Beyond Visibility: Enforcement
Showing engineers the cost is powerful. But for high-stakes environments, you may want to go further: automatically block a Pull Request if the cost increase exceeds a threshold. This is cost policy enforcement.
Infracost supports this natively through its infracost comment command combined with exit codes, and through integration with Infracost Cloud (the SaaS product) which provides a policy engine. For open-source workflows, you can implement threshold checks directly in your CI pipeline.
Implementing a Cost Threshold in CI
The pipeline step is simple in concept: extract the total monthly cost figure from the breakdown's JSON output, compare it against a configured threshold, and fail the step (blocking the merge) if the estimate exceeds it.
Threshold Strategy: Absolute vs. Differential
There are two ways to define cost policies:
Absolute threshold: Block if total monthly cost exceeds $X. Simple, but can be gamed by splitting changes across multiple PRs. Also, a large existing infrastructure will always be near the threshold regardless of the PR's actual impact.
Differential threshold: Block if the PR increases monthly cost by more than $Y. More precise — it measures the marginal impact of the specific change. A PR that adds $50 to a $10,000/month infrastructure is treated differently from a PR that adds $50 to a $100/month infrastructure.
The differential approach is generally preferred because it measures what the engineer actually controls: the cost impact of their specific change.
A nuanced interview question is: "What are the limitations of IaC cost estimation tools like Infracost?" The honest answer acknowledges three gaps: (1) Usage-based costs are estimates — data transfer, Lambda invocations, and API calls depend on runtime traffic that cannot be known at plan time; (2) Discounts are not reflected — Enterprise Discount Programs (EDPs), Reserved Instance commitments, and Savings Plans reduce actual costs below list price, so estimates will be higher than actuals; (3) Shared costs are invisible — support plan fees, third-party marketplace charges, and cross-account shared services do not appear in per-PR estimates. Acknowledging these limitations shows maturity and prevents over-reliance on estimates as ground truth.