Nobody chose to keep 7 years of event logs. The default did. You’ve paid for it every month since.
The CTO opens the FinOps dashboard. Spend is up 30% this quarter. The dashboard shows where the money went: storage, egress, a warehouse running 24/7. It doesn’t show why, because the why is a decision nobody remembers making.
Three defaults drive most of the cloud bill I see at SMEs:
- Retention. Logs, events, and raw tables set to “keep forever” because that was the default when the pipeline shipped. Nobody picked it. Nobody owns it.
- Storage tier. Everything sits in hot storage, queried once a quarter or never. Cold storage costs a fraction. The data never moved because moving it was nobody’s job.
- Copies. The same dataset replicated across three environments, two of them stale, all three billed.
A dashboard reports this after the money is spent. It can’t change the number it’s showing you.
What lowers the bill sits upstream, in architecture:
- Set retention on purpose. “Raw events: 90 days. Aggregates: 3 years.” Write it down. Give it an owner.
- Tier by access, not by habit. A table queried once a month doesn’t belong in hot storage.
- Kill the copies you can’t name. If nobody can say why a dataset is replicated, it probably shouldn’t be.
I watched a two-week storage review cut a Belgian SME’s warehouse bill by close to 40%. Not one line of pipeline code changed. The savings were sitting in retention settings nobody had touched since the platform went live.
The dashboard is where cloud cost shows up. It gets set much earlier: in what you keep, how fresh it has to be, and how many times you copy it. Fix that and the dashboard mostly takes care of itself.
When did anyone last set your retention on purpose?