A FinOps lead opens AWS Cost Explorer to answer the question the CFO asked yesterday: where is our cloud spend going. The first view is a stacked bar chart of monthly cost by service. EC2 is the biggest stack. Click it: now the view is broken down by usage type. NAT gateway traffic is a surprising chunk. Click again: now broken down by account. Three accounts share the NAT gateway cost. Click again: which resources in each account. Forty minutes in, the FinOps lead has the answer for one corner of the spend, and the connection back to the original $480k/month total is gone in a stack of breadcrumbs.
The nested-table cost report is the universal failure mode of cloud billing UIs. AWS Cost Explorer, GCP Billing, and Azure Cost Management each have their own version. Each presents spend as a number that the operator can drill into, and each loses the visual connection between the top number and the resource at the leaf. The question “where does our cloud spend flow” has a textbook visualisation: a Sankey diagram. Until ZopNight, no cloud cost product shipped one as a built-in view.
This post covers what Cost Flow renders, why the visual encoding does work the nested table cannot, how untagged spend becomes visually impossible to ignore, how drill-down preserves the diagram’s shape at every zoom level, and how the long tail of small resources gets collapsed so the operator sees the actual cost drivers.
Why the nested-table cost report hides the answer
The nested-table view is structurally limited. It presents one breakdown at a time, and the operator has to navigate the hierarchy by drilling. The connection between layers is implicit: the operator must remember that “$120k of EC2” became “$80k of NAT gateway traffic” four clicks ago.
| Question | Nested table | Cost Flow Sankey |
|---|---|---|
| What share of spend is each team? | Drill into account, then tag breakdown, infer | Visible as band thicknesses |
| What service drives team-payments’ cost? | Filter to team-payments, drill by service | One band’s continuation across layers |
| Is untagged spend a problem? | A row near the bottom of the table | A fat band you cannot avoid |
| Where does this $30k chunk go? | Three more clicks to find out | Trace the band visually |
The structural problem is not that Cost Explorer is slow. It is that the question “where does the spend flow” is a connectivity question, and the table representation has no encoding for connectivity. Each row is one node; the relationships between nodes are implicit in the navigation. A Sankey encodes the connectivity directly: the bands are the edges, their thickness is the weight, and the shape of the flow is visible at a glance.
The other structural problem is comparison-of-magnitudes. A nested table treats $200,000 and $2,000 as equally important: both occupy one row of the same height. A Sankey makes the $200k band a hundred times thicker than the $2k band. The visual encoding leverages spatial reasoning the operator already has, instead of requiring the operator to mentally weight each row by its dollar value.
What Cost Flow does
Cost Flow renders cloud spend as a Sankey diagram. Each column of the diagram is a layer of breakdown. Bands flow from layer to layer, with the thickness of each band proportional to the dollars flowing through that path. The total at the top is the same total at the bottom; the diagram redistributes the same money across layers.
The default layers are: Total → Cloud → Account → Team → Service → Resource. Each layer is a column. A given dollar in a leaf resource is traceable backwards through five layers: the operator can follow the band from cart-svc-rds back through RDS → team-payments → prod-account → AWS → Total and see the chain of attribution.
The diagram covers a single time window (default: the trailing 30 days). The window is selectable: trailing 7 days, trailing 90 days, the most recent calendar month. The numbers redraw; the shape stays consistent.
Why the visual encoding does the work the table can’t
The Sankey’s strength is in two specific tasks the table is bad at: comparing magnitudes across layers, and tracing flow end-to-end.
Comparing magnitudes is the question “is team-payments larger than team-search, by how much.” In the table it is two rows of numbers the operator has to mentally subtract. In the Sankey it is two bands whose thicknesses are immediately comparable. The eye does the comparison; the operator does not.
