A cloud account setup checklist for cost is worked through by the platform owner before a new account, subscription or project is handed to a team, and again when an existing account gets a new owner; it records which budgets and alerts, tags, exports, guardrails, quotas, access rights and names are in place before the first resource exists. The decision it records is the handover: an account without a complete checklist gets no team. Why controls are cheaper at the start of the lifecycle than at its end is explained on cost in the development lifecycle; how accounts, subscriptions and projects form the hierarchy on billing accounts and hierarchies. This page is the checklist.
The template
Cost controls for <account, subscription or project>, created on <date>, owner <team>, cost centre <number>, environment <prod, dev, sandbox>, handed over by <role>
Master data
| Field | Value |
|---|---|
| Name per the scheme | <org-team-environment-purpose> |
| Place in the hierarchy | <organisational unit, management group or folder> |
| Billing account | <payer account, billing profile or Cloud Billing account> |
| Tags or labels on the account | owner=<team>, cost-center=<number>, environment=<value> |
| Billing and security contacts | <distribution list, not a person's mailbox> |
| Time limit | <end date or none>, deletion deadline <date> |
| Budget per month | <amount>, reasoning <estimate from the architecture review> |
Checklist before handover
Allocation
- Tags or labels on the account set and read by the central export
- Name follows the scheme; the account sits in the organisational unit, management group or folder of its environment
- Tagging enforcement inherited: tag policy attached, Azure Policy assigned, or constraint and pipeline check active
Billing data
- Account appears in the central export: the payer's Data Exports, an export on the billing scope or the billing account's BigQuery export
- Read access to cost data granted to the team:
<role>per provider - Account registered in the cost tool with owner and cost centre
Budgets and alerts
- Monthly budget set with alerts at
<50, 80, 100>percent actual and<100>percent forecast to<team lead, cloud owner> - Anomaly detection covers the account: monitor, anomaly alert or detection per billing account
- For
devandsandbox: budget action or billing shutdown at<percent>configured<yes, no, reason>
Guardrails
- Regions restricted to
<list> - Services restricted:
<list>; GPU instances and<expensive services>on request only - Quotas at their defaults; increases only with a request and a budget check
- Free tier and credits: expiry
<date>noted, reminder<30>days before
Access
- Billing rights only for
<roles>; root or owner access with MFA, not for daily use - No long-lived access keys; alert on key creation
Operations
- Shutdown schedule for
devset as tagschedule; deletion deadline for temporary resources asexpires-on - Owner has confirmed the checklist; entry in the account register
Per provider
| Control | AWS | Azure | Google Cloud |
|---|---|---|---|
| Hierarchy | organisational unit in AWS Organizations | management group | folder under the organisation |
| Account tags | account tags, activated for cost allocation | subscription tags with inheritance in Cost Management | project labels |
| Export | Data Exports (CUR 2.0) on the payer | export on the billing account scope | BigQuery export on the billing account |
| Budget | AWS Budgets, budget actions | Cost Management budgets, action groups | Cloud Billing budgets, Pub/Sub, disable billing |
| Anomalies | Cost Anomaly Detection | anomaly alerts | cost anomaly detection |
| Guardrails | service control policies | Azure Policy | organisation policies |
| Quotas | Service Quotas | subscription quotas | project quotas |
| Cost access | IAM policies for Billing, billing views | Cost Management Reader role | Billing Viewer role |
Account register
| Account | Owner | Cost centre | Environment | Budget per month | Created | End date | Checklist confirmed |
|---|---|---|---|---|---|---|---|
<id> | <team> | <number> | <environment> | <amount> | <date> | <date> | <date, person> |
How to fill it in
Master data: the name carries team and environment because the export shows it on every line and the tag can be missing; contacts are distribution lists because people leave. The budget comes from the estimate of the architecture review, not from a round number.
Allocation: which tags are mandatory is in the tagging policy; how account, subscription and project themselves serve allocation is on allocation by account, subscription and project. Billing data: the exports per provider are described on AWS Cost and Usage Report, Azure cost exports and Google Cloud billing export; read access on access and roles for cost data.
Budgets: the thresholds and what a budget action can do are on budget alerts and thresholds; the billing shutdown is for sandboxes only, because it deletes resources. Guardrails: regions, services and quotas as a brake are described on guardrails and approval thresholds; when a free tier ends and what is charged then on free tiers and trials. An alert from the account lands in the anomaly runbook.
How to adapt it
One team: the account register is one row per environment, and the handover is confirmed by the person who also uses the account. Several teams: the checklist becomes the pipeline that creates an account from a template (account factory, landing zone, project factory), and the check is the pull request on the template.
One provider: the per-provider table shrinks to one column, the rows stay. Three providers: one register for all, with a provider column, because the monthly review asks by cost centre, not by provider.
Startup: budget, anomaly detection, the access key alert and the free tier date are the four points that come first; regions and services follow with the second account. Finance-led: no account without a cost centre in the register, and the register is reconciled monthly against the export so no account runs outside the chargeback.
Sources
Read on 2026-10-21. FinOps Foundation, Governance, Policy & Risk (CC BY 4.0), account tags for cost allocation, configuring budget actions, service control policies, alternate contacts of an account, avoiding unexpected charges after the Free Tier, tag inheritance in Cost Management, assign access to Cost Management data, overview of Azure Policy, restrict resource locations, disable billing with budget notifications, Essential Contacts.