Cloud costs are invisible until the bill arrives

# cost_policy.rego
package terraform

import data.openinfraquote as oiq

# Fail if total monthly cost increase exceeds $500
deny[msg] {
  oiq.monthly_cost_delta > 500
  
  msg := sprintf(
    "Cost increase of $%.2f exceeds $500 limit",
    [oiq.monthly_cost_delta]
  )
}

# Require approval for production changes over $100
warn[msg] {
  oiq.monthly_cost_delta > 100
  contains(input.path, "production")
  
  msg := sprintf(
    "Production change of $%.2f requires director approval",
    [oiq.monthly_cost_delta]
  )
}

# Block expensive instance types in dev
deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_instance"
  startswith(resource.change.after.instance_type, "m5.2xlarge")
  contains(input.path, "dev")
  
  msg := "m5.2xlarge instances not allowed in dev"
}