Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / How Cloud Contracts Now Charge for Terraform Plan Caching
Transcript
- Lucas: If you've run a Terraform plan and apply cycle more than a few times this week, your cloud provider might have started charging you for something you probably thought was free: caching the plan output. Luna: Wait — caching the plan? Isn't that just a local file that Terraform generates before it touches anything in the cloud? Lucas: It used to be, and for most teams it still is if they're running open-source Terraform locally. But a growing number of enterprise agreements with AWS, Azure, and GCP now include a line item specifically for 'Terraform plan caching' when you use their managed Terraform services — like AWS Proton or Azure Deployment Environments. Luna: So it's not the open-source CLI. It's when you use the provider's own orchestration layer? Lucas: Right. And the trigger is this: every time you run a plan, the provider caches the output so that subsequent plans — especially in CI/CD pipelines — can compare against it without re-evaluating the entire state. That cache is now being metered as a compute event. Luna: How much are we talking? Is it per plan, per cache read, per something else? Lucas: It varies. AWS charges per cache write — each time a plan completes and writes its output to the cache. Azure charges per cache read, which is more painful for teams that do lots of plan-only runs before applying. GCP bundles it into the cost of Cloud Build minutes but with a multiplier if you exceed a certain cache size threshold. Luna: So if you're a team running a hundred plans a day in CI — which is pretty normal — that could add up fast. Lucas: Exactly. I talked to a fintech in the mid-stage — about 80 engineers — and they saw a 12 percent bump in their CI/CD cost line after the charge was introduced. That's not trivial when you're already paying for compute, storage, and egress. Luna: Twelve percent just from caching plan outputs. And I bet most teams didn't even see it coming because the contracts buried it under 'advanced orchestration features' or something. Lucas: They did. In one AWS enterprise agreement I reviewed, the charge was listed under 'Proton Plan Cache Operations' — it's a separate SKU that many finance teams wouldn't even think to flag during contract review. Luna: So is this a money grab, or is there a legitimate cost driver on the provider side? Lucas: There is a real cost. Storing and serving cached plan outputs at scale — especially for large state files — requires infrastructure. But providers are also clearly looking for ways to monetize the DevOps lifecycle beyond just raw compute and storage. Terraform plan caching is a low-friction point because it's invisible to most developers. Luna: Low friction meaning they can add it without breaking anything, and teams only notice when the bill comes. Lucas: Exactly. And because it's a metered charge, it scales with your iteration frequency — which is the exact behavior DevOps encourages. The faster you iterate, the more you pay. Luna: That feels almost anti-pattern. You want teams to plan early and often to catch drift, but now there's a financial penalty for doing that. Lucas: That's the tension. Some teams I've spoken to are already changing their workflows — consolidating plans, running fewer plan-only checks, or even skipping plan caching entirely and regenerating the plan from scratch each time. Luna: But regenerating from scratch is slower and uses more compute on the Terraform side — that can't be cheaper. Lucas: It depends. If you're comparing the cost of cache reads versus the cost of a full plan evaluation, it's a trade-off. For small state files, regenerating might actually be cheaper because there's no cache write or read charge. For large state files, caching still wins on latency. Luna: So the provider's pricing model is essentially forcing teams to optimize for cost over speed — which is the opposite of what cloud was supposed to do. Lucas: Right. And it's not just Terraform. Other IaC tools like Pulumi and Crossplane are seeing similar metering experiments. But Terraform is the most widespread, so it's getting the most attention. Luna: What about open-source Terraform with remote state backends? Does the charge apply there? Lucas: No — if you're running the open-source CLI against a generic S3 or Azure Storage backend, there's no cache charge because the provider isn't managing the plan lifecycle. The charge only applies when you use the provider's managed Terraform service, which handles caching, locking, and state versioning automatically. Luna: So the trade-off for convenience is a new cost line. That seems like a classic cloud lock-in play. Lucas: It is. Once you're using the managed service, migrating back to open-source becomes a project. And the caching charge is small enough that most teams won't bother — at least until it compounds. Luna: What about HashiCorp itself? They changed their licensing to BSL last year. Does that affect this? Lucas: Not directly. The BSL change was about commercial use of Terraform itself. Cloud providers are still allowed to offer managed Terraform services under the old MPL license for now. But the caching charge is the provider's own invention, not something HashiCorp mandated. Luna: So it's pure cloud provider innovation. For revenue generation. Lucas: Exactly. And it's spreading. Google Cloud's next-gen Cloud Build pricing includes a per cache hit charge for Terraform plans. Azure just announced a preview of 'Deployment Environments caching' with a per-read fee. Luna: Are there any workarounds besides abandoning managed services? Lucas: A few. Some teams are setting cache TTLs aggressively — like 30 seconds — so the cache expires quickly and fewer reads occur. Others are using a hybrid model: open-source CLI for plan-only runs, and managed service only for applies. That avoids the cache charge on the high-frequency planning side. Luna: But that adds operational complexity. You're managing two pipelines. Lucas: It does. And that's the rub — the provider is betting that the complexity of avoiding the charge outweighs the cost of paying it. For most teams, it probably does. Luna: It's like a tax on iteration. The more you try to improve your infrastructure, the more you pay. Lucas: I think that's the right way to frame it. And it's part of a broader trend where cloud contracts are finding new ways to meter developer workflows — not just infrastructure consumption. Luna: Yeah, we've seen episodes on pipeline minutes, Terraform plan runs, state file reads. This is just the next frontier. Lucas: And you know, speaking of this being useful — if these conversations help you think about your own contracts or workflows, honestly, if today was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. Luna: Listeners like you are what keep this show ad-free and focused on the details that actually matter. Lucas: So back to caching — one thing that could shift this dynamic is if HashiCorp or the open-source community releases a tool that lets teams cache plans locally without touching the cloud provider's cache service. That would bypass the charge entirely. Luna: Is anyone working on that? Lucas: I've seen some early prototypes — essentially a local caching proxy that intercepts plan outputs and serves them from a local or shared filesystem. But it's early, and it would require teams to manage their own cache invalidation logic. Luna: Which is exactly what the managed service was supposed to solve. Lucas: Right. So the industry is at a weird inflection point where convenience and cost are diverging. I don't think the caching charge is going away, but I do think we'll see more tools emerge to help teams optimize around it. Luna: Maybe the real lesson is to read your contract's fine print on 'advanced services' before signing. Lucas: Always. And to ask your account rep: 'Is Terraform plan caching billed separately?' If they hesitate, you know it's coming. Luna: Fair point. Let's see how this evolves — I suspect we'll have a follow-up episode in six months when the charge becomes standard practice. Lucas: I'd bet on it. Thanks for listening.