IaC Cost Estimation
See the dollar impact of a Terraform change before it merges — CostLens prices your plan and posts the delta straight to the pull request.
Every Terraform pull request changes what your infrastructure costs — but that's usually invisible until the change is live and the bill arrives. IaC Cost Estimation prices the change while it's still a pull request: CostLens reads your terraform plan, prices every resource being added, changed, or destroyed, and posts the monthly and annual dollar impact directly on the PR, before anyone clicks merge.
How it helps
- See the cost of a change before it ships, not after the next invoice.
- Reviewers get the number right where they're already looking, in the PR, with no separate dashboard to check.
- An optional policy gate can flag or block a PR that would push spend past a budget, without CostLens ever touching your merge settings itself.
- Catches easy wins automatically — an oversized instance type or an old-generation disk gets flagged as a pre-deploy recommendation, before it's ever provisioned.
How it works
- CostLens watches for pull requests that touch Terraform. Once connected, it's triggered by your repository's own pull-request webhook — CostLens filters to PRs that change
.tf,.tfvars, or plan files. - Your CI runs the plan — CostLens prices it. CostLens doesn't run
terraform planitself; your existing CI pipeline does that, as it already does today, with one small step added to send the result to CostLens. CostLens reads the plan, prices every resource against its rate card, and runs a handful of pre-deploy checks — like flagging a gp2 volume or an over-provisioned instance type — all within a few seconds. - A comment appears on the PR. One comment, kept up to date as you push more commits: the monthly and annual delta, a line-by-line breakdown per resource, any pre-deploy recommendations, and a link back into CostLens for the full detail.
- A pass/fail check, if you want one. If you've turned on the policy gate, CostLens also posts a commit status —
CostLens / cost impact— that you can mark as a required check in your own branch protection settings.
CostLens never runs your Terraform
Only your CI ever executes terraform plan — CostLens receives the resulting plan output, prices it, and never holds credentials to run infrastructure changes on its own. It also never merges a pull request, pushes to your default branch, or changes your branch-protection rules — the gate is a commit status you choose whether to require.
Setting it up
- Connect GitHub or GitLab. See Git Integration if you haven't already.
- Go to IaC Estimates in the sidebar and create a webhook for the repository — CostLens gives you a signed URL and a one-time secret.
- Add that webhook URL in your repository's own settings (GitHub: Settings → Webhooks; GitLab: Settings → Webhooks).
- Add one step to your existing CI pipeline that sends the plan to CostLens — the exact snippet for your CI is generated for you on the IaC Estimates page, ready to paste in.
That's it — the next pull request that touches Terraform gets a comment.
What you'll see
IaC Estimates (the main page) lists every analyzed pull request — repository, PR number (linked straight to the PR), monthly delta, gate outcome, and when it ran. A Guardrails panel spells out the hard limits on this whole feature, matching the callout above: CostLens never merges, never runs Terraform itself, and the cost-impact status check is off by default.
Click into any pull request for the full picture: the total delta and projected monthly cost, the gate result and why, a per-resource breakdown (what changed, its cost delta, and a note when a figure couldn't be priced), and any pre-deploy recommendations it caught.
What gets priced
| Priced with a real dollar figure | AWS EC2 instances, EBS volumes, RDS databases, Elastic IPs, and load balancers · Azure virtual machines, managed disks, public IPs, and load balancers · GCP compute instances and static IPs |
| Flagged as usage-based (cost depends on usage, never shown as $0) | S3, Lambda, DynamoDB, NAT gateways, CloudWatch Logs, and similar consumption-billed services across all three clouds |
| Unpriced | Everything else — counted in the resource breakdown, never guessed at |
The policy gate
Off by default. Turn it on from IaC Estimates and choose:
- Mode — Fail (blocks the check) or Warn (flags it without failing).
- A monthly dollar threshold — flag any PR that would add more than a set amount per month.
- A budget tie-in — flag a PR if it would push spend past a percentage of one of your CostLens budgets.
- Unaddressed savings — flag a PR that ignores pre-deploy recommendations worth more than a set amount.
Turning this on only adds the CostLens / cost impact commit status to the pull request — to actually have it block a merge, mark it as a required check in your repository's own branch protection settings. CostLens never changes that setting for you.
Per-repository policies
The policy you configure in CostLens applies organization-wide. Setting a different policy for one specific repository is available today through the CostLens API — open a support case if you'd like help setting one up.
What's not supported yet
Bitbucket, Pulumi, OpenTofu, and CloudFormation aren't supported — Terraform on GitHub or GitLab only, for now.