FinOps

Approval-Gated Terraform with Cost Estimates

Every Terraform change is planned, priced and approved before it applies; load-test environments are created, then destroyed.

A pull request is reviewed, the Terraform plan is priced by Infracost, and a named approver signs off in an Azure DevOps environment before apply. Load-test environments get their own resource group, tags and budget, and are destroyed when the test ends.

commitplan + costsign-offapplycreate, destroystateauditmetricsAzure Pipelines · IaC pipelineMicrosoft AzureMain environment · resource groupLoad-test resource group · temporaryCost visibilityApproversper environmentTerraform codemodules per environmentAzure Repospull requestCode reviewlint, policy checksterraform plansaved plan fileInfracostcost of the planManual approvalAzure DevOps environmentterraform applythe approved planLog Analyticsapproval and run auditTerraform stateBlob Storage, lockedVM scale setsautoscaleAKSautoscaleAzure Load Testingsimulated trafficSpot VMstemporary test computeTest dataStandard storageResource tagsenv, project, phaseBudgetsalerts to ownersCost Managementcost per resource groupAzure AdvisorrightsizingAzure Monitortest metrics

Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.

When to use it

  • Anyone can trigger infrastructure pipelines today, with no approval trail
  • Spend surprises: nobody sees the cost of a change before it lands
  • Performance tests that need production-sized resources for hours, not months

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

FinOps