ZopNight for Cloud Architects: Cost-Aware Design Decisions
Cost, dependency and scaling behaviour are design properties. The architect's job is to see them before a change, not after.
A cloud architect is accountable for how the estate fits together: which services talk to which, where workloads are placed, and what a change will break. Cost is a design property in that picture, not a report that arrives a month later. The FinOps Framework names this work as a capability of its own, Architecting and Workload Placement, and puts it in the hands of its Engineering persona, described as responsible for “designing, building, managing and optimizing technology infrastructure to achieve cost-effectiveness, performance, reliability, security and compliance.”
What you are accountable for, and the capability that maps to it
Knowing what connects to what. ZopNight’s topology graph lays resources out by provider, account, region and network, linking those that share security groups on AWS, networks on GCP or VNets on Azure. It is a map of the estate as discovered, not as documented.
Knowing the impact before a change. Blast radius analysis runs before a recommendation is applied or a schedule is changed. It builds a one-hop adjacency graph from resource metadata (database access through shared security groups, load balancer targets, volume attachments, Lambda and Cloud Run triggers, parent-child membership, cross-region links) and classifies each neighbour as affected, warning or safe. A resource type not explicitly proven safe defaults to warning. Its limits are stated: one hop only, and connectivity inferred from metadata rather than flow logs. See blast radius explained.
Stopping expensive designs at review time. IaC governance evaluates Terraform and OpenTofu plans in the pull request. Priced-plan guardrails such as a maximum monthly cost, a total budget cap or a maximum cost delta put the monthly dollar figure into the PR. You can write custom policies in Rego, and ZopNight acts only as the decision point: your GitHub required check enforces it, and ZopNight never runs apply. See infrastructure as code.
Changing scaling without losing what exists. When an autoscaler policy is created on a target that already has cloud-side scaling policies, you choose to adopt them as they are or replace them. Replace captures the full prior configuration so removing the ZopNight policy restores it, and it refuses to touch shapes it cannot reconstruct, such as predictive scaling policies.
Placing workloads on the right purchase model. Commitment recommendations are priced from the resource’s real on-demand versus committed rate and its measured uptime, with a break-even gate; where uptime is unknown, savings are reported as unknown rather than assumed.
Where to start
Connect accounts read-only for discovery, topology and recommendations; nothing can be stopped or changed until an account is switched to read + write. Then open blast radius from any high-value recommendation and compare what it shows against your own diagrams. See the walkthrough in viewing blast radius before remediation.
Questions we get a lot.
If yours isn't here, email us and we'll answer directly.
Does blast radius read VPC flow logs?
No. It infers connections from resource metadata such as shared security groups, load balancer targets and volume attachments, and it looks one hop out from the target.
Can IaC governance block a merge?
ZopNight returns a decision on the plan. Blocking is done by your GitHub required check, so enforcement stays in your pipeline.