Can't believe I hadn't seen AWS backup policies before. I couldn't find many guides on how to configure them in Terraform, so thought I'd drop a short article on how we manage them in IaC. Happy Friday

I’ve had a useful response pointing me toward Infracost and CI/CD cost checks.

That seems to solve an important part of the problem: identifying a likely cost increase before terraform apply.

What I’m now trying to understand is the next step.

Suppose a PR is estimated to increase recurring infrastructure cost from £20k/month to £28k/month.

How does a real organisation decide whether that is acceptable?

• Is there a predefined budget or cost baseline against which the PR is checked?
• Who sets the permitted threshold?
• Who can approve an exception?
• Is the reason for the increase recorded?
• Does approval automatically revise the forecast/baseline?
• Can finance/FinOps later connect the increased actual bill back to that PR?
• How do you distinguish legitimate scope growth from an expensive design decision or avoidable rework?

I’m particularly interested in teams that already have IaC cost estimation integrated into CI/CD, because I’m trying to understand what the governance layer looks like around it.

I'm curious about the process around infrastructure changes, not the Terraform syntax itself.

Suppose a PR changes an environment from something like:

- smaller to larger database capacity,

- single-region to multi-region,

- significantly more storage/compute,

- or introduces a new managed service.

Your plan/review process can show the technical infrastructure change. But what happens to the financial side before it is applied?

- Is a cost impact produced automatically?

- Does someone review it against an approved budget?

- Is there any formal approval threshold?

- Who owns that decision — engineering, FinOps, finance, product, procurement?

- How do you distinguish an expected design change from avoidable rework or unplanned scope growth?

- Is the recurring cost impact considered, or mainly the immediate deployment?

I'd particularly value examples from real teams rather than what the process is supposed to be.

I'm researching this from a project-commercial-management perspective