Chapter 05 / Adopt

Six steps. One quarter.

Most FinOps teams complete UFMS adoption in six weeks. The rollout is sequential by design: each step unblocks the next. By the end you have full label coverage, a unit-cost dashboard, and a public proof of conformance.

Timeline

01

Week 1

02

Week 2

03

Week 2

04

Weeks 3-4

05

Week 5

06

Week 6

01Week 1

Inventory and assign cost centers

Pull the full account / project list from your cloud billing export. Map each one to a four-digit cost-center code following the format cc-NNNN. Park the registry in version control.

Deliverable

A signed-off cost-center registry committed to your repo.

cost-centers.json

{
  "cc-1001": {"name": "Engineering",    "owner": "platform-eng-lead"},
  "cc-1002": {"name": "AI Research",    "owner": "ai-lead"},
  "cc-1003": {"name": "Finance",        "owner": "cfo"},
  "cc-1004": {"name": "Customer Ops",   "owner": "coo"},
  "cc-1005": {"name": "Marketing",      "owner": "cmo"}
}

02Week 2

Adopt the canonical key set

Update Terraform / Bicep / Pulumi modules so every newly-provisioned resource carries the full UFMS label set. Use module defaults for the inheritable keys (ifo4_org, ifo4_platform, ifo4_owner, ifo4_env, ifo4_product, ifo4_app).

Deliverable

A Terraform module that fails the plan if any required tag is unset.

modules/ufms-defaults/main.tf

variable "cc"      { type = string }
variable "svc"     { type = string }
variable "lifecycle" { default = "new" }
variable "unit"    { type = string }

locals {
  ufms_labels = {
    ifo4_cc        = var.cc
    ifo4_org       = "ifo4"
    ifo4_app       = var.app
    ifo4_svc       = var.svc
    ifo4_owner     = var.owner
    ifo4_env       = var.env
    ifo4_platform  = "ifo4"
    ifo4_lifecycle = var.lifecycle
    ifo4_product   = var.product
    ifo4_unit      = var.unit
  }
}

03Week 2

Wire the validator into CI

Run ufms-validate in pre-merge CI. Wire it into pull-request status checks. Configure it to read the Terraform plan JSON so it catches missing or malformed labels before any apply.

Deliverable

A required CI status check that blocks merge on any UFMS error.

.github/workflows/ufms.yml

name: UFMS gate
on: [pull_request]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -fsSL https://get.ifo4.org/ufms | sh
          terraform plan -out plan.bin
          terraform show -json plan.bin > plan.json
          ufms-validate --terraform-plan plan.json --fail-on-missing

04Weeks 3-4

Backfill existing resources

Run the auto-tagger across all clouds. It reads project metadata, naming conventions, IAM bindings, and prior tags to infer reasonable ifo4_* values and applies them as ifo4_managed_by=ufms-auto-tagger. Review the diff in a dry-run before the apply.

Deliverable

An auto-tagging dry-run report and an apply run with under 0.5% drift.

auto-tag.sh

#!/usr/bin/env bash
set -euo pipefail

# Dry run first - prints diff, no writes
ufms-auto-tagger \
  --gcp-project ifo4-production \
  --aws-account 123456789012 \
  --inventory-file ./inventory.json \
  --dry-run > drift-report.json

# Review drift-report.json with a human, then:
ufms-auto-tagger \
  --gcp-project ifo4-production \
  --aws-account 123456789012 \
  --inventory-file ./inventory.json \
  --apply

05Week 5

Build the unit-cost view

With UFMS labels flowing into your billing export, you can join cost rows to traffic rows by ifo4_unit. The unit_metrics view computes cost-per-unit nightly. Surface it in a dashboard finance and engineering both look at.

Deliverable

A dashboard with cost-per-unit for every product and every service.

sql/unit_metrics.sql

CREATE OR REPLACE VIEW unit_metrics AS
SELECT
  DATE(usage_start_time)            AS day,
  labels.value                      AS ifo4_product,
  labels2.value                     AS ifo4_unit,
  SUM(cost)                         AS cost_usd,
  SUM(usage_count)                  AS units,
  SAFE_DIVIDE(SUM(cost), SUM(usage_count)) AS cost_per_unit
FROM billing_export
LEFT JOIN UNNEST(labels) AS labels  ON labels.key  = 'ifo4_product'
LEFT JOIN UNNEST(labels) AS labels2 ON labels2.key = 'ifo4_unit'
WHERE DATE(usage_start_time) >= DATE_SUB(CURRENT_DATE(), INTERVAL 90 DAY)
GROUP BY day, ifo4_product, ifo4_unit;

06Week 6

Earn the badge

Run the conformance attestation. It samples your billing export, validates the label set on every line item, and signs a proof. Submit the proof to the IFO4 Standards Council and your organization appears in the registry of UFMS-Compliant organizations.

