Jenkins Terraform cost estimation: cost checks in your pipeline

Quick answer

Add a stage after terraform plan that converts the plan to JSON and prices it. Post the monthly cost to the pull request via your SCM API, and exit non-zero past a budget so the stage, and a required build, fails. It reuses the plan you already generate, needs no cloud credentials to estimate, and runs air-gapped on self-hosted Jenkins.

Jenkins is where a lot of Terraform still ships, especially in enterprises with self-hosted controllers. The same shift-left idea applies: put the cost in the review, so an expensive change is caught in the pipeline instead of on the bill.

Estimate from the plan

Produce the plan, convert to JSON, price it, the resolved output is the most accurate input, for the reasons in plan JSON cost estimation.

terraform init -input=false
terraform plan -out=tf.plan -input=false
terraform show -json tf.plan > plan.json
c3x estimate --path plan.json

A declarative Jenkinsfile

pipeline {
  agent any
  stages {
    stage('Plan') {
      steps {
        sh '''
          terraform init -input=false
          terraform plan -out=tf.plan -input=false
          terraform show -json tf.plan > plan.json
        '''
      }
    }
    stage('Estimate') {
      steps {
        sh 'c3x estimate --path plan.json --budget 500 --format markdown > cost.md'
        // post cost.md to the PR via your SCM API using stored credentials
      }
    }
  }
}

Gate the build on a budget

The --budget flag exits non-zero when the monthly total crosses the line, failing the Estimate stage and the build. Mark that build as a required check on your PR provider and the over-budget change can't merge, the budget-guardrail pattern in Jenkins terms.

Post the cost to the PR

Jenkins already holds SCM credentials, so post the estimate as a comment or status via the GitHub, GitLab, or Bitbucket API. Comment the monthly total and the delta versus the base branch, and update one comment in place rather than stacking new ones each build.

Self-hosted and air-gapped

On a self-hosted controller the estimation stage needs only the plan file and a pricing catalog. Point it at a self-hosted catalog and it runs air-gapped, with no outbound internet.

FAQ

Where in a Jenkins pipeline should cost estimation run?

In a stage right after terraform plan, on pull-request or branch builds. Generate the plan, convert it to JSON, and price it. The plan has resolved variables and modules, so its JSON is the most accurate input.

How do I fail the build when a change is over budget?

Have the estimator exit non-zero past a budget threshold. In a declarative pipeline the failing sh step fails the stage and the build; wire that build as a required status on your PR provider so an over-budget change can't merge.

Can Jenkins post the cost back to the pull request?

Yes, via your SCM's API, GitHub, GitLab, or Bitbucket, using the credentials Jenkins already has. Post the monthly total and the delta versus the base branch as a PR comment or status check, so reviewers see the cost next to the diff.

Does it work on agents without cloud credentials?

The plan stage needs your existing cloud credentials; the estimation stage does not. Estimation reads the plan JSON and prices it against a catalog, so it never calls your cloud account and can run on a restricted agent.

Will it slow the pipeline down?

No. A static estimate runs in seconds and reuses the plan you already produce. Run it as its own stage or in parallel with validate, it adds seconds, not minutes.

Can it run air-gapped on self-hosted Jenkins?

Yes. Point the estimator at a self-hosted pricing catalog and it runs with no outbound internet, which suits self-hosted Jenkins in restricted networks.

What to do next

Add the stage to one pipeline and watch the cost land in the build. C3X reads your Terraform plan, prices the resources against a live catalog, and reports the monthly cost with optional budget gating, free and self-hostable. Start with the quickstart and the CI/CD guide.