Tracing flow is the question “where does this $30k chunk go.” In the table it is a series of drill-downs. In the Sankey it is a band the operator’s eye follows from one column to the next. The terminal node tells the operator where the spend ends up; the path tells the operator how it got there.
| Question | Why the Sankey wins |
|---|---|
| Is team-payments larger than team-search? | Bands’ thicknesses are directly comparable |
| Where does this $30k chunk end up? | The eye follows the band end-to-end |
| Are there 3 cost drivers or 30? | Number of fat bands is countable at a glance |
| Is untagged spend a problem? | A fat untagged band is impossible to skip |
Untagged spend made impossible to ignore
ZopNight’s cost model uses the 4-field chargeback schema (owner, cost-centre, environment, customer). When a resource is correctly tagged, it shows up under the right team and environment in the Sankey. When it is not, it falls into an Untagged band.
| Field missing | Where the spend lands in the Sankey |
|---|---|
owner | Untagged → owner band, falls through to resource |
cost-centre | Splits across owner; cost-centre column shows Unknown |
environment | Splits across team; environment column shows Unknown |
customer | Only relevant for SaaS unit economics; shows Unknown in customer-keyed view |
The visual encoding creates the incentive that the nested table never could. A 14% Untagged band is visually impossible to ignore in a meeting. The FinOps lead pastes the screenshot into Slack, the platform team sees a fat unlabelled band, and tagging becomes the agenda for the next sprint. The nested table’s “untagged: $68,400” line at row 47 does not produce the same response.
This is the second-order benefit. Cost Flow is not just a better way to look at tagged spend. It is a mechanism to surface untagged spend in a way that creates pressure to fix it.
Drill-down: same shape at every zoom level
Clicking a band in the Sankey restricts the entire diagram to that band’s contents. Click the team-payments band and the diagram redraws as just team-payments’ flow: which environments, which services, which resources. The shape is the same; the scope is narrower.
The cognitive map the operator built at the org-wide view (bands as teams, thickness as dollars, flow as attribution) survives the zoom. There is no new chart type to learn at the team level. The team lead who looks at their team-restricted Sankey reads it the same way the CFO reads the org-wide one.
This is the architectural payoff. Switching chart types at each level of zoom (which Cost Explorer does: bar at the top, table at the next level, pivot at the level after) breaks the operator’s mental model every time. Keeping the same encoding at every zoom level preserves the model and reduces what each level costs to read.
Top 5-10 resources per team, long tail collapsed
The leaf layer of the Sankey is resources. A team can have hundreds. Rendering them all produces a noisy diagram where the top 5 cost drivers are visible but the cumulative effect of 200 tiny bands at the bottom makes the chart hard to scan.
Cost Flow’s heuristic: show the top 5 to 10 resources per parent band, collapse the rest into an Other band. The collapsed band is itself clickable: the operator who wants the full list can expand it. The default is the readable view; the long tail is one click away when needed.
This matters because the cognitive cost of the long tail is real. A team’s biggest 10 resources usually account for 80-95% of the team’s spend; the remaining 200 small resources account for the leftover 5-20%. The 200 small resources are not where the optimisation opportunities are. They are noise, and Cost Flow defaults to suppressing them.
How to use Cost Flow day to day
The workflow is short.
| Step | Action | Where |
|---|---|---|
| 1 | Open Cost Flow | Sidebar → Cost Flow |
| 2 | Pick a time window | Top-right selector |
| 3 | Read the org-wide flow | Default view |
| 4 | Screenshot for the board / Slack | OS screenshot |
| 5 | Drill into a team band for the team meeting | Click the band |
| 6 | Check the Untagged band weekly | Top of diagram |
For the weekly FinOps meeting the workflow is: paste the screenshot, talk for 5 minutes about which bands have grown, drill into the largest grower for the next 5 minutes, agree on one action item. The 40-minute “walk through the cost report” meeting that used to consume Friday afternoons becomes a 10-minute look at the diagram and a clearer decision.
For the board update the screenshot is the artefact. A CFO who looks at a Sankey for 30 seconds sees the same thing the FinOps lead saw in their first 5 minutes of analysis: which teams are driving the cost, which clouds, which services. The chart compresses the analysis into a visual the executive audience can read without training.
What ZopNight does not yet ship: a time-axis Sankey showing how the flow has changed over months, a forecast Sankey projecting the flow forward, a per-customer Sankey keyed on the customer-id tag for SaaS unit economics. Each is a future direction; the base diagram of “where the dollars flow right now” is the current deliverable.
The bill is a number. The flow is the story. Watch the flow. Pin the bands you care about. Watch the Untagged band shrink as tagging improves. Forward the diagram to the CFO. That is the work the work is for.
