Infrastructure as code and cost review, moved left.

Here is how to build the loop: the estimate that runs on every plan, the policies worth enforcing, and the review cadence that keeps drift from creeping back in.

Why review cost in code rather than on the bill?

Cloud cost is decided long before the invoice arrives. The instance family, the storage class, the redundancy setting, and the data transfer path are all chosen in a configuration file and then provisioned automatically. By the time spend shows on the Cost and Usage Report on AWS or the equivalent export on Azure, GCP, and OCI, the decision is already in production and the cost has already accrued. Reviewing cost in code closes that gap. The reviewer sees that a change adds a projected amount per month at the same moment they review the logic, while the change is still a diff rather than a running fleet. The fix is editing a line, not raising a change request against live infrastructure.

This is also where waste compounds. Infrastructure as code exists to make patterns repeatable, which means a default that is slightly too large, a volume on the wrong storage tier, or a NAT gateway placed in every subnet gets copied everywhere the module is used. The review gate is the single point where one correction fixes every future instance of the pattern.

What does a cost estimate in the pull request look like?

The pattern is consistent across the four clouds. A continuous integration step runs the plan, a cost estimator reads the planned resources and prices them against the current provider list rates, and the result posts as a comment showing the monthly delta this change introduces. A reviewer approving a change that adds a meaningful monthly amount now does so knowingly rather than blindly.

The estimate is indicative, not a bill: it uses list pricing and assumes steady state, so it will not reflect Savings Plans, Reservations, Committed Use Discounts, or Universal Credits coverage, nor usage based services priced per request. Treat the number as a directional signal that flags large changes for human judgement, not as a forecast. Even as a directional signal it does the main job, which is making an invisible cost visible at the cheapest possible moment to change it.

Which policies are worth enforcing at merge?

Policy as code engines let you turn cost hygiene into automated checks that block a merge when a rule fails. The highest value rules are simple and few.

• Mandatory ownership tags. Block any resource without an owner, environment, and cost centre tag. This is the single rule that makes every downstream allocation, showback, and anomaly alert possible, because untagged spend cannot be attributed to anyone.
• Instance and storage guardrails. Flag instance families above an agreed size, storage provisioned on premium tiers without justification, and volumes without lifecycle rules. On AWS that includes nudging gp2 volumes to gp3 and steering general workloads toward Graviton; equivalent guardrails apply per cloud.
• Expensive by default resources. Require explicit sign off for the quiet budget eaters: a NAT gateway in every availability zone, cross region replication, provisioned throughput, and always on premium support tiers of managed services.
• Environment scaling. Enforce that non production environments cannot provision production sized capacity, and that dev and test resources carry a shutdown schedule.

Keep the rule set short. A policy gate that blocks ten merges a day for trivial reasons gets disabled within a week; a gate that blocks the genuinely expensive mistakes earns its place and stays on.

A worked example

How often should code based cost rules be reviewed?

Provider pricing, instance families, and discount instruments change through the year, so the estimator's price data and the policy rules both need a cadence. A quarterly review of the guardrails keeps them aligned with current list rates and with new generation instances worth defaulting to, such as a newer Graviton family on AWS or a new flexible compute shape on OCI. The review also prunes rules that no longer fire and adds ones for new patterns the estate has adopted. This cadence sits inside the wider operating model, where ownership, forecasting, and commitment coverage are governed together rather than as one off projects.

Bring cost review into your delivery pipeline

We help enterprises wire cost estimates and policy gates into infrastructure as code pipelines across AWS, Azure, GCP, and OCI, tied to clean ownership tagging and a sustainable review cadence. We take zero provider commissions and answer only to you. Our guarantee: we reduce your cloud spend or we reimburse our service fee, on either a Fixed Fee or a no risk Gainshare basis. Book a strategy call to scope it for your estate, and follow more in The Cloud Spend Navigator.