure the driver. And keeping it central hides the cost from the people who could reduce it.

The rule matters less than two habits: write it down, and apply it the same way every month. Teams accept almost any split they can predict. They fight every split that surprises them.

Try the even split, then look at the web team’s bar. Now switch to the usage driver.

A Kubernetes cluster is a shared cost with its own internal economy. The bill shows machines. The teams run pods on them. Tools like OpenCost and Kubecost close the gap by pricing each pod’s slice of the nodes it runs on.

Which slice is the question. A pod requests CPU and memory, which the scheduler reserves whether it’s used or not, and then uses some amount of it. Charging by usage rewards teams that over-request: they reserve the capacity and someone else pays for the idle part. Charging by requests, or by whichever is higher, makes the reservation itself the cost, and that’s what moves teams to rightsize.

Then there’s the capacity nobody requested: spare nodes, headroom, fragmentation. Spread it across teams and they’ll never see it. Leave it with the platform team and idle becomes a number someone owns, and usually shrinks. GPU clusters serving models raise the same question with higher stakes, which notebook 18 picks up.

Allocate by usage and look at the data team. Then switch to requests and keep idle with the platform.

Allocation produces a number per team. What happens next is a choice. Showback sends it to the team as information: here’s what you spent, here’s how it changed. Chargeback books it against the team’s budget, so the money really moves between cost centres.

Chargeback gets attention fast, because a budget line is harder to ignore than a dashboard. It also turns every allocation error into a dispute. A team charged for costs it can’t trace will spend its energy arguing, not optimising.

So the order matters. Showback first, while coverage climbs and the shared rules settle. Chargeback once allocation is high and stable enough that the unexplained part is smaller than anyone’s rounding error. Plenty of mature organisations never switch at all: a trusted showback, read every week, does most of the job.

Set allocation to 70% and switch to chargeback. Then raise it to 95%.