FinOps portfolio: 71 tickets over 5 years

My first finops ticket was called “Optimize the AWS infrastcuture.” The typo is still there. That was 2021 — a one-person infrastructure team at a startup that didn’t have the word finops in its vocabulary and didn’t know it needed one.

Five years later I went looking for every cost-related ticket I’d ever created. I expected maybe thirty. I found 71, spread across 8 Jira projects, touching every layer of the stack from EBS volumes to LLM inference spend. Nobody asked me to create a finops practice. I just kept looking at the bill and refusing to pay for things that didn’t earn their keep.

When I pulled the wider Jira archive, this portfolio stopped looking like an isolated sprint and started looking like the explicit cost-and-governance slice of a much longer substrate line. Before there was a FinOps spike, there were DNS cutovers, VPN setups, RDS recreations, kubecost installs, spot-instance experiments, external DNS work, and tenant plumbing. The project names changed. The instinct did not.

The arc

The tickets tell a story if you read them in order. Not a strategy — a maturation. The 71-ticket set is the part where the company had enough shared vocabulary for me to call the work FinOps. The lineage is older: infrastructure hygiene became cost visibility, then right-sizing, then deletion, then governance, and finally architecture that makes future waste harder to create.

First came audits. “Audit our AWS costs.” “Quantify the cost of our current setup.” “Create test plan for spot instances.” I was trying to see the bill clearly, because nobody else was looking.

Then visibility. I installed kubecost in 2021 to get per-namespace cost attribution on EKS. Later I enabled the AWS Cost Optimization Hub and started exporting its recommendations as FOCUS-format Parquet to S3 — which I query with DuckDB instead of clicking through the console, because ClickOps is schlepping.

Then right-sizing. gp2 to gp3. io1 to gp3 ($198/mo on one RDS instance). Magnetic EBS volumes nobody remembered creating. 40 orphaned EBS volumes that AWS recommended I snapshot and delete. 25 orphaned target groups. A t2.micro running for years with no name and no owner ($8/mo). I converted 17 volumes to gp3 in one evening and knocked $39/mo off the bill before dinner.

Then elimination. Three AWS Client VPN endpoints that had accumulated over four years of incremental security decisions — $489/mo replaced by a $3 t4g.nano running Headscale. A Transit Gateway that never carried traffic. A SAML VPN, a cert-based VPN, a NAT gateway, a Simple AD directory — all deleted, all ticketed, all with dollar amounts. A Jenkins instance and its ALB ($55/mo). A second ALB nobody was using ($22/mo). An EKS cluster that was part of an abandoned upgrade path ($72/mo for the control plane alone). Ancient stopped instances from 2016 that were still paying for EBS volumes. A mystery AWS Data Pipeline that had been billing $1/mo from a service AWS itself had canceled — the console was gone, but the CLI still worked.

Then replacement architecture. The VPN replacement wasn’t just a deletion — it was a design decision. I replaced a managed service with open-source infrastructure, open-sourced the Terraform module, and published the post. The Bedrock log router went from per-tenant subscription filters to a shared Lambda — consolidation as architecture, not just as cost reduction.

The current estate looks the same to me. A Well-Architected Review, support-plan downgrades, GovCloud auth-handler parity, tenant onboarding cleanup, and redundant rebuild elimination are not separate chores. They are cost, governance, tenancy, and operability showing up as one system again.

The monitoring stack

I don’t check the bill once a quarter. I have three systems watching it for me.

MiserBot sends a daily Slack report showing spend changes. It installs as a CloudFormation stack — one IAM role with read-only access plus CUR write permissions, and Concurrency Labs does the rest. When MiserBot flagged a new line item in March 2026, I traced it to RDS entering extended support at $330/mo. I stopped everything and upgraded PostgreSQL 13 to 16 that week.

