The AI capex audit lands on the platform team

Something changed in the market this month, and it will reach your Azure estate before the quarter is out.

Alphabet reported. The numbers were fine. Google Cloud revenue was up 82% year on year to $24.8 billion. The stock got sold anyway, because the same release guided 2026 capital expenditure to roughly $205 billion and showed free cash flow going negative for the first time in the company's life as a public business.

Read that again, because the mechanism matters. A beat on revenue was not enough to offset the spending line. For about two years, "we are building more AI infrastructure" was, on its own, a reason for a stock to go up. As of this week it is a question the company has to answer.

Microsoft and Meta report tomorrow after the close. Apple and Amazon on Thursday. They all have the same question waiting for them.

The repricing is narrow, which is what makes it a signal

Broad equity markets are close to flat this week. What is selling off is specific: the companies that supply AI infrastructure.

Nvidia is down 5%, AMD 5.2%, Micron 2.3% and Sandisk 11% in a single session. That follows a worse stretch in early July, when Micron fell 13% in a day and Intel dropped 21% across the selloff. Two things triggered it. SK Hynix was reported to be slowing its high-bandwidth memory expansion, and Meta said it had surplus AI infrastructure capacity worth monetising.

Surplus capacity, from a company that spent two years telling everyone it could not build fast enough.

Underneath it, one assumption is being revised: that demand for AI compute would keep outrunning supply for long enough to justify the build cost. The burden of proof has moved onto the companies doing the spending, and they now have to carry it in public, quarter by quarter.

Interest rates are the other half of it. Rates have been held at 3.50-3.75%, and the Fed's own projections shifted this quarter from expecting a cut by year end to implying a rise. Money staying expensive is what turns a long-payback investment programme from patient into scrutinised.

How this reaches you

Here is the transmission path, and it is short.

Public markets stop rewarding infrastructure spend on faith. Boards read that. CFOs read the boards. Within a quarter or two, someone senior asks a version of this question:

What are we actually running, why, and what does it return?

That question does not stop at the cloud bill. A bill tells you what you were charged. It does not tell you what is deployed, who asked for it, whether it is compliant, whether anyone is using it, or whether it can be turned off without breaking something. The only function in the business that can answer all of that is the one that defines the estate in code.

That is you.

This is the part worth sitting with. For a platform team, a capex reckoning arrives as a governance and visibility problem long before it arrives as a budget cut. You get asked to justify 100%, not to trim 20%, and the honest answer for most estates is "I would need a few weeks to find out."

What shipped this month, and why the timing is not a coincidence

HashiCorp's release slate for July reads like a direct answer to that question. I do not think that is an accident. Vendors build toward where budget pressure is heading.

tfpolicy: governance in the language you already write

Announced 16 July, in public beta on HCP Terraform. This is the significant one.

tfpolicy is policy as code written in HCL, the same language your infrastructure is already defined in, rather than in Sentinel or Rego. It evaluates resource relationships, external data sources, provider and module usage, and live infrastructure after deployment. That last one is being undersold: it means evaluation against real state, not only against the plan.

Post-deploy evaluation against live state is the difference between "we block bad Terraform" and "we can tell you what is non-compliant in production right now." The first is a gate. The second is an answer to the audit question.

Sentinel and OPA are still supported, so nobody has to rip anything out. But if you have been putting off policy as code because it meant standing up a second engine with a second syntax nobody on the team writes yet, that excuse just got thinner.

The obvious caveat: public beta is public beta. Pilot it on a non-production project, write three or four policies that matter, and see how the live-state evaluation behaves against a real estate before you plan a migration.

Terraform Stacks: the consolidation story got adoptable

A batch landed on 23 July, and the theme is making Stacks usable on estates that already exist rather than only on greenfield.

Monorepo support, GA. Working directory support and trigger patterns, so multiple Stacks can live in one repository without every commit firing every run. If you rejected Stacks on repo-layout grounds, that objection is gone.
Guided CLI migration from workspaces to Stacks, public beta. A modular path to move incrementally rather than in one jump. This was the actual blocker for most people.
Workspace and Stack restore, GA on Standard and Premium. One-click restore to the exact pre-deletion state, with deleted items held on a Recoverable Items page for 30 days.
Project and workspace policy override permissions, GA on HCP Terraform and Terraform Enterprise 2.0.0. Override rights scoped to a project or a single workspace instead of the whole organisation.
Registry tagging with a project registry view, GA. Per-project visibility of artefacts sharing the project's tags.

Read those together and the shape is clear. Consolidate the sprawl, and make the consequences of getting something wrong smaller and reversible. Both are cheaper to run than what they replace.

Infragraph: knowing what you have

HCP Terraform powered by Infragraph is in limited availability for Standard and Premium customers on US instances, with the connector set now covering Azure, GitHub and Terraform Enterprise.

