FinOps for startups: your first week with AAA Sentinel, from the first account to the Monday ritual

"We'll optimize costs once we grow." It is a reasonable call in a startup's first months: there is product to build and the cloud bill is still small. The problem is that habits not formed early cost far more later, when there are hundreds of resources without an owner and nobody remembers what each one was for. In this article we cover the FinOps basics worth having from day one and how to get them running in a week with AAA Sentinel.

FinOps in two minutes

FinOps is the practice of managing cloud spend with data and with owners, just as any other company expense is managed. It is not only about cutting: it is about knowing what you spend on, deciding whether it is worth it, and having someone accountable for each item. The FinOps Foundation organises it into three phases that repeat in a cycle:

• Inform: see how much is spent, on what, and by whom.
• Optimize: remove what is surplus and adjust what is oversized.
• Operate: make it a habit, with alerts, regular reviews and owners.

Why start early

While the bill is small, each habit is cheap to put in place and prevents problems that are hard to undo later:

• Tagging from the first resource is almost free; tagging hundreds of inherited resources is a project.
• Forgotten resources (unattached disks, unused IPs, snapshots of disks that no longer exist) pile up quietly, and each one bills every month.
• Catching a spending spike on the day it appears is much cheaper than finding it on next month's bill.
• When an investor asks how much the infrastructure costs and why, you will have the answer with data.

How AAA Sentinel helps: the 30-day trial

When you sign up you get 30 days of the full Pro plan, with no credit card. That is plenty of time to set up everything in this article:

• Up to 5 AWS, Azure or Google Cloud accounts, connected read-only.
• A daily automatic scan, plus manual scans whenever you need them.
• Every waste detection rule, the savings overview, reservation and rightsizing recommendations, and the simulator.
• Alerts by email, Slack, Microsoft Teams or webhook, and the periodic summary by email.

Worked example: ACME's first week

ACME is a fictional startup with a single AWS account and one person, the CTO, looking after the infrastructure. This is the plan she follows in her first week with AAA Sentinel, and the one we will walk through step by step:

Step 1 (day 1): connect the account read-only

In My cloud accounts → Connect account, pick the provider under "Choose your cloud provider". With AWS, the wizard has three steps:

• "Step 1 — Create the IAM role": click "Open CloudFormation in AWS". The console opens with the FinOpsSentinelConnector stack already configured, including your organization's External ID. Tick the box where AWS asks you to acknowledge that the stack creates IAM resources, and create it. The AWS user creating it must be allowed to create IAM roles. Then click "I created the role".
• "Step 2 — Copy the role ARN": once the stack finishes, copy the role ARN from the CloudFormation Outputs tab and click "I have the ARN".
• "Step 3 — Connect the account": paste the ARN, enter the "Account name" and click "Connect account".

If your cloud is Azure or Google Cloud

The wizard is equivalent, also read-only:

• Azure: "Step 1 — Create Service Principal" with the Reader role for inventory and Cost Management Reader for costs; then you paste its credentials and name the account.
• Google Cloud: "Step 1 — Create a Service Account" with read roles and "Step 2 — Upload Service Account" with its JSON file. "Step 3 — Real costs (optional)" connects your BigQuery billing export if you have one.

Step 2: the first scan

With the account connected, go back to My cloud accounts and click "Scan" on it. The scan can take up to 2 minutes. From then on:

• An automatic scan runs every day in the early hours (at 04:00 UTC), so findings stay up to date without you doing anything.
• You can run manual scans when you change something, up to 2 a day per account.
• Whatever you fix in the cloud disappears from the findings on the next scan.

Step 3 (day 2): read Active findings

Active findings is the list of everything the scan has found. Each finding shows the severity, the resource, the account and the estimated "Savings/mo"; opening it shows the "Recommendation" with what to do and why. The key is to decide, not just read. Each finding has a status:

• "Open": waiting for a decision.
• "Accepted": you are going to act on it.
• "Dismissed": you reviewed it and it is intentional, for example a disk you keep on purpose.
• "Resolved": you have already fixed it.

What ACME found

This is ACME's first scan. The figures are an example worked out with approximate us-east-1 list prices; in your account, the platform shows its own estimate under "Savings/mo":

• The first three rows are waste: about US$51/month removed in an afternoon. ACME marks them "Accepted" and deletes them.
• The underused instance turns out to be a test environment for a customer who has left. It is terminated: another US$121/month.
• The untagged resources save nothing on their own, but they are the ones nobody knows the owner of. The rule asks for at least two of Environment, Project, Owner, CostCenter or Team.

Step 4 (day 3): the Savings overview

The Savings overview gathers the account's whole potential: "Total savings/mo" and "Annual savings", the "Potential savings breakdown" and the "Top quick wins", the optimizations with the greatest immediate impact. From here you reach three more analyses, part of the Pro plan and included in the trial:

• Reserved Instances: which stable instances are worth reserving for 1 or 3 years. Today it covers AWS EC2 instances and RDS databases.
• Rightsizing: EC2 instances that can move down a size based on their real usage.
• Savings simulator: scenarios such as switching development off at night or moving S3 data to Glacier, to size the saving before acting.

Step 5 (day 4): alerts and the weekly summary

So you do not have to log in to check, go to Alerts → Alert channels and choose where to receive notifications: email, Slack, Microsoft Teams or a webhook. Then review two blocks:

• "Detection thresholds": by default it alerts when spend rises by 20% or more, and does not alert if total spend is below US$5. You can also choose whether to be notified of every new critical or high finding.
• "Periodic summary": it starts disabled. Choose "Weekly", the "Day of week" and the "Send time (UTC)". You will receive by email, for each account, the monthly cost, the number of findings, the potential savings, the alerts in the period and the completed scans.

The Monday ritual: 30 minutes

With the weekly summary arriving first thing on Monday, the review fits in half an hour:

• Read the summary: has the monthly cost changed? Were there alerts this week?
• Open Active findings and decide on each new one: accept, dismiss or resolve. Leave none "Open" without a reason.
• Pick a single action for the week, the one with the highest "Savings/mo" or the easiest, and give it an owner.
• Check that new resources arrive tagged. If they show up under "Untagged resources", talk to whoever created them.

When to move to a paid plan

Before the trial ends, decide whether you want to keep scanning. This is what changes between the two plans (monthly prices, taxes included):

• Pro is enough while a single person manages the cloud: it does not include team members.
• Business makes sense when you want to invite the team with roles (finance, approvers, read-only) or have the AI Agent carry out approved actions, such as switching development environments off at night.

What it does not do yet

So you know what to expect:

• It does not manage cloud budgets. For a monthly cap with a warning, use your provider's budgets (AWS Budgets, Azure or Google Cloud budgets) and leave spikes and waste to AAA Sentinel.
• Reservation recommendations cover AWS EC2 and RDS; it does not recommend Savings Plans or Azure or Google Cloud reservations.
• It does not analyse Kubernetes clusters.
• Per-service anomaly detection and cost allocation by team are part of the Business plan.

First-week checklist

With this done, you will have the FinOps essentials running before the bill becomes a problem:

• First account connected read-only and first scan completed.
• Every finding has a status: accepted, dismissed or resolved.
• Waste removed and the first rightsizing action decided.
• Alert channel set up and thresholds reviewed.
• Weekly periodic summary enabled for Monday morning.
• Environment and Owner tags on every new resource.
• A decision on the plan made before the trial ends.