Infracost
Infracost estimates the monthly cost of infrastructure code before it is applied. It reads a plan, prices each resource from the cloud provider's price list and reports the difference a pull request would make. In the platform, the AWS Baseline's plan workflow prices every pull request and leaves the estimate on it as a comment.
What it does
Given OpenTofu or Terraform code and a plan, Infracost produces a breakdown (this instance costs this much per month) and a diff (this change adds or removes this much). It needs an API key for the pricing service. Teams use it to spot a change that quietly adds an expensive resource and to keep a record of cost decisions on the pull request itself.
How BuiltForProd uses it
The landing-zone repository's plan.yml ends with four Infracost steps, after the plan has been posted. The first installs the CLI through the infracost/actions/setup action (version 4.2.0) with currency set to USD. The second runs infracost breakdown over the same generated environments tree the plan ran against and writes the result as JSON. The third posts that JSON to the pull request with the infracost/actions/comment action. Three properties define how the sequence behaves:
- It runs only on pull request events.
- The comment behavior is
update, so each pull request carries exactly one cost comment, rewritten on every push rather than added to. - It reads the API key from the repository secret
INFRACOST_API_KEY, which the deployment guide lists as optional. Every step is skipped when the key is absent, and each is markedcontinue-on-error, so a missing key, a network failure or an Infracost outage leaves the job green.
Only the AWS Baseline has these steps. The blueprint infrastructure repositories do not, because most of their spend is a handful of well-known resources whose prices are written beside the stage values: the extra DocumentDB instance, the extra Redis node, the extra EKS node for ArgoCD high availability.
The workbooks place Infracost in the operating rhythm rather than in the code: the DevOps team workflow has the DevOps lead review Infracost reports daily and cost trends every second week. The operable pillar is where cost visibility sits in the BuiltForProd Standard.
The platform's own cost controls do not depend on Infracost. Every expensive service is off behind a switch whose comment states its price, in security.hcl and network.hcl, and per-stage sizing values carry the same annotations.
Terms you will see
| Term | Meaning |
|---|---|
| Breakdown | The full monthly cost of the resources in a plan. |
| Diff | The change in monthly cost a pull request introduces. |
| API key | The credential for Infracost's pricing service, stored as a repository secret. |
| Comment behavior | update: one cost comment per pull request, rewritten on each push. |
continue-on-error | The GitHub Actions setting that keeps the job green if the step fails. |
| Usage-based cost | Charges Infracost cannot see in a plan, such as data transfer. |
Where to read more
- GitHub Actions for the plan workflow
- Terragrunt for the plan it reads
- Operable in the BuiltForProd Standard