Per-resource, per-group, per-account budgets

Outcome

By the end of this lesson, you will be able to pick the right budget scope for an accountability boundary, design a composite budget hierarchy, and explain why multiple budgets on the same data are independent (and useful).


Prerequisites	M4.6.L1: Budget vs forecast vs alert
Time	9 minutes

1. Concept

A ZopNight budget sits on exactly one target. Picking the right target depends on the accountability boundary: who is being asked to manage to the budget?

SCOPE             SPEND TRACKED                  ACCOUNTABILITY
──────────────────────────────────────────────────────────────────
Per-resource      One specific resource          The owner of that
                                                  resource (often a
                                                  DBA, SRE or service
                                                  owner)

Per-group         A resource group (multiple      The group's owner
                  resources, coordinated         (often a team's tech
                  ownership)                      lead)

Per-account       Everything in one connected     Whoever owns the
                  cloud account                   account as a whole

Per-AI-provider   Spend through one connected     The platform or AI
                  AI provider                     lead

Each target can carry one budget; a second budget on the same target is rejected. There is no team, tag or filter scope. The same dollar of spend can still be watched by several budgets at once (its resource, a group it belongs to, its account), each with a different audience.

Per-resource detail

Use per-resource budgets for critical individual resources where the team wants pinpoint accountability.

EXAMPLE: Production payments database

  Resource:  db-prod-payments
  Reason:    business-critical; cost reflects sizing decisions
  Budget:    $1,200/month
  Alerts:
    warning at 75%  → #db-team-alerts
    exceeded (100%) → #db-team-alerts + #finops-alerts

  WHO CARES: the DBA who chose the instance size, the DB lead who
  signed off, the FinOps partner who reviews unit economics for
  the database.

  WHAT IT CATCHES:
    - Storage growth beyond plan
    - Unplanned scaling-up
    - I/O pattern changes that increase cost

Per-resource budgets are most valuable for resources that meet two criteria: high absolute cost AND well-defined ownership. A $50/month resource doesn’t need its own budget; a $50K/month database does.

Per-group detail

Use per-group budgets when multiple resources share coordinated ownership and lifecycle. For most teams this is the workhorse scope: a team’s environments are usually resource groups.

EXAMPLE: EU dev environment

  Group:      dev-platform-eu
  Includes:   47 resources (compute, RDS, ELB, S3, ...)
  Budget:     $4,800/month
  Alerts:
    warning at 85%  → #dev-platform-eu (team awareness)
    exceeded (100%) → #dev-platform-eu + #finops-alerts

  WHO CARES: the team that owns the EU dev environment as a unit.

  WHAT IT CATCHES:
    - Aggregate growth across the group
    - Forgotten resources that someone provisioned
    - Schedule failures causing weekend spend

Groups are a clean accountability unit when the group itself has a coherent owner. They are less useful when group membership is fluid (resources joining and leaving frequently) because the budget tracks the current membership.

Per-account detail

Use per-account budgets when one cloud account belongs to one owner: a team’s own AWS account, a GCP project for one product, a sandbox subscription.

EXAMPLE: ML training account

  Cloud account:  ml-training-prod
  Budget:         $22,000/month
  Alerts:
    warning at 80%  → #ml-infra
    exceeded (100%) → #ml-infra + #finops-alerts

  WHO CARES: the ML infra lead, the FinOps partner.

  WHAT IT CATCHES:
    - Aggregate account spend trending wrong
    - New services switched on in the account
    - Composite effects (each resource looks fine; the sum is not)

Per-account is the broadest scope. It needs no grouping work, which makes it a good first budget for accounts with a single owner. It is a poor fit for shared accounts, where it alerts everyone about everyone’s spend.

The team view: rolling up existing budgets

There is no per-team budget. A team’s detail page (Teams, then the team) shows a budget summary instead: the total of the budgets that already sit on the team’s assigned resources and resource groups.

