The DevSecFinOps Factory: Why I Enforce Checkov & Infracost Before Terraform Hits Azure
How I designed a declarative, multi-region Azure Enterprise Landing Zone using Checkov for policy-as-code and Infracost for financial guardrails, turning human bottlenecks into automated gates.
“Everyone wants developer velocity in the cloud. But velocity without deterministic guardrails isn’t scaling—it’s just automating the explosion of your budget and security posture.”
In my current role, I was tasked with architecting a multi-region Azure Enterprise Landing Zone (CAF) for massive-scale tenant onboarding. The goal was to build a standardized Hub & Spoke architecture.
The traditional approach relies on heavy human intervention: architects reviewing Terraform pull requests, security engineers manually auditing NSGs, and FinOps teams screaming about unexpected monthly bills. We needed velocity, but we couldn’t sacrifice control.
The Mess
At first, we relied entirely on Azure Policy to enforce compliance after resources were deployed. It was a disaster.
Engineers would write hundreds of lines of Terraform, push to main, and the pipeline would execute successfully. But 15 minutes later, Azure Policy would tear down their unencrypted storage accounts or public-facing subnets.
The feedback loop was too slow. Developers were frustrated because their code compiled but failed in the cloud. Security was frustrated because non-compliant resources lived for minutes before being remediated. And FinOps was completely blind until the invoice arrived. We were trying to fix the leaks after the ship had already sailed.
The Solution
I decided to shift the entire enforcement mechanism left. If a policy violation or a budget overrun was going to happen, it had to fail the PR before it ever reached Azure.
I designed a “DevSecFinOps Factory” pipeline using GitHub Actions, injecting two mandatory gates into every single Terraform workflow: Checkov and Infracost.
- Checkov (Policy-as-Code): I wrote custom Python policies to enforce our Hub & Spoke baseline. Before
terraform planeven runs, Checkov statically analyzes the HCL. If an engineer forgets to enable Azure Defender on a SQL server, the PR turns red instantly. No human review required. - Infracost (Financial Guardrails): We integrated the Infracost API directly into the PR comments. If a developer accidentally spun up 10
Standard_D16s_v3VMs instead of 1, Infracost would flag the $5,000/month delta. I set a hard CI gate: any PR that increases the monthly bill by more than 10% requires explicit FinOps approval. - ExpressRoute Steering: To ensure our multi-region traffic was deterministic, I enforced BGP Local-Pref steering tags directly in the Terraform modules, ensuring active/passive failovers were codified, not manually configured.
By turning subjective human reviews into objective, deterministic code gates, we slashed deployment friction while dramatically increasing our security posture.
Key Takeaway
If you are using Azure Policy to catch Terraform mistakes, you are doing it wrong. Enforce compliance and cost in the CI/CD pipeline using static analysis before the code ever touches the cloud provider. A failed PR is a teaching moment; a failed deployment is an incident.
Architecture and decisions: mine. Debugging sessions at odd hours: mine. AI assistance: structure, syntax, first draft. — Sachin