Deliverable

A signed conformance proof and a registry listing on standards.ifo4.org.

attest.sh

# Generate the conformance proof
ufms-attest \
  --org-slug acme \
  --billing-export gs://acme-billing/2026-04 \
  --output proof.json

# Submit to the Standards Council
curl -X POST https://standards.ifo4.org/api/ufms/attestations \
  -H "Authorization: Bearer $IFO4_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @proof.json

# Receive your registry listing within 5 business days.

Earn the badge

UFMS-Compliant. Publicly listed.

Submit a signed conformance proof. The Standards Council verifies, signs, and lists your organization on the public registry. Re-attestation runs annually. Loss-of-conformance triggers a 30-day grace window before the listing is removed.

Submit attestation See the registry

IFO4

Chapter 05 / Adopt

Six steps. One quarter.

Timeline

01

Week 1

02

Week 2

03

Week 2

04

Weeks 3-4

05

Week 5

06

Week 6

01Week 1

Inventory and assign cost centers

Pull the full account / project list from your cloud billing export. Map each one to a four-digit cost-center code following the format cc-NNNN. Park the registry in version control.

Deliverable

A signed-off cost-center registry committed to your repo.

cost-centers.json

{
  "cc-1001": {"name": "Engineering",    "owner": "platform-eng-lead"},
  "cc-1002": {"name": "AI Research",    "owner": "ai-lead"},
  "cc-1003": {"name": "Finance",        "owner": "cfo"},
  "cc-1004": {"name": "Customer Ops",   "owner": "coo"},
  "cc-1005": {"name": "Marketing",      "owner": "cmo"}
}

02Week 2

Adopt the canonical key set

Deliverable

A Terraform module that fails the plan if any required tag is unset.

modules/ufms-defaults/main.tf

variable "cc"      { type = string }
variable "svc"     { type = string }
variable "lifecycle" { default = "new" }
variable "unit"    { type = string }

locals {
  ufms_labels = {
    ifo4_cc        = var.cc
    ifo4_org       = "ifo4"
    ifo4_app       = var.app
    ifo4_svc       = var.svc
    ifo4_owner     = var.owner
    ifo4_env       = var.env
    ifo4_platform  = "ifo4"
    ifo4_lifecycle = var.lifecycle
    ifo4_product   = var.product
    ifo4_unit      = var.unit
  }
}

03Week 2

Wire the validator into CI

Run ufms-validate in pre-merge CI. Wire it into pull-request status checks. Configure it to read the Terraform plan JSON so it catches missing or malformed labels before any apply.

Deliverable

A required CI status check that blocks merge on any UFMS error.

.github/workflows/ufms.yml

name: UFMS gate
on: [pull_request]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -fsSL https://get.ifo4.org/ufms | sh
          terraform plan -out plan.bin
          terraform show -json plan.bin > plan.json
          ufms-validate --terraform-plan plan.json --fail-on-missing

04Weeks 3-4

Backfill existing resources

Deliverable

An auto-tagging dry-run report and an apply run with under 0.5% drift.

auto-tag.sh

#!/usr/bin/env bash
set -euo pipefail

# Dry run first - prints diff, no writes
ufms-auto-tagger \
  --gcp-project ifo4-production \
  --aws-account 123456789012 \
  --inventory-file ./inventory.json \
  --dry-run > drift-report.json

# Review drift-report.json with a human, then:
ufms-auto-tagger \
  --gcp-project ifo4-production \
  --aws-account 123456789012 \
  --inventory-file ./inventory.json \
  --apply

05Week 5

Build the unit-cost view

Deliverable

A dashboard with cost-per-unit for every product and every service.

sql/unit_metrics.sql

CREATE OR REPLACE VIEW unit_metrics AS
SELECT
  DATE(usage_start_time)            AS day,
  labels.value                      AS ifo4_product,
  labels2.value                     AS ifo4_unit,
  SUM(cost)                         AS cost_usd,
  SUM(usage_count)                  AS units,
  SAFE_DIVIDE(SUM(cost), SUM(usage_count)) AS cost_per_unit
FROM billing_export
LEFT JOIN UNNEST(labels) AS labels  ON labels.key  = 'ifo4_product'
LEFT JOIN UNNEST(labels) AS labels2 ON labels2.key = 'ifo4_unit'
WHERE DATE(usage_start_time) >= DATE_SUB(CURRENT_DATE(), INTERVAL 90 DAY)
GROUP BY day, ifo4_product, ifo4_unit;

06Week 6

Earn the badge

Deliverable

A signed conformance proof and a registry listing on standards.ifo4.org.

attest.sh

# Generate the conformance proof
ufms-attest \
  --org-slug acme \
  --billing-export gs://acme-billing/2026-04 \
  --output proof.json

# Submit to the Standards Council
curl -X POST https://standards.ifo4.org/api/ufms/attestations \
  -H "Authorization: Bearer $IFO4_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @proof.json

# Receive your registry listing within 5 business days.

Earn the badge

UFMS-Compliant. Publicly listed.

Submit attestation See the registry