|
1 | 1 | --- |
2 | 2 | layout: default |
3 | | -title: "FinOps Cost Governance Workshop" |
| 3 | +title: Home |
| 4 | +nav_order: 0 |
| 5 | +permalink: / |
4 | 6 | --- |
5 | 7 |
|
6 | 8 | # FinOps Cost Governance Workshop |
7 | 9 |
|
| 10 | +Welcome to the **FinOps Cost Governance Workshop** — a hands-on, progressive workshop that teaches you how to scan Azure infrastructure for cost governance violations using four open-source tools: PSRule, Checkov, Cloud Custodian, and Infracost. |
| 11 | + |
| 12 | +All results are normalized to [SARIF v2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) for unified reporting in GitHub Advanced Security or Azure DevOps Advanced Security. |
| 13 | + |
8 | 14 | > [!NOTE] |
9 | 15 | > This workshop is part of the [Agentic Accelerator Framework](https://github.com/devopsabcs-engineering/agentic-accelerator-framework). |
10 | 16 |
|
11 | | -Learn to scan Azure infrastructure for cost governance violations using four open-source tools—PSRule, Checkov, Cloud Custodian, and Infracost—producing SARIF output for GitHub Security tab integration. |
12 | | - |
13 | 17 | ## Architecture |
14 | 18 |
|
15 | 19 | ```mermaid |
@@ -56,20 +60,66 @@ graph LR |
56 | 60 | | Cloud Custodian | Orphans, tagging, right-sizing on live resources | Converted | Apache 2.0 | |
57 | 61 | | Infracost | Pre-deployment cost estimates | Converted | Apache 2.0 | |
58 | 62 |
|
59 | | -## Labs |
| 63 | +## Prerequisites |
| 64 | + |
| 65 | +- **GitHub account** with access to create repositories |
| 66 | +- **Azure subscription** (required for Labs 04, 05, 07; free tier works) |
| 67 | +- **VS Code** with the Bicep and PowerShell extensions |
| 68 | +- **Tools** (installed during Lab 00): |
| 69 | + - Azure CLI |
| 70 | + - GitHub CLI |
| 71 | + - PowerShell 7+ |
| 72 | + - PSRule and PSRule.Rules.Azure module |
| 73 | + - Checkov (`pip install checkov`) |
| 74 | + - Cloud Custodian (`pip install c7n c7n-azure`) |
| 75 | + - Infracost CLI |
60 | 76 |
|
61 | | -Work through the labs in order. Labs 02–05 can be completed in parallel after Lab 01. |
| 77 | +See [Lab 00: Prerequisites](labs/lab-00-setup.md) for detailed installation instructions. |
62 | 78 |
|
63 | | -- [ ] [Lab 00 — Prerequisites and Environment Setup](labs/lab-00-setup.md) _(30 min, Beginner)_ |
64 | | -- [ ] [Lab 01 — Explore the Demo Apps and FinOps Violations](labs/lab-01.md) _(25 min, Beginner)_ |
65 | | -- [ ] [Lab 02 — PSRule: Infrastructure as Code Analysis](labs/lab-02.md) _(35 min, Intermediate)_ |
66 | | -- [ ] [Lab 03 — Checkov: Static Policy Scanning](labs/lab-03.md) _(30 min, Intermediate)_ |
67 | | -- [ ] [Lab 04 — Cloud Custodian: Runtime Resource Scanning](labs/lab-04.md) _(40 min, Intermediate)_ |
68 | | -- [ ] [Lab 05 — Infracost: Cost Estimation and Budgeting](labs/lab-05.md) _(35 min, Intermediate)_ |
69 | | -- [ ] [Lab 06 — SARIF Output and GitHub Security Tab](labs/lab-06.md) _(30 min, Intermediate)_ |
70 | | -- [ ] [Lab 06-ADO — SARIF Output and ADO Advanced Security](labs/lab-06-ado.md) _(35 min, Intermediate)_ |
71 | | -- [ ] [Lab 07 — GitHub Actions Pipelines and Cost Gates](labs/lab-07.md) _(45 min, Advanced)_ |
72 | | -- [ ] [Lab 07-ADO — ADO YAML Pipelines and Cost Gates](labs/lab-07-ado.md) _(50 min, Advanced)_ |
| 79 | +## Labs |
| 80 | + |
| 81 | +| # | Lab | Duration | Level | |
| 82 | +|---|-----|----------|-------| |
| 83 | +| 00 | [Prerequisites](labs/lab-00-setup.md) | 30 min | Beginner | |
| 84 | +| 01 | [Explore Demo Apps](labs/lab-01.md) | 25 min | Beginner | |
| 85 | +| 02 | [PSRule](labs/lab-02.md) | 35 min | Intermediate | |
