The problem
Cloud spend had crept up for over a year with nobody directly accountable for it, and a routine security audit flagged loose IAM permissions, long-lived unrotated secrets, and no consistent vulnerability scanning in the deploy pipeline.
What we did
- FinOps. Tagged every resource by team and environment, moved steady-state workloads to reserved and savings-plan pricing, right-sized over-provisioned instances, and set up cost-anomaly alerts so a spend spike is caught the week it happens, not the month.
- Security hardening. Rebuilt IAM around least privilege, moved secrets into a managed secrets store with automatic rotation, and added dependency and container vulnerability scanning to the CI/CD pipeline.
- Ongoing ownership. Left a monthly cost review and a security checklist built into the release process, rather than a one-time cleanup that quietly drifts back.
The outcome
Monthly cloud spend dropped by roughly a third within two billing cycles, and the next security audit came back clean. Both are now routine, checked parts of how the team ships — not projects that need repeating.