All Tools View Categories About Contact Privacy

Terraform Cost Policy Guardrail (Prevent Overspend)

Generate a cost guardrail checklist, Terraform check block and OPA Rego policy. Nothing is uploaded.

Runs entirely in your browser - nothing is uploaded and no cloud connection is made.
0
lines generated
Your generated cost guardrail will appear here.

About Terraform Cost Policy Guardrail (Prevent Overspend)

An overspend guardrail stops runaway infrastructure before it is applied. The Cost Policy Guardrail Generator emits a checklist, a Terraform check block and an OPA Rego policy from a simple form, so you can gate plans on estimated monthly cost without writing policy by hand. The three outputs describe the same rule in different formats: a human checklist, a native Terraform check that fails a plan, and a Rego policy you can run in Conftest or OPA during CI.

Set a monthly budget, an alert threshold and an enforcement mode (deny or warn), then optionally cap individual resource types. The deny mode hard-blocks an apply that would exceed the budget, while warn mode surfaces the violation without blocking, which is useful while you tune budgets. The output combines a Terraform check block with an OPA Rego policy that reads an estimate such as Infracost output or a Terraform variable.

Input is validated and errors are reported inline, for example when the budget is not positive or the threshold is outside one to one hundred percent. Everything runs locally with nothing uploaded, so your budget numbers and resource topology never leave the browser. Use the generated pieces as a starting point, then wire the estimate into your pre-apply step.

The guardrail also documents intent. The generated checklist is something you can paste into a pull request description or a runbook so reviewers see the cost rules that apply to the change, not just the policy code. That shared context makes budget conversations happen earlier and with less friction, because the limit and its threshold are stated in plain language next to the infrastructure.

Adopting a guardrail early changes behaviour. When engineers know a plan will fail above a budget, they right-size instances, drop unused disks and question expensive defaults during authoring rather than after the bill arrives. The tool makes that feedback loop cheap to set up, which is the point: a small, clear rule that runs everywhere is better than a perfect policy nobody wires in.

Features

  • Budget gate - block or warn on overspend.
  • Alert threshold - warn before hitting the hard cap.
  • Per-type caps - optional resource-type monthly limits.
  • Terraform check block - generated with valid HCL.
  • OPA Rego policy - ready for Conftest / OPA.
  • Provider aware - aws, gcp or azure selection.
  • Custom message - your own violation text.
  • Live stats - a count of generated lines.
  • Documented intent - the checklist explains the rule in plain language.
  • Threshold note - shows the dollar value of the alert percent.
  • JSON export - copy the guardrail config as JSON.
  • Cheap to adopt - one form produces runnable policy.
  • Copy / Download / Print - get guardrail.md wherever you need it.

How to Use

  1. Set the monthly budget in USD and the alert threshold as a percent.
  2. Pick the provider and the enforcement mode (deny or warn).
  3. Write a violation message or keep the default.
  4. Optionally add per-type caps - one row per resource type and its monthly max.
  5. Generate the guardrail checklist, check block and Rego.
  6. Copy, copy as JSON or download the result.
  7. Review the checklist in the pull request so reviewers see the budget rule.
  8. Drop the check block into a .tf and the Rego into a policy directory.
  9. Wire the estimate into your pre-apply or CI step.

Examples

Example 1 - hard block at $1000. budget 1000, deny, so any estimate above the limit fails the run before apply.

Example 2 - warn at 80%. budget 2000, threshold 80, warn, so a $1700 estimate warns at $1600 but still applies.

Example 3 - per-type caps. aws_instance max 500 and aws_rds_cluster max 800 record individual ceilings in the checklist.

Example 4 - custom message. set a message that names the budget owner so the failure is actionable in a pipeline log.

Example 5 - gcp warn. provider gcp, budget 2000, warn, so a non-aws stack still gets a guardrail.

Example 6 - azure deny. provider azure, budget 1500, deny, with a cap on azurerm_virtual_machine.

Example 7 - multi-cap. several per-type rows produce a checklist that documents every ceiling at a glance.

Benefits

  • Two policy formats - Terraform check and Rego from one form.
  • Flexible - budget, threshold, caps and enforcement.
  • Prevents surprises - catch overspend at plan time, not in the bill.
  • Validated input - clear error messages before generation.
  • CI ready - Rego runs in Conftest alongside other checks.
  • Shared context - the checklist travels with the change.
  • Cross-cloud - works for aws, gcp and azure.
  • Behaviour change - cheap feedback encourages right-sizing.
  • Private - nothing leaves the browser.
  • Portable - copy, download, export JSON or print the guardrail.

Frequently Asked Questions

What does this guardrail do?
It produces a checklist, a Terraform check block and an OPA Rego policy that block (or warn on) an apply when the estimated monthly cost exceeds an approved budget.
Where does the cost estimate come from?
The generated policy reads an estimate such as Infracost output (input.cost.monthly) or a Terraform variable (var.monthly_cost_estimate). Wire it into your pre-apply step.
deny vs warn?
deny fails the run so overspend cannot be applied; warn surfaces the violation without blocking, useful while tuning budgets.
Can I cap per-resource-type cost?
Yes. Add rows for a resource type and its monthly cap; the checklist records each cap and the policy can be extended to enforce them.
Does this connect to a cloud or upload anything?
No. The guardrail is assembled entirely in your browser and nothing is uploaded.
Can I download it?
Yes. Copy the output, download guardrail.md, or print it.