A graph across the estate is exactly the artefact you need when someone asks what depends on what. It is also, not coincidentally, the artefact you need before you can safely turn anything off.

The Terraform MCP server got Stacks support

21 July. Worth a line because agentic workflows against infrastructure are moving faster than most teams' policy on them. If your engineers are pointing AI agents at infrastructure, the governance question above applies to those agents too, and it applies sooner than you think.

The Azure-specific homework

Two things on the Azure side that pair with all of the above.

azurerm 4.81.0 shipped on 14 July. Go moved to 1.26.5, and API versions stepped up across CDN (2025-12-01), Compute (2025-04-01) and Key Vault (2026-02-01). New resources include Log Analytics workspace tables, federated identity credentials, CDN Front Door batch rule sets, Monitor scheduled query rule alerts, Web PubSub custom certificates, and a set of Cognitive Services connection types. Container Registry gained Entra authentication policies and network rule bypass options. Logic App Standard can now reference a Key Vault secret for its storage configuration.

It also fixes a CDN Front Door wildcard custom domain validation regression that 4.80.0 introduced two weeks earlier, which is your periodic reminder to pin the provider and read the changelog before you bump.

Microsoft's retirement wave is a cost conversation with a deadline. NVv3 and NVv4 support ends 2026-09-30. Several legacy Reserved VM SKUs stopped selling on 2026-07-01. CuRP retires 2026-10-31. HBv2, HC and NP series go on 2027-05-31.

Those dates are not negotiable and they are close. If your estate has NVv3 or NVv4 in it, that is a migration you are doing in the next two months, and it is far better to do it as a planned modernisation than as an emergency in September.

Elsewhere: patch OpenTofu

If you run OpenTofu anywhere, stop reading and go do this one.

OpenTofu 1.12.5 and 1.11.13 landed on 21 July, both carrying a security fix. The Encrypted Client Hello implementation was leaking pre-shared key identities during the handshake, which let a passive network observer de-anonymise the hostname of the server being contacted. ECH exists specifically to prevent that, so the failure mode is the feature not doing its one job.

Both maintained lines are patched. There is no reason to sit on it.

While you are there, 1.12.4 and 1.11.12 from 13 July fixed moved-block provider source address comparison, which mattered if you have been shuffling resources between providers.

What Terraform core is cooking

Stable is 1.15.8. The 1.16 alphas (most recently 1.16.0-alpha20260715) are carrying a few things worth knowing about early:

Import blocks inside modules. For brownfield landing zone work this is the headline. Bringing existing resources under management has been awkward precisely because imports could not live where the module lived.
A store block in terraform_data for ephemeral and sensitive values.
on_failure modes on resource action triggers: halt, taint, or continue.
Providers can use nested blocks as computed values, plus Linux s390x builds if you happen to run mainframes.

Alphas are alphas. Do not pin production to them. Do read the changelog, because import-in-modules will change how you plan an onboarding.

Azure Verified Modules, for its part, was quiet in July. Nothing shipped beyond issue traffic. The last substantive news was the Azure Infra Summit in late June and the Bicep platform landing zone going GA back in January, both of which I covered in this month's round-up.

What to do this week

Five things you can start on Monday, none of which require a strategy document first.

Patch OpenTofu to 1.12.5 or 1.11.13 if you run it. Security fix, no debate.
Find your NVv3 and NVv4 instances. The clock runs out on 30 September. Knowing the number now is worth more than a plan you write in three weeks.
Write down what you would say if a CFO asked what your estate costs and what it returns. Not the answer, the process. If the honest version is "I would need two weeks," that gap is the actual finding.
Pilot tfpolicy on one non-production project. Three policies. Include one that evaluates live state, because that is the capability you cannot get from your current gate.
Re-examine Stacks if you dismissed it. The monorepo and migration objections were real and they have been addressed.

The point

The AI infrastructure spending cycle just met its first serious public challenge. Whether that turns out to be a temporary correction or the start of something longer is above my pay grade and probably yours.

What is not above our pay grade is the second-order effect. Scrutiny of infrastructure spend travels downward until it lands on whoever can produce evidence about the estate. In most organisations that is a platform team with a Terraform repository and no easy way to answer questions about live state.

The tooling to answer those questions shipped this month. The question arrives next quarter. That ordering is unusually favourable, and it will not last.

Sources: HashiCorp Terraform blog · tfpolicy announcement · Stacks and workspace restore · azurerm releases · OpenTofu releases · Terraform releases · Trading Economics, US markets · Forbes, the July semiconductor selloff · Kiplinger, July Fed meeting · Azure updates

Share price moves quoted as at 28 July 2026. Nothing here is investment advice.