azure-cost-finops

Standard IDs

ID	Severity	What it checks
FIN-001	P1	No Azure Budget resource with action-group alerting
FIN-002	P2	Autoscale rules with no documented right-sizing review cadence
FIN-003	P2	No cost-anomaly detection/alerts configured
FIN-004	P2	Orphaned/unused resources with no automated cleanup policy

---

Check A — No Budget resource with alerting (FIN-001)

Detection

Grep Bicep for Microsoft.Consumption/budgets. This goes beyond azure-waf-review's WAF-COST pillar (which flags missing cost tags) by checking for an actual spend ceiling with alert thresholds — without one, a runaway resource (an autoscale misconfiguration, a forgotten test environment) accumulates cost with nobody notified until the monthly bill arrives.

BAD — no budget defined anywhere

// No Microsoft.Consumption/budgets resource in any template — spend is unmonitored
// until someone happens to check the Cost Management blade.

GOOD — budget with staged alert thresholds tied to the on-call action group

resource budget 'Microsoft.Consumption/budgets@2023-05-01' = {
  name: 'budget-orders-prod-monthly'
  properties: {
    category: 'Cost'
    amount: 5000
    timeGrain: 'Monthly'
    notifications: {
      actual_80pct: {
        enabled: true
        operator: 'GreaterThan'
        threshold: 80
        contactGroups: [actionGroup.id] // same action group as azure-observability AOBS-003
      }
      forecasted_100pct: {
        enabled: true
        operator: 'GreaterThan'
        threshold: 100
        thresholdType: 'Forecasted'
        contactGroups: [actionGroup.id]
      }
    }
  }
}

---

Check B — Autoscale rules with no right-sizing review cadence (FIN-002)

Detection

Check whether autoscale rules (Microsoft.Insights/autoscaleSettings, Container Apps scale rules) have a documented review cadence — min/max replica counts and scale thresholds set once at launch and never revisited drift out of sync with actual traffic patterns over time, typically erring toward over-provisioned minimums "just to be safe."