Outcome
By the end of this lesson, you will be able to distinguish rollup from isolation views, decide which view fits which audience, and use ZopNight’s account filters to switch between them.
| Prerequisites | M4.4.L1-L3 (multi-account fundamentals + discovery) |
| Time | 9 minutes |
1. Concept
A multi-account environment generates two structurally different cost views from the same underlying data:
ROLLUP Sum costs across multiple accounts to get one number "What did our entire AWS estate cost this month?" "What does the production OU spend?"
ISOLATION Keep per-account costs distinct and visible "What did prod-eu account cost this month?" "How does platform-prod compare to product-prod?"Both views are correct; they answer different questions. The skill is picking the right view for the audience and switching cleanly between them. Most failures here are the wrong view shown to the wrong audience. Leadership gets per-account detail it cannot act on. Engineering cannot see its own costs because everything is presented as one company-wide total.
When rollup is the right view
SCENARIO WHY ROLLUP WINS──────────────────────────────────────────────────────────────────Executive monthly cost review "What does cloud cost us this month?": one number
Annual budget vs actual reporting Compare budget against aggregate spend
Treasury / cash-flow planning Aggregate matters; per- account is irrelevant
Cost-per-business-unit (rolled up by BU) Each BU's slice across all its accounts
Org-wide compliance reports "What is our cloud spend this fiscal year?"
External reporting (investors, audits) Single defensible numberWhen isolation is the right view
SCENARIO WHY ISOLATION WINS──────────────────────────────────────────────────────────────────Per-team accountability Each team owns one (or more) accounts; their bill is their responsibility
Chargeback to teams The actual invoice each team should receive
Quota management Quotas are per-account; need to see per-account utilization
Incident response "Cost spike: which account?" → isolation surfaces the source
Compliance: per-account scope PCI/HIPAA scope is account- bounded; reports must isolate
Anomaly investigation Which account's anomaly is this? → isolation neededBoth views matter. Different reports, different audiences, same underlying data.
How ZopNight handles both
ZopNight surfaces both views from the same cost records. There is no separate report per view; you move between rollup and isolation on the same pages:
SURFACE PRIMARY VIEW SECONDARY VIEW──────────────────────────────────────────────────────────────────Cost Reports → Summary Rollup (org total, Per-provider card; daily or accumulated) expand a provider to see each account, and an account to see its resource types
Cost Reports → Teams Rollup (team totals) Team detail: split by provider and by resource type
Cost Flow (/cost/flow) Sankey of the period's Click an account node spend, 4 columns deep to narrow every column to that one account
Resources list Every resource Filter to one cloud account (an account row on Summary opens it)Team scoping vs account filtering
These are two different filters that both narrow the visible data, and confusing them is a common source of “I can’t find my cost” support tickets.
TEAM SCOPING Restricts the user's visibility to resources owned by their team. The team may span multiple accounts; the scope sees every resource assigned to team X (directly or through its resource groups), regardless of account. Tags do not decide it.
ACCOUNT FILTERING Narrows what you are looking at to one account: an account node in Cost Flow, or the Resources list filtered to that account. It changes the view, not the user's access.A platform engineer scoped to the platform team sees their team’s resources across the 3 accounts that hold platform infrastructure. They can narrow further to “just acme-platform-prod” by clicking that account in Cost Flow. Two layers of filtering compose.
Cross-account analysis examples
"Top 10 spenders org-wide" (rollup analysis) Filter: no account filter (or all accounts) Sort: monthly cost descending Limit: 10 → Returns top resources regardless of which account they're in Use: org-wide optimization targeting
"Cost difference: prod-us vs prod-eu" (isolation analysis) View: Cost Reports → Summary, AWS card expanded Compare: the acme-prod-us and acme-prod-eu rows, then expand each to compare their resource-type split Use: regional cost-of-running comparison
"Which account is growing fastest?" (trend isolation) View: Cost Flow, Provider → Account → Service → Team layout Period: this month, then the same dates last month → Compare each account node's total across the two periods Use: early warning for runaway accounts
"Show my team's spend across accounts" (team scoping + isolation) Scope: team-scoped user (Editor on team=platform) View: Cost Flow, default layout; the Account column shows which accounts feed the platform team's node Use: team lead understanding where their spend livesCommon reporting mistakes
MISTAKE FIX──────────────────────────────────────────────────────────────────Showing exec team per-account Lead with the Cost Reports →breakdown of 60+ accounts Summary total; expand accounts only on request
Showing platform team an org-wide Use team scoping; filter torollup when they wanted theirs their team scope first
Mixing prod and non-prod in a single Filter by account or by tagreport intended for compliance review to isolate prod-scope
Comparing accounts without normalizing Compare cost-per-unit, notfor workload size raw cost; small + cheap account vs large + cheap account is not the same insight as small + expensive vs large + expensiveThe normalization point is especially important. A cheap small dev account can look “100% growth month-over-month” simply because someone provisioned a single resource. Normalizing by workload size (units, requests, users) avoids over-reacting.
