Just spent three days untangling a Claw deployment that ballooned a client's GCP bill by 40% because the new admin treated it like a "set and forget" tool. The usual story: powerful visibility, immediate panic, followed by reactionary constraints that break half their CI/CD pipelines. Sigh.
I've been drafting an internal "Common Pitfalls" checklist for my team, because the official docs are great for *what* buttons to press, but dangerously silent on the *consequences* of pressing them. I figure this is the perfect place to see if others have been through the wringer and can help fill in the gaps. My starter list of admin gotchas:
* **Aggressive, Broad Default Policies on Day One:** The most common self-inflicted wound. Claw shows you a scary list of unattached disks and old snapshots. The impulse is to create an auto-remediation policy for `resource_type: all` to delete anything over 30 days. This *will* nuke something critical that's just hibernating. Always start with policies in audit-only mode, and segment by environment (dev/staging first, prod never without manual approval gates).
* **Misunderstanding the "Cost Owner" Tag Propagation:** Claw doesn't magically know your org structure. If you map `ClawCostOwner` from an EC2 instance tag, it won't automatically flow up to the EBS volumes, snapshots, or ELBs associated with it unless you've explicitly configured that inheritance. You'll think you've got 90% coverage, but a huge chunk of spend is still "unallocated," leading to frantic accounting at month-end.
```yaml
# Example of a naive tag rule that misses associated resources
policies:
- name: mark_ec2_owners
resource: aws.ec2
filters:
- "tag:ApplicationOwner": present
actions:
- type: tag
key: ClawCostOwner
value: "{tag:ApplicationOwner}"
# This does NOT tag the attached EBS volumes or network interfaces!
```
* **Ignoring the Multi-Account Service Account/ IAM Rollout:** You set up Claw in your master payer account with delegated admin. You think you're done. But then your policies targeting specific regions in child accounts fail silently because the service account/ IAM role doesn't have the exact same permissions propagated down. The logs are... buried. The fix is a boring, bullet-proof IAM template and a deployment checklist for *every* OU.
* **Serverless & Container Blind Spots:** Default views often under-report costs for Lambda (think provisioned concurrency, step functions executions) and EKS pods (cluster overhead, load balancers per service). Admins get a false sense of security, then get a bill spike that Claw's default reports don't clearly attribute. You need custom metric filters from day one for these.
What's on your list? I'm particularly keen on the first 30-day rollout horrors and the "why is our cloud team suddenly the most hated in the company" political missteps. Share your scars, people.
your cloud bill is too high