The set of policies and controls used to manage the full cost footprint of a Databricks deployment. It extends beyond usage charges to include compute, storage, networking, workspace overhead, and the identities that are allowed to create and retain those resources.
Expanded Definition
Databricks Cloud Cost Governance is the discipline of controlling who can create, scale, retain, and delete Databricks resources, and how those choices affect the full cloud bill. It covers compute, storage, networking, workspace overhead, and the identity layer that authorises those costs. In practice, this means cost policy and NHI governance must be treated as one control plane, not separate finance and security concerns.
Definitions vary across vendors, but the operational standard is clear: cost governance is stronger when privilege boundaries, provisioning rules, and lifecycle controls are enforced together. That aligns closely with the intent of NIST Cybersecurity Framework 2.0, especially where asset management, access control, and monitoring intersect. It also matches NHIMG guidance on the Top 10 NHI Issues and the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs, where identity sprawl directly becomes spend sprawl.
The most common misapplication is treating cloud cost governance as a budgeting exercise alone, which occurs when teams track usage charges but ignore over-permissioned identities that can create long-lived, expensive resources.
Examples and Use Cases
Implementing Databricks Cloud Cost Governance rigorously often introduces more approval and policy friction, requiring organisations to weigh speed of experimentation against the cost of uncontrolled resource growth.
- A data science team can be allowed to start ephemeral clusters, but only through approved service identities with auto-termination and budget-tag enforcement.
- A platform team can restrict workspace creation to a small set of controlled identities, reducing shadow workspaces that accumulate storage, logs, and orphaned compute.
- A FinOps group can monitor idle jobs and oversized clusters, while an IAM team reviews the service accounts that are permitted to launch them.
- A security team can require just-in-time access for privileged administrative actions, limiting the identities that can approve high-cost infrastructure changes.
- After an incident, investigators can correlate excessive spend with a newly created NHI, then trace whether permissions, tokens, or automation pipelines enabled the resource growth.
These patterns map to broader cloud governance and NHI control themes described in Ultimate Guide to NHIs — Regulatory and Audit Perspectives and are consistent with Databricks-style operational controls that should be measured against framework expectations such as the NIST Cybersecurity Framework 2.0.
Why It Matters in NHI Security
Cost governance becomes an NHI security issue because the same identities that create legitimate workloads can also create unbounded financial exposure. When service principals, automation tokens, or workspace admins are over-privileged, they can generate clusters, storage, and external integrations that persist beyond business need. NHIMG research shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, making lifecycle control and spend control inseparable in cloud environments. That risk shows up plainly in incidents such as the Azure Key Vault privilege escalation exposure and the 230M AWS environment compromise, where identity misuse can quickly translate into operational and financial damage.
NHIMG analysis also shows only 1.5 out of 10 organisations are highly confident in securing NHIs, which helps explain why uncontrolled cloud spend often coexists with weak identity governance. Organisations typically encounter runaway Databricks costs only after an access review, billing spike, or post-incident investigation, at which point Databricks Cloud Cost Governance becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Cost sprawl often stems from weak secret and identity lifecycle controls. |
| NIST CSF 2.0 | PR.AC-4 | Access management governs which identities may provision or expand spend-bearing resources. |
| NIST Zero Trust (SP 800-207) | Zero trust requires continuous verification before identities can invoke costly actions. | |
| NIST SP 800-63 | AAL2 | Assurance levels inform how strongly privileged automation identities should be protected. |
| NIST AI RMF | AI risk management applies where agentic automation can trigger cloud spend. |
Use stronger authentication for identities that can create or manage billing-impacting assets.
Related resources from NHI Mgmt Group
- Why do non-human identities complicate sovereign cloud governance?
- How should regulated teams evaluate cloud-private identity governance platforms?
- When does a cloud identity platform create more governance risk than it reduces?
- Should organisations modernise ERP governance before moving systems to cloud applications?