AWS daily spend budget alarms fire when the annualized daily spend (daily × 30.3) crosses a threshold. I add a new lower threshold every time I drive costs down. The alarm history is the progress narrative: $6,000/mo was the original. $4,000/mo was the first achievement — I wanted to know if it ever crept back. Then $3,000. Then $2,000. Each alarm is a ratchet that locks in the gains and makes regression visible.

AWS anomaly detection emails handle the rest. Combined with bitter experience — I’ve been burned by extended support charges more than once — they drive preemptive upgrades on RDS and EKS before AWS starts billing penalty rates.

The feedback loop: MiserBot flags a change → I open DuckDB → query the Cost Optimization Hub Parquet in S3 → investigate → act. During the January sprint, I ran the same query every morning and watched $716 in available savings drop to $490 as I worked through the recommendations. $226/mo captured in two weeks.

The savings plan that made itself unnecessary

I’d been renewing a 1-year Compute Savings Plan annually. Coverage reports showed 50% of our compute was covered in November, December, January — not good enough. I bought a 3-year plan to push coverage to ~82% and created a daily budget alarm: if coverage drops below 80%, I get an email.

The plan was to wait for the 1-year to expire, then stagger monthly purchases of 3-year Compute Savings Plans — replacing the outgoing annual capacity with cheaper three-year commitments, spreading the risk across months instead of one annual cliff.

Phase 1 of the finops spike eliminated so much obsolete compute that when the 1-year plan expired, there was no gap left to fill. I canceled it instead of renewing. The optimization had made the discount instrument unnecessary. That’s the best possible outcome — you don’t need the coupon because you stopped buying the thing.

The archaeology

In March I went back through an older product’s infrastructure — a platform from the company’s earlier life. g2.2xlarge GPU instances from an era when that was a reasonable instance type. CloudFormation stacks for deployment configurations nobody could name. CodeDeploy applications for services that hadn’t run in years. An RDS instance that AWS kept restarting for maintenance every week because it was “stopped temporarily” — I had to race them to delete it.

I deleted 71 EBS volumes from an abandoned cluster in a single session. I inventoried 4.7 TB of RDS snapshots in dev, some dating back to 2016. I stopped five running instances that predated Kubernetes. Every one of these was an ancestor of the current infrastructure — still breathing, still billing, invisible to anyone who didn’t go looking.

The discipline

Every optimization gets a ticket. Every ticket has a dollar amount where possible. Every threshold gets an alarm. I created a private Slack channel mid-sprint as an operational diary — daily logs of what I deleted, converted, or proposed, with volume IDs, DuckDB queries, and CLI output. I wish I’d created it years earlier.

The portfolio now spans 71 tickets across 8 Jira projects, 5 years, and a spend reduction from $6,000/mo to under $2,000/mo. Most of those tickets took less than an hour. Some took five minutes. A few — the VPN replacement, the EKS cluster consolidation proposal, the savings plan strategy — took real architectural thinking.

None of them required a finops team. They required an engineer who looked at the bill every day and kept asking: does this earn its keep?

The receipts

Everything above is the narrative. Below is the evidence — the daily diary entries from the sprint and the full ticket portfolio. Scroll if you want the story. Stay if you want the proof.

The January sprint — daily Slack diary

I kept a private channel during the sprint. Here’s what a month of daily finops work looks like when one person is doing it between other responsibilities:

The full ticket portfolio — 71 tickets, 8 projects, 2021–2026

Every ticket below is real. The project prefixes are sanitized, the dollar amounts are not. Read the “Done” column as a progress bar — most of the value has already been captured. The backlog items are either blocked by other teams, deliberately on hold, or waiting for the right moment.

Epics

Under Epic RM-434 (28 tickets)

VPN replacement arc (~$489/mo → $3/mo)

Cost Optimization Hub cluster (INF)

Infrastructure cleanup

Scale-down / auto-scaling

SaaS platform cost optimization

Right-sizing

Visibility & governance

Spend controls (LLM)

Direct cost reduction