Light FinOps: controlling AWS costs without sacrificing security
Tags, budgets, rightsizing, and cost alerts without turning off logging or GuardDuty.
Puerto Rico SMBs migrate to AWS for agility then receive bills exceeding projected annual budget in one quarter. FinOps is not just shutting resources — it is visibility, accountability, and optimization without cutting security controls. The AWS Security Blog and FinOps Foundation agree: turning off CloudTrail or GuardDuty for cost is false economy CISA would discourage.
Start with mandatory tagging: Environment, Owner, CostCenter, Application. AWS Budgets with alerts at 80% and 100% monthly threshold; SNS to finance and IT email. Weekly Cost Explorer reviewing top services — idle EC2, unattached EBS, misconfigured dev NAT Gateway traffic are frequent culprits in Puerto Rico digital agency accounts.
Rightsizing: Compute Optimizer recommends oversized instances; apply in staging first. Reserved Instances or Savings Plans only after 6 months stable baseline — mature FinOps measures commitment risk. Spot for batch and non-critical CI accepts interruption.
Do not sacrifice security: GuardDuty, Config, and logging are cost of regulated business. Bruce Schneier notes outsourcing infra without outsourcing configuration responsibility creates gaps — same applies to FinOps without security review of cost changes.
Mainland teams serving PR clients often centralize billing at HQ — tags per Puerto Rico project/client help chargeback and architecture decisions. Two-hour monthly light FinOps avoids Friday "shut everything down" emergency when surprise bill arrives.
Operations and execution — connecting strategy with what the team ships every week.
