FinOps Policies

This FinOps policy recommends switching DynamoDB tables in non-production environments from provisioned capacity mode to on-demand capacity mode. Provisioned capacity requires upfront read/write unit commitments that generate costs even when tables sit idle, making it a poor fit for development, staging, and testing workloads. Why This Policy Matters Non-production DynamoDB tables are rarely accessed at…

Running an outdated OpenSearch version on AWS triggers extended support charges that increase your monthly instance costs by a fixed percentage. This FinOps policy identifies OpenSearch domains running versions eligible for extended support and recommends upgrading to a current, fully supported version to eliminate that surcharge. Use this policy when auditing OpenSearch infrastructure costs in…

Amazon SQS queues should be encrypted at rest to protect message data from unauthorized access and meet compliance requirements. This FinOps policy ensures that encryption is enabled on all SQS queues, aligning with AWS Security Hub control SQS.1 and frameworks such as AWS Foundational Security Best Practices and NIST SP 800-53. This policy applies to…

This FinOps and security policy requires that Amazon ECS services are not directly reachable from the public internet. Publicly accessible ECS services expand the attack surface, increase the risk of unauthorized access, and commonly violate compliance frameworks such as CIS AWS Foundations Benchmark and PCI-DSS. This policy corresponds to AWS Security Hub control ECS.2. Why…

Storing sensitive information such as database passwords, API keys, and authentication tokens directly in ECS container environment variables creates significant security risks and compliance violations. This FinOps policy helps organizations identify and remediate insecure secret management practices in their ECS infrastructure while reducing potential security breaches. Why this policy matters Container environment variables in ECS…

Database Migration Service (DMS) replication instances that are publicly accessible create unnecessary security risks and potential compliance violations. This FinOps policy ensures DMS replication instances are configured with private access only, reducing attack surface while maintaining operational functionality. When DMS instances are publicly accessible, they can be reached from the internet, creating opportunities for unauthorized…

AWS ElastiCache Redis versions 4, 5, and 6 will transition to extended support pricing, resulting in significant cost increases. Upgrading to newer Redis versions before support deadlines helps avoid these additional charges while maintaining security and performance standards. Why This Policy Is Important ElastiCache Redis extended support pricing represents a substantial increase in operational costs….