How ZopNight uses both views
For executive reporting, Cost Reports → Summary gives the rollup as the headline number, with the provider breakdown as the first level of detail and per-account as the second. For engineering team views, Cost Reports → Teams rolls up by team, and the team detail splits that total by provider and resource type.
ZopNight does not pick a report for you by role. After sign-in, everyone who holds dashboard:view lands on Overview (the org’s default dashboard); a role without it lands on Needs attention. Team scoping then decides which resources each person’s views include.
AUDIENCE WHERE TO SEND THEM─────────────────────────────────────────────────────────Executive Cost Reports → SummaryTeam lead (team-scoped) Cost Reports → TeamsFinOps (cross-team) Summary, then Cost Flow to drillIncident responder Cost Flow, then ResourcesTo give an audience its own starting point, save a dashboard for it and share the link (M4.7 covers dashboards).
2. Demo
A mid-size customer’s reporting layout:
ORG: 8 AWS accounts, $1.62M/mo total spendACCOUNTS: acme-prod-platform $640K/mo acme-prod-product $360K/mo acme-prod-shared $200K/mo acme-staging $180K/mo acme-dev-shared $80K/mo acme-sandbox $40K/mo acme-security $30K/mo acme-shared-services $90K/mo ──────── $1,620K total
VIEW BY AUDIENCE:
EXECUTIVE (monthly review): Cost Reports → Summary Headline: "Cloud spend this month: $1.62M" Per-provider: AWS $1.62M (single cloud in this example) Expand AWS: the 8 accounts above, largest first
FINANCE PARTNER (quarterly review): Cost Reports → Teams (showback view) Per-team subtotals: platform $740K, product $410K, data $260K, ... Summary tab Export for the finance system, team totals copied from the Teams tab
PLATFORM ENGINEER (their team's view): Team-scoped; sees platform team's resources only Cost Flow, default layout: Provider → Account → Type → Team Account column: acme-prod-platform $640K, acme-staging $100K Their team's optimization recommendations: $80K/mo unrealized
INCIDENT RESPONDER (cost-spike investigation): Cost Reports → Summary: the daily chart shows the spike day Cost Flow for that period: the acme-prod-product node is the one that grew; click it to narrow every column to that account Then open Resources filtered to acme-prod-productOne data set; four very different views based on audience.
3. Hands-on (6 min)
For your team and org:
EXECUTIVE-AUDIENCE REPORT (rollup): Total monthly spend (org-wide): $__________ Top-level breakdown: by provider / by environment / by team Frequency: weekly / monthly / quarterly Owner: __________
PER-TEAM REPORT (isolation): Number of teams reported: _____ Top spender: __________ $__________ Lowest spender: __________ $__________ Frequency: monthly Distribution method: Slack / email / dashboard
INCIDENT VIEW (isolation): Cost Flow layout to start from: __________ (one of the 5 presets) Account you would click first: __________
ONE QUESTION you could not answer with the current views: __________________________________________________________
Which view would answer it? __________________________________________________________If you have a question that the current views don’t answer, that’s a gap to close (often a custom dashboard: covered in M4.7).
4. Knowledge check
Q1
A leadership review wants the org-wide cloud cost total. Best view:
A. Rollup view (Cost Reports → Summary)
B. Per-account isolation showing all 12 accounts
C. Random account
D. Resource-level detail
Show answer
Correct: A. One headline number with drill-down available for follow-up questions. Executives need a clean number; the per-account detail is available if they ask. Rollup at the top, isolation underneath when asked. Don’t lead with detail the audience cannot act on.
Q2
A team lead investigating spend on their team’s resources. Best view:
A. The org-wide rollup, which totals up every one of the accounts together at once regardless
B. Team-scoped view (automatically filters to their team’s resources across all accounts that hold them)
C. A single cloud account view, picked out at random from across the whole estate
D. The anomaly view, which shows whatever deviated most recently in the period
Show answer
Correct: B. Shows only what they own, rolled up to the team, with Cost Flow showing which accounts feed it. Combines RBAC scope with isolation. Team scoping is the right filter; the view is rolled up to team for the team’s view but isolates across accounts.
Q3
Rollup and isolation views:
A. Are different views of the same underlying data
B. Are different reports, each stored separately
C. Are the same view under two different names
D. Require two entirely separate ZopNight tenants
Show answer
Correct: A. ZopNight supports both natively; users switch by expanding accounts on Summary or clicking an account in Cost Flow. Executive needs rollup; engineering needs isolation; both are produced from the same cost records. Same data, two views. Maintaining separate reports for the two would create reconciliation pain.
5. Apply
Use Cost Reports → Summary for the rollup and its per-provider and per-account breakdowns (zop.dev/zopnight/app/cost-reports), and Cost Reports → Teams for team rollups (zop.dev/zopnight/app/cost-reports?tab=teams).
For recurring audiences, build a dedicated dashboard (covered in M4.7) and share its link with that audience.
Related lessons
- L1: Why multi-account
- L2: Cloud-provider hierarchies
- L3: Cross-account discovery
- L5: Multi-account anti-patterns (next)
- T4.M4.7.L1: Dashboard presets