TEAM PLATFORM: budget summary on the team detail page

  Group budgets on the team's groups:
    prod-platform:     $14,000/month
    staging-platform:   $3,200/month
    dev-platform-eu:    $4,800/month

  Resource budgets on the team's directly assigned resources:
    monitoring-cluster:   $800/month

  A resource budget on a resource that sits inside one of those
  budgeted groups is left out of the team total: the group's
  budget already covers it.

  TEAM TOTAL: $22,800/month of budgeted spend

So “the platform team’s budget” is something you build out of group and resource budgets, and the team page adds them up.

Composite budgets

A team can watch the same spend at several scopes, alerting different audiences:

TEAM PLATFORM: composite budget set

  Per-account budget: platform-prod account, $24,000/month
    Audience: team lead + FinOps
    Catches:  total account spend trending wrong

  Per-group budgets (environments inside that account):
    prod-platform:    $14,000/month
    staging-platform:  $3,200/month

    Audience: group's tech lead + on-call
    Catches:  environment-specific overruns

  Per-resource budgets (critical resources):
    db-prod-orders:        $1,500/month
    db-prod-payments:      $1,200/month

    Audience: DBA
    Catches:  resource-specific anomalies

The total is the same spend; different budgets watch different slices. When db-prod-orders crosses its warning threshold, only the DB team is alerted (with subscriptions scoped to that resource): the account budget is not affected because the resource’s spend is a fraction of the account total. When the account budget crosses its threshold, the team lead and FinOps hear about it.

Aggregation rules

A resource's spend contributes to:
  - Its per-resource budget (if defined)
  - The budget on any resource group it belongs to (if defined)
  - The budget on its cloud account (if defined)

NO DOUBLE-COUNTING within a single budget. Each budget is independent;
the same dollar appears in several budget totals (which is correct:
the dollar contributes to several accountability boundaries).

This is sometimes a source of confusion. “Why does my account budget show $24K and the sum of my resource budgets show $2.7K?” Because the resource budgets only cover two specific resources; the account budget includes everything in the account.

Designing the hierarchy

A practical sequence for designing a budget hierarchy from scratch:

1. START with group budgets per team environment
   prod / staging / dev groups for each team with cost
   accountability. The team page adds them up.

2. ADD per-account budgets where one owner holds a whole account
   Sandbox accounts, single-team accounts, single-product projects.

3. ADD per-resource budgets for outliers
   The top 3-5 most-expensive resources per team. The 80/20 rule:
   per-resource budgets give pinpoint signal where it matters.

4. ROUTE notifications by audience
   Scope each team's subscriptions to its groups, resources or
   account, so each alert lands on the owner (L3)

5. REVIEW quarterly
   Are the amounts right? Are the warnings firing meaningfully?
   Are the audiences responding? Adjust.

A typical maturity path

ORG MATURITY            TYPICAL BUDGET SHAPE
──────────────────────────────────────────────────────────────────
Crawl                    A few per-account budgets on the biggest
                         accounts
Walk (early)             Group budgets for each team's prod
                         environment
Walk (late)              Group budgets for prod + staging + dev;
                         team pages show the rollup
Run                      Groups + per-resource budgets for outliers;
                         scoped alert routing
Run (mature)             All of above + monthly variance review;
                         quarterly re-baseline of amounts

The progression is gradual. Don’t try to build the full Run-stage hierarchy on day 1: group budgets for each team’s environments capture most of the value with a fraction of the work.

2. Demo

A mid-size org’s composite budget structure:

ORG: 5 teams, $180K/month total spend

PER-ACCOUNT BUDGETS (single-owner accounts):
  ml-training-prod:       $22,000/month   (ml-infra)
  data-warehouse-prod:    $18,000/month   (data)
  sandbox-shared:          $3,000/month   (platform, as account owner)

PER-GROUP BUDGETS (team environments in shared accounts):
  prod-platform:          $14,000
  staging-platform:        $3,200
  prod-product:           $26,000
  staging-product:         $6,500

PER-RESOURCE BUDGETS (top critical):
  db-prod-orders            $1,500
  db-prod-payments          $1,200
  redis-prod-cache            $600
  prod-eks-cluster          $3,500

