Chapter 78: DevOps Projects Part 8: Terraform Three-Tier EKS CI Drift CloudFormation Infracost

78.6 Project 60: Infrastructure cost estimate with Infracost

By Ravindra Bagale Last updated: 28 October 2026

Friends, apply without a cost read is gambling. Today we generate a Terraform plan JSON, run an Infracost-style breakdown on a sample, write a monthly estimate note for an ALB plus ASG plus RDS sketch, and add a PR comment habit.

What you will build in this project

plan JSON tip.
Infracost breakdown notes.
Monthly estimate table.
PR comment habit.

1. Start from a real company story

At Freshworks in Chennai, a weekend apply added NAT Gateways in three AZs for a tiny lab VPC. Finance saw a spike on Monday.

Rough surprise: about ₹1.2 lakh that month for a forgotten lab.

Divya blocked merge without a cost diff on the pull request.

Today we build that cost-read habit.

Picture 1: terraform plan -out → show -json → infracost breakdown → PR comment

Ravindra Bagale's Tip

Students ignore NAT and RDS idle cost because the EC2 line looks small. Always read the full breakdown. Keep that habit.

2. Start and prepare

Step 1: Why cost first

Why: Surprises show up on the bill. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'A green terraform apply can still be an expensive apply'

You will see:

A green terraform apply can still be an expensive apply

What it means: Why.

Example 2: a2

Type this:

mkdir -p /tmp/tf60 && printf '%s\n' 'Rule: no merge to main without a cost diff on the PR' > /tmp/tf60/RULE.txt && cat /tmp/tf60/RULE.txt

You will see:

Rule: no merge to main without a cost diff on the PR

What it means: Rule.

Example 3: a3

Type this:

echo 'Infracost reads terraform plan JSON and prints monthly estimates'

You will see:

Infracost reads terraform plan JSON and prints monthly estimates

What it means: What it does.

Step 2: Sample HCL

Why: ALB ASG RDS sketch names. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: COST-INPUT.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'resources_for_estimate:' '- aws_lb app' '- aws_autoscaling_group desired=2 x t3.micro' '- aws_db_instance db.t3.micro single-AZ' '- aws_nat_gateway count=1' > /tmp/tf60/COST-INPUT.txt && cat /tmp/tf60/COST-INPUT.txt

You will see:

- aws_nat_gateway count=1

What it means: Inputs listed.

Example 5: b2

Type this:

echo 'Use the same resource names as project 55 where possible'

You will see:

Use the same resource names as project 55 where possible

What it means: Reuse.

Example 6: b3

Type this:

echo 'Region ap-south-1 prices differ from us-east-1 — pick one'

You will see:

Region ap-south-1 prices differ from us-east-1 — pick one

What it means: Region tip.

Step 3: Plan JSON

Why: Feed for Infracost. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: commands. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

echo 'terraform plan -out=tfplan'

You will see:

terraform plan -out=tfplan

What it means: Save plan.

Example 8: c2

Type this:

echo 'terraform show -json tfplan > plan.json'

You will see:

terraform show -json tfplan > plan.json

What it means: JSON export.

Example 9: c3

Type this:

echo 'Keep plan.json out of git — it may include sensitive values'

You will see:

Keep plan.json out of git — it may include sensitive values

What it means: Secret tip.

3. Build the main pieces

Step 4: Infracost CLI tips

Why: breakdown and diff. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: CLI-NOTES.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' 'CLI tips:' 'infracost breakdown --path plan.json' 'infracost diff --path plan.json --compare-to main_plan.json' 'Install from infracost.io docs when you are ready' > /tmp/tf60/CLI-NOTES.txt && cat /tmp/tf60/CLI-NOTES.txt

You will see:

infracost breakdown --path plan.json

What it means: CLI tips.

Example 11: d2

Type this:

echo 'breakdown is absolute monthly; diff is the PR delta'

You will see:

breakdown is absolute monthly; diff is the PR delta

What it means: breakdown vs diff.

Example 12: d3

Type this:

echo 'Pin the CLI version in CI for stable numbers'

You will see:

Pin the CLI version in CI for stable numbers

What it means: Pin tip.

Step 5: Manual table

Why: Even without the binary. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ESTIMATE.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' 'rough_monthly_usd_ap_south_1:' '  alb: 20' '  asg_2x_t3_micro: 15' '  rds_db_t3_micro: 15' '  nat_gateway: 35' '  total_approx: 85' '  note: numbers are teaching placeholders — re-price before finance review' > /tmp/tf60/ESTIMATE.txt && cat /tmp/tf60/ESTIMATE.txt

You will see:

total_approx: 85

What it means: Estimate table.

