Azure DevOps Terraform cost estimation in your pipeline

Quick answer

In your Azure DevOps PR-validation pipeline, add a step after terraform plan that converts the plan to JSON and prices it. Comment the monthly total and the diff on the pull request using System.AccessToken, and exit non-zero past a budget so the required branch policy fails. It runs in seconds and needs no cloud credentials to estimate.

Azure DevOps branch policies already gate merges on build and review. Cost belongs in that same gate: the pipeline that validates a Terraform change is the right place to price it, so an expensive PR is caught before it completes rather than on next month's invoice.

Estimate from the plan

Generate the plan, convert it to JSON, and price that, the resolved output accounts for variables, for_each, and modules, which is why plan JSON is the most accurate input.

terraform init -input=false
terraform plan -out=tf.plan -input=false
terraform show -json tf.plan > plan.json
c3x estimate --path plan.json

A YAML pipeline step

Run on pull requests to the main branch, produce the plan, estimate, and comment. The estimation step uses the pipeline's built-in token to post the comment; no extra secret needed.

trigger: none
pr:
  branches: { include: [ main ] }
pool: { vmImage: ubuntu-latest }
steps:
  - script: |
      terraform init -input=false
      terraform plan -out=tf.plan -input=false
      terraform show -json tf.plan > plan.json
    displayName: Plan
  - script: c3x estimate --path plan.json --budget 500 --format markdown > cost.md
    displayName: Estimate
  - script: |
      # post cost.md to the PR via the REST API using $(System.AccessToken)
      ./scripts/post-pr-comment.sh cost.md
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
    displayName: Comment

Gate the merge with a branch policy

The --budget flag makes the estimator exit non-zero when the monthly total crosses the line, which fails the pipeline. Add that pipeline as a required build validation policy on main, and an over-budget PR can't complete until it's fixed or explicitly approved, the budget-guardrail pattern in Azure DevOps terms.

Self-hosted agents and restricted networks

On a self-hosted agent the estimation step needs only the plan file and a pricing catalog. Point it at a self-hosted catalog and it runs in air-gapped Azure DevOps environments with no outbound internet.

Same pattern, other CI

The plan → JSON → estimate → comment → gate flow is identical in GitHub Actions, GitLab CI, Atlantis, or a Terraform Cloud run task. Only the comment API and YAML change.

FAQ

Where does cost estimation go in an Azure DevOps pipeline?

In the PR-validation pipeline, right after terraform plan. Generate the plan, convert it to JSON, and price it as a following step. Because the plan resolved variables and modules, its JSON is the most accurate input.

How do I comment the cost on a pull request?

Post to the Azure DevOps REST API pull request threads endpoint using the built-in System.AccessToken, or use a marketplace PR-comment task. Comment the monthly total and the delta versus the target branch so reviewers see the cost next to the diff.

How do I block a PR that's over budget?

Have the estimator exit non-zero when the estimate exceeds a threshold, which fails the pipeline. Make the pipeline a required branch policy on the target branch, so the PR can't complete until the cost is brought down or approved.

Does it work with YAML and classic pipelines?

Both. In YAML you add script steps after the plan; in classic pipelines you add command-line tasks. The logic is the same, plan, convert to JSON, estimate, comment, gate.

Do I need service connection credentials to estimate?

You need your existing service connection to run terraform plan. The estimation step itself needs no cloud credentials, it reads the plan JSON and prices it against a catalog, so it never calls Azure, AWS, or GCP.

Can it run on self-hosted agents behind a firewall?

Yes. On a self-hosted agent the estimator only needs the plan file and a pricing catalog, which can be self-hosted. That keeps estimation working in restricted or air-gapped Azure DevOps environments.

What to do next

Add the step to one PR pipeline and watch the cost comment appear. C3X reads your Terraform plan, prices the resources against a live catalog, and comments the monthly cost with optional budget gating, free and self-hostable. The quickstart gets a first estimate going, and the CI/CD guide has the pipeline details.