Skip to main content
Back to blog

Cloud Budgets Belong to Accounts, Not Resources

Riya Mittal
Riya Mittal Engineer · Zop.Dev
4 min read
Cloud Budgets Belong to Accounts, Not Resources

A budget only works when it lands on something a person can own. Most cloud budgets do not. They sit on a single resource or a resource group, objects that no team fully owns and no engineer checks daily. The bill arrives, the budget was never the number anyone watched, and the overspend is already three weeks old.

The unit teams actually own is the cloud account. A team gets an AWS account, an Azure subscription, or a GCP project, and everything they ship lives inside it. That boundary is where access, blast radius, and spend already line up. ZopNight now lets you set a budget on that boundary: one budget for an entire cloud account, with month-to-date spend shown per account.

A budget is only as good as the owner behind it

The job of a budget is not to stop spend. It is to force one question early: who owns this, and what will they cut. That question only has an answer when the budget maps to a real owner.

Resource-level budgets fail this test. They sound precise, but they shatter accountability into hundreds of pieces. A team running 300 resources would need 300 budgets to cover its footprint. The moment someone launches resource 301 untracked, it sits outside every budget you set. Coverage is never complete, and the gaps are exactly where waste hides.

Resource groups help, but only inside one provider’s grouping model, and they still do not match how money is owned. A group can span two teams. A team can span five groups. When the budget object does not match the ownership object, every overspend becomes a meeting about whose line item it was, held a month too late.

The account is the one object with complete coverage

The account does not have this problem. Spend rolls up to it by construction. Every resource, tagged or untagged, launched by a script or a person, lands in exactly one account. That makes the account the only budget object with both complete coverage and a single clear owner.

Architecture diagram

This is why account budgets catch what resource budgets miss. The instance someone spun up for a load test and forgot still counts against the account ceiling, because it cannot escape the account. There is no gap to fall through.

Month-to-date spend, per account, before the invoice

A ceiling is useless if you only see the burn after the month closes. ZopNight shows month-to-date spend for each account next to its budget, so a team reads “38,000 of 50,000, nine days left” instead of finding the overage on next month’s bill. The number updates as spend lands, which turns the budget from a post-mortem into a live signal a team can act on while the month is still open.

Budgets get a dedicated page under Settings, with three filters that answer the only questions that matter at scale: which accounts have a budget applied, which do not, and all of them together.

Budget objectCoverageClear ownerWhere waste hides
ResourceOne resource onlyMaybeEverything untracked
Resource groupOne provider’s groupingRarelyCross-group spend
Cloud accountEvery resource inside itYes, the teamNowhere to hide

The “Not set” filter is the one to run first. It surfaces every account operating without a ceiling, and those are the accounts that produce the surprise bills nobody can explain. An account with no budget is not a small risk. It is an unbounded one, and you usually find out its size on the invoice.

When account budgets work, and when they break

Account budgets work when your account layout already maps to teams: one account per team, per environment, or per product line. There, the budget, the owner, and the blast radius are the same boundary, and the number means something the moment it is crossed.

They break when one account holds many unrelated teams. A shared production account with twelve teams inside it gives you one budget for twelve owners, which is the same as no owner. If that is your layout, the fix is upstream. Split the account along team lines, or pair the account budget with policy-based attribution so spend inside the account still resolves to the team that created it.

Set the budget where ownership already lives, and the question a budget exists to ask, who owns this and what will they cut, finally has an answer before the bill does.

Tagged
Riya Mittal

Riya Mittal

Engineer · Zop.Dev

Riya works on the autonomous remediation engine at Zop.Dev. Before that she was a security engineer at a SaaS company that learned the hard way what 14 days of exposure looks like. She writes about cloud security, automation, and the trade-off between speed and safety.

Stop watching the waste.
Start cutting it.

See. Find. Fix. Automatic.

Connect your first cloud account in under 5 minutes. See your first remediation in under 7. No credit card required.

CDCR connect detect classify remediate
full audit every action traceable
read-only default access
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001 · zero-trust· 30% average cloud cost cut· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001 · zero-trust· 30% average cloud cost cut· 4 platforms · 1 console·