Skip to content
APEX

Cost Governance Guide

Budget alerts, forecast notifications, and anomaly detection for every deployment.

Why Cost Governance Is Mandatory

Section titled “Why Cost Governance Is Mandatory”

Every IaC deployment in this project must include cost monitoring resources. This is enforced by iac-bicep-best-practices.instructions.md and iac-terraform-best-practices.instructions.md, which apply to all .bicep, .tf, and implementation plan files.

The rule is simple: no budget, no merge. Challenger reviews verify cost monitoring exists, and CI validators flag missing budget resources.

Budget Alert Setup

Section titled “Budget Alert Setup”

Every deployment implements the governed cost-monitoring contract: a scope-appropriate Azure Budget, actual and forecast notifications, Action Group routing, and anomaly detection. Governance constraints override repository defaults.

The canonical contract and implementation examples are maintained in one place:

Budget amounts and notification recipients remain parameters. Do not copy thresholds or notification blocks into documentation; the canonical contract changes independently of this guide.

Per-Environment Budgets

Section titled “Per-Environment Budgets”

Use parameterised budgets that scale by environment:

EnvironmentTypical BudgetRationale
devLowMinimal resources, short-lived
stagingMediumProduction-like but limited use
prodFullProduction workload capacity

Set the budget amount via .bicepparam or terraform.tfvars — never hardcode it in the template.

Azure Resource Manager MCP Tools

Section titled “Azure Resource Manager MCP Tools”

The cost-estimate-subagent uses the hosted Azure Resource Manager MCP server during architecture review and as-built documentation:

ToolPurpose
get_retail_pricesQuery public retail catalog rows
query_costsQuery actual costs for an authorized scope
query_aks_costsBreak down deployed AKS costs
forecast_costsForecast costs for a deployed scope
get_benefit_recommendationsRetrieve reservation and savings-plan recommendations

The subagent calculates estimates from returned meter units and explicit usage. It cannot call ARM deployment, resource mutation, or budget creation tools.

The Microsoft Learn documentation tools (exposed through the Azure MCP documentation router, e.g. mcp_azure-mcp_documentation with command: "microsoft_docs_search") are used for looking up service-specific pricing documentation.

Repeatability Rules

Section titled “Repeatability Rules”

The cost governance instruction enforces zero hardcoded values:

  • projectName must be a parameter with no default
  • All tag values must reference parameters
  • Budget amounts must be parameterised
  • .bicepparam / terraform.tfvars is the only place for project defaults

Adversarial Review Checklist

Section titled “Adversarial Review Checklist”

The Challenger reviews verify two mandatory cost categories:

Cost Monitoring:

  • Budget resource exists
  • Notifications comply with the governed cost-monitoring contract
  • Anomaly detection configured
  • Notification recipients are parameterised

Repeatability:

  • No hardcoded project names or values
  • projectName is a required parameter
  • Template deploys to any tenant/region/subscription

Post-Deployment Validation

Section titled “Post-Deployment Validation”

After deployment, verify budget alerts are active:

Terminal window
# List budgets in the resource group
az consumption budget list \
  --resource-group rg-${PROJECT}-${ENV}


# Check budget notifications
az consumption budget show \
  --budget-name budget-${PROJECT}-${ENV} \
  --resource-group rg-${PROJECT}-${ENV}
Section titled “Related”