Skip to content
APEX

Cost governance

Why cost governance is mandatory

Section titled “Why cost governance is mandatory”

Every IaC deployment in this project must include cost monitoring resources. This is enforced by iac-bicep-best-practices.instructions.md and iac-terraform-best-practices.instructions.md, which apply to all .bicep, .tf, and implementation plan files.

Required reviews check the cost-monitoring contract. Do not infer complete coverage from CI or a source scan; verify the approved scope and deployed configuration.

Budget alert setup

Section titled “Budget alert setup”

Every deployment implements the governed cost-monitoring contract: a scope-appropriate Azure Budget, actual and forecast notifications, Action Group routing, and anomaly detection. Governance constraints override repository defaults.

The canonical contract and implementation examples are maintained in one place:

Budget amounts and notification recipients remain parameters. Do not copy thresholds or notification blocks into documentation; the canonical contract changes independently of this guide.

Per-environment budgets

Section titled “Per-environment budgets”

Use parameterised budgets that scale by environment:

EnvironmentTypical BudgetRationale
devLowMinimal resources, short-lived
stagingMediumProduction-like but limited use
prodFullProduction workload capacity

Set the budget amount via .bicepparam or terraform.tfvars, never hardcode it in the template.

Azure MCP pricing tool

Section titled “Azure MCP pricing tool”

The cost-estimate-subagent uses only the Azure MCP pricing tool during architecture review and as-built documentation:

ToolPurpose
pricing_getQuery public retail catalog rows, with optional savings-plan data

The subagent calculates estimates from returned meter units and explicit usage. It has no Azure Resource Manager MCP, deployment, resource mutation, or budget creation tools. Actual-cost and forecast queries belong to the apex-azure-cost-optimization skill, which uses the ARM MCP CostManagement toolset.

The Microsoft Learn documentation tools (exposed through the Azure MCP documentation router, e.g. mcp_azure-mcp_documentation with command: "microsoft_docs_search") are used for looking up service-specific pricing documentation.

Repeatability rules

Section titled “Repeatability rules”

The cost governance instruction enforces zero hardcoded values:

  • projectName must be a parameter with no default
  • All tag values must reference parameters
  • Budget amounts must be parameterised
  • .bicepparam / terraform.tfvars is the only place for project defaults

Adversarial review checklist

Section titled “Adversarial review checklist”

The Challenger reviews verify two mandatory cost categories:

Cost Monitoring:

  • Budget resource exists
  • Notifications comply with the governed cost-monitoring contract
  • Anomaly detection configured
  • Notification recipients are parameterised

Repeatability:

  • No hardcoded project names or values
  • projectName is a required parameter
  • Target scope, region, permissions, and service availability match the approved plan

Post-deployment validation

Section titled “Post-deployment validation”

After deployment, verify budget alerts are active:

Terminal window
# List budgets in the resource group
az consumption budget list \
  --resource-group rg-${PROJECT}-${ENV}


# Check budget notifications
az consumption budget show \
  --budget-name budget-${PROJECT}-${ENV} \
  --resource-group rg-${PROJECT}-${ENV}
Section titled “Related”