| 86 | +| 03 | [Checkov](labs/lab-03.md) | 30 min | Intermediate | |
| 87 | +| 04 | [Cloud Custodian](labs/lab-04.md) | 40 min | Intermediate | |
| 88 | +| 05 | [Infracost](labs/lab-05.md) | 35 min | Intermediate | |
| 89 | +| 06 | [SARIF + GitHub Security Tab](labs/lab-06.md) | 30 min | Intermediate | |
| 90 | +| 06-ADO | [SARIF + ADO Advanced Security](labs/lab-06-ado.md) | 35 min | Intermediate | |
| 91 | +| 07 | [GitHub Actions + Cost Gates](labs/lab-07.md) | 45 min | Advanced | |
| 92 | +| 07-ADO | [ADO Pipelines + Cost Gates](labs/lab-07-ado.md) | 50 min | Advanced | |
| 93 | + |
| 94 | +## Workshop Schedule |
| 95 | + |
| 96 | +### Half-Day (3.5 hours) |
| 97 | + |
| 98 | +| Time | Activity | |
| 99 | +|------|----------| |
| 100 | +| 0:00 – 0:30 | Lab 00: Prerequisites | |
| 101 | +| 0:30 – 0:55 | Lab 01: Explore Demo Apps | |
| 102 | +| 0:55 – 1:30 | Lab 02: PSRule | |
| 103 | +| 1:30 – 2:00 | Lab 03: Checkov | |
| 104 | +| 2:00 – 2:15 | Break | |
| 105 | +| 2:15 – 2:45 | Lab 06: SARIF + GitHub Security Tab (or Lab 06-ADO) | |
| 106 | + |
| 107 | +### Full-Day (7 hours) |
| 108 | + |
| 109 | +| Time | Activity | |
| 110 | +|------|----------| |
| 111 | +| 0:00 – 0:30 | Lab 00: Prerequisites | |
| 112 | +| 0:30 – 0:55 | Lab 01: Explore Demo Apps | |
| 113 | +| 0:55 – 1:30 | Lab 02: PSRule | |
| 114 | +| 1:30 – 2:00 | Lab 03: Checkov | |
| 115 | +| 2:00 – 2:40 | Lab 04: Cloud Custodian | |
| 116 | +| 2:40 – 2:55 | Break | |
| 117 | +| 2:55 – 3:30 | Lab 05: Infracost | |
| 118 | +| 3:30 – 4:00 | Lab 06: SARIF + GitHub Security Tab | |
| 119 | +| 4:00 – 4:35 | Lab 06-ADO: SARIF + ADO Advanced Security | |
| 120 | +| 4:35 – 4:50 | Break | |
| 121 | +| 4:50 – 5:35 | Lab 07: GitHub Actions + Cost Gates | |
| 122 | +| 5:35 – 6:25 | Lab 07-ADO: ADO Pipelines + Cost Gates | |
73 | 123 |
|
74 | 124 | ## Lab Dependency Diagram |
75 | 125 |
|
@@ -110,25 +160,13 @@ graph LR |
110 | 160 | | Full-Day (ADO) | ADO | 00–05, 06-ADO, 07-ADO | ~7.75 hours | Yes | |
111 | 161 | | Full-Day (Dual) | Both | 00–05, 06, 06-ADO, 07, 07-ADO | ~9.25 hours | Yes | |
112 | 162 |
|
113 | | -## Prerequisites |
114 | | - |
115 | | -- **GitHub account** with access to create repositories |
116 | | -- **Azure subscription** (required for Labs 04, 05, 07; free tier works) |
117 | | -- **VS Code** with the Bicep and PowerShell extensions |
118 | | -- **Tools** (installed during Lab 00): |
119 | | - - Azure CLI |
120 | | - - GitHub CLI |
121 | | - - PowerShell 7+ |
122 | | - - PSRule and PSRule.Rules.Azure module |
123 | | - - Checkov (`pip install checkov`) |
124 | | - - Cloud Custodian (`pip install c7n c7n-azure`) |
125 | | - - Infracost CLI |
126 | | - |
127 | 163 | ## Getting Started |
128 | 164 |
|
129 | | -1. **Use this template** — Click [Use this template](https://github.com/devopsabcs-engineering/finops-scan-workshop/generate) to create your own copy. |
130 | | -2. **Install prerequisites** — Follow [Lab 00](labs/lab-00-setup.md) to set up your environment. |
131 | | -3. **Start scanning** — Work through the labs sequentially, beginning with [Lab 01](labs/lab-01.md). |
| 165 | +1. **Fork or use this template** to create your own workshop instance. |
| 166 | +2. Complete [Lab 00: Prerequisites](labs/lab-00-setup.md) to set up your environment. |
| 167 | +3. Work through the labs in order — each lab builds on the previous one. |
| 168 | + |
| 169 | +> **Tip**: This workshop is designed for GitHub Codespaces. Click **Code → Codespaces → New codespace** to get a pre-configured environment with all tools installed. |
132 | 170 |
|
133 | 171 | ## License |
134 | 172 |
|
|
0 commit comments