ALERT ROUTING (scoped subscriptions):
  Per-resource:  resource owner's channel
  Per-group:     #group-team-channel; exceeded also to #finops-alerts
  Per-account:   account owner's channel + #finops-alerts

TEAM PAGES:
  platform:  prod-platform + staging-platform = $17,200 budgeted
             (resource budgets on resources inside those groups
             are covered by the group budgets)
  product:   prod-product + staging-product = $32,500 budgeted

WHEN A SPECIFIC RESOURCE CROSSES ITS WARNING THRESHOLD:
  Only that resource's owners are alerted
  The group's budget may be far from its threshold; no group alert

WHEN AN ACCOUNT BUDGET CROSSES ITS WARNING THRESHOLD:
  Account owner + FinOps alerted
  This is a composite signal; investigate which groups drove it

The hierarchy means each alert lands on the right audience with the right specificity.

3. Hands-on (5 min)

Design your team’s budget hierarchy:

PER-GROUP BUDGETS (one per environment, typically 1-3):
  Group:        __________  Budget: $__________  Threshold: ___%
  Group:        __________  Budget: $__________  Threshold: ___%
  Group:        __________  Budget: $__________  Threshold: ___%

PER-ACCOUNT BUDGET (only if your team owns a whole account):
  Account:      __________  Budget: $__________  Threshold: ___%

PER-RESOURCE BUDGETS (top 3-5 critical):
  Resource:     __________  Budget: $__________  Owner: __________
  Resource:     __________  Budget: $__________  Owner: __________
  Resource:     __________  Budget: $__________  Owner: __________

TEAM PAGE TOTAL (sum of the group budgets, plus resource budgets
outside those groups):  $__________

REVIEW CADENCE:    monthly / quarterly

A common error is to skip per-resource budgets entirely. Even one or two well-chosen per-resource budgets (the database, the EKS cluster) catch anomalies a group or account budget would dilute.

4. Knowledge check

Q1

A critical database needs precise budget tracking:

A. The team’s budget summary is enough
B. Cloud-account isolation is sufficient
C. A tag-based budget on the owning team
D. Per-resource budget for that database

Show answer

Correct: D. Alerts fire on this resource specifically, routed to the DB owner. Most precise scope; combine with a group or account budget for composite visibility. Per-resource is the right scope for high-stakes individual resources.

Q2

On a team’s detail page, the budget summary totals:

A. The budgets on the team’s assigned resources and groups
B. All resources tagged with the team’s name in any account
C. Only the most expensive resource the team owns
D. A separate team budget created on the Budgets page

Show answer

Correct: A. There is no per-team budget and no tag scope. The team page adds up the budgets that already sit on the team’s assigned resources and resource groups; a resource budget inside a budgeted group is covered by the group’s budget and left out of the total.

Q3

Multiple budgets on the same data:

A. Cause double-counting
B. Confuse the engine
C. Are not allowed
D. Are independent

Show answer

Correct: D. A common pattern in mature orgs: per-account, per-group and per-resource budgets all track overlapping spend. The same dollar contributes to each budget it falls under, alerting different audiences at the appropriate granularity. Independent budgets, same underlying data. Each watches a different accountability boundary.

5. Apply

Create budgets on the Budgets page. Pick the scope (resource, resource group, cloud account or AI provider), set the monthly amount, and set the alert threshold. The Budget Health dashboard surfaces all your budgets in one view.

For new customers, the recommended starting hierarchy is: group budgets for each cost-accountable team’s environments, plus per-resource budgets for the 3-5 highest-cost critical resources. Add per-account budgets where one owner holds a whole account. Each team’s page then shows its budgeted total.

Glossary terms touched

Budget

Outcome

1. Concept

Per-resource detail

Per-group detail

Per-account detail

The team view: rolling up existing budgets

Composite budgets

Aggregation rules

Designing the hierarchy

A typical maturity path

2. Demo

3. Hands-on (5 min)

4. Knowledge check

Q1

Q2

Q3

5. Apply

Related lessons

Glossary terms touched

Start with the bill.