Cost guardrails as code — budgets, SCPs, and deliberate spend tradeoffs

frameworkactive owner: philip · updated 2026-11-14

relates: env-selected-store-adapters · dual-deployment-serverless-container · warm-standby-dr-region-pair

Cost guardrails as code

Infrastructure cost is managed as code: org-wide budgets as alerts, SCPs that deny unencrypted/expensive resources, and explicit tradeoff comments at every spend decision (NAT gateways, warm standby, secret caching). Postgres/Aurora is the biggest line item, so its cost is engineered, not discovered.

Problem it solves

• Cloud bills surprise; a new account or resource quietly starts costing; the biggest database line item (Aurora Multi-AZ + warm standby DR) needs deliberate sizing, not default sizing.

Shape

• Org-wide cost budget (org/budgets.tf): consolidated spend across every member account, present and future — an alert threshold, not a spending cap; new accounts cannot quietly start costing.
• SCP guardrails (org/scp.tf): deny unencrypted RDS/Aurora creation outright — compliance and cost floor in one control.
• Tradeoff comments at the decision point: modules/network/main.tf rejects NAT gateways (~USD 40/month per AZ plus data processing) in favour of public endpoints where acceptable; bizcore-ingest caches secrets (300s) so rotation doesn't force redeploys and per-request Secrets Manager calls don't add latency+cost to every webhook.
• Alarm cost discipline: CloudWatch alarm actions wired only when they have a destination (HANDOFF.md: six alarms firing into nothing was a tracked defect).

Rules

• Every infrastructure PR states its monthly cost delta in the description or a comment — no silent spend.
• Budgets alert; humans decide. Caps that break production are worse than alerts.
• Cache aggressively at trust boundaries (secrets, lookups) — per-request vendor calls are a cost AND latency bug.
• Right-size DR: warm standby is scaled-down by design; active-active is a later, evidence-based upgrade.
• Alarm without an action is waste — wire destinations or delete the alarm.

Anti-patterns

• Default-sized everything (db.t3.large "just in case").
• NAT gateways by default in every AZ — the single most common AWS cost blowout.
• Per-request Secrets Manager / config lookups in hot paths.
• Budgets that page nobody (no action) or cap production (outage by cost control).

Sources

• aws-infra/org/budgets.tf, org/scp.tf, modules/network/main.tf, modules/bizcore-ingest/
• aws-infra/HANDOFF.md (unapplied-changes inventory discipline; alarm-without-action defect)
• aws-infra/docs/aws-design-guide.html (warm-standby cost midpoint)