Spacelift Terraform cost estimation: cost in the run, gated by policy

Quick answer

Spacelift runs Terraform with hooks and Open Policy Agent policies, so you can price the plan in a before or after hook and enforce a budget with a plan policy that rejects the run when the estimate is too high. The estimator reads the plan Spacelift already produces, so cost and a budget gate live directly in the stack run.

Spacelift is a managed Terraform runner built around policy-as-code, which makes it a natural home for cost gating. It already produces a plan on every run and evaluates OPA policies against it, so adding cost is a matter of pricing the plan and writing a policy that acts on the number.

Price the plan in a hook

Spacelift stacks support lifecycle hooks that run shell commands around the plan and apply phases. In an after-plan hook, convert the plan to JSON and run the estimator (for example c3x estimate --path plan.json), writing the monthly cost where the run and any policy can see it. The plan is already generated, so the hook just consumes it.

Gate with a plan policy

Spacelift plan policies, written in Rego for Open Policy Agent, can deny a run based on plan data. Feed the estimated cost into the policy input and write a rule that rejects the run when the monthly total, or the delta, exceeds a budget. This is the cost policy-as-code approach, enforced natively by Spacelift rather than a custom CI script.

Advisory first

As with any budget gate, start advisory: surface the cost on every run without blocking, so the team sees the number and trusts it. Once it is trusted, switch the policy to deny over-budget runs, the budget-guardrail pattern with Spacelift policies doing the enforcement.

Self-hosted and worker pools

Spacelift can run on your own worker pools, where the estimator needs only the plan file and a pricing catalog. Point it at a self-hosted catalog and cost estimation runs inside your network with no external dependency.

FAQ

How do I add cost estimation to Spacelift?

Price the plan in an after-plan hook by converting it to JSON and running the estimator, then enforce a budget with a Spacelift plan policy in Rego that denies the run when the estimate is too high. The plan is already produced by the stack run.

Can Spacelift block a run that is over budget?

Yes, with a plan policy. Spacelift evaluates Open Policy Agent policies against plan data, so a rule that reads the estimated cost and denies runs over a threshold blocks an over-budget change natively, without a custom CI script.

Where does the cost estimate come from in Spacelift?

From the plan Spacelift already generates. An after-plan hook converts the plan to JSON and runs the estimator against it, so no extra plan is needed and the estimation adds only seconds.

Does Spacelift cost estimation need cloud credentials?

No. Estimation reads the plan JSON and prices it against a catalog, so it never calls your cloud account. On self-hosted worker pools it needs only the plan file and a pricing catalog, which can be self-hosted.

How do I roll out cost gating in Spacelift safely?

Start advisory: surface the cost on every run without blocking, so the team trusts the number. Then switch the plan policy to deny over-budget runs. This mirrors the budget-guardrail pattern, with Spacelift policies doing the enforcement.

Does C3X work with Spacelift?

Yes. C3X is a CLI that prices a Terraform plan against a live catalog, so it runs in a Spacelift hook, and its output feeds a Rego plan policy for budget enforcement. It also self-hosts for private worker pools.

What to do next

Wire cost into your stack policies. C3X prices your Terraform plan against a live catalog and feeds a budget policy. Start with the quickstart and the CI/CD guide.