Example 14: e2

Type this:

echo 'NAT often costs more than the tiny ASG — that surprises juniors'

You will see:

NAT often costs more than the tiny ASG — that surprises juniors

What it means: NAT lesson.

Example 15: e3

Type this:

echo 'Replace placeholders with Infracost output before you present to finance'

You will see:

Replace placeholders with Infracost output before you present to finance

What it means: Finance tip.

Step 6: PR comment habit

Why: Paste the diff. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: PR-HABIT.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' 'PR checklist:' '- attach infracost diff' '- call out NAT RDS and idle resources' '- require finance or team lead ack above a threshold' > /tmp/tf60/PR-HABIT.txt && cat /tmp/tf60/PR-HABIT.txt

You will see:

- attach infracost diff

What it means: PR habit.

Example 17: f2

Type this:

echo 'Threshold example: comment must be green under 50 USD delta'

You will see:

Threshold example: comment must be green under 50 USD delta

What it means: Threshold.

Example 18: f3

Type this:

echo 'Weekend labs need an owner tag and a destroy date'

You will see:

Weekend labs need an owner tag and a destroy date

What it means: Lab hygiene.

4. Automate and verify

Step 7: CI sketch

Why: Cost job. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ci cost notes. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' 'CI job cost:' '1 terraform plan -out=tfplan' '2 terraform show -json tfplan > plan.json' '3 infracost diff' '4 post comment to the pull request' > /tmp/tf60/CI-COST.txt && cat /tmp/tf60/CI-COST.txt

You will see:

3 infracost diff

What it means: CI steps.

Example 20: g2

Type this:

echo 'Store the Infracost API key in the CI secret store — not in the YAML'

You will see:

Store the Infracost API key in the CI secret store — not in the YAML

What it means: Secret tip.

Example 21: g3

Type this:

echo 'Fail the job when monthly delta exceeds the team budget cap'

You will see:

Fail the job when monthly delta exceeds the team budget cap

What it means: Fail tip.

Step 8: Tagging for cost

Why: Allocation. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: tags tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'tags Project Env Owner on every resource make the bill readable'

You will see:

tags Project Env Owner on every resource make the bill readable

What it means: Tags.

Example 23: h2

Type this:

echo 'Cost allocation tags must be activated in the billing console once'

You will see:

Cost allocation tags must be activated in the billing console once

What it means: Activation tip.

Example 24: h3

Type this:

echo 'Untagged NAT Gateways are how labs get lost'

You will see:

Untagged NAT Gateways are how labs get lost

What it means: NAT tag tip.

Step 9: Destroy forgotten

Why: Stop the bleed. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: destroy tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

echo 'terraform destroy in every lab README'

You will see:

terraform destroy in every lab README

What it means: Destroy.

Example 26: i2

Type this:

echo 'Calendar reminder: Friday 5 pm destroy check'

You will see:

Calendar reminder: Friday 5 pm destroy check

What it means: Calendar.

Example 27: i3

Type this:

echo 'AWS Budget alerts email the team at 50 percent and 80 percent'

You will see:

AWS Budget alerts email the team at 50 percent and 80 percent

What it means: Budget alert.

5. Harden and accept

Step 10: Local proof

Why: Files ready. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: list. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

ls /tmp/tf60

You will see:

CI-COST.txt\nCLI-NOTES.txt\nCOST-INPUT.txt\nESTIMATE.txt\nPR-HABIT.txt\nRULE.txt

What it means: Artifacts.

Example 29: j2

Type this:

grep total_approx /tmp/tf60/ESTIMATE.txt

You will see:

total_approx: 85

What it means: Total line.

Example 30: j3

Type this:

cat /tmp/tf60/RULE.txt

You will see:

Rule: no merge to main without a cost diff on the PR

What it means: Rule.

Step 11: Acceptance

Why: Divya signs off. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

echo 'Plan JSON path documented; estimate table written'

You will see:

Plan JSON path documented; estimate table written

What it means: Checks.

Example 32: k2

Type this:

echo 'PR habit requires cost diff'

You will see:

PR habit requires cost diff

What it means: Habit check.

Example 33: k3

Type this:

echo 'Divya: PASS'

You will see:

Divya: PASS

What it means: Accepted.

Step 12: Chapter bridge

Why: Terraform projects complete. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: bridge to Ansible. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'Terraform projects 49-60 complete'

You will see:

Terraform projects 49-60 complete

What it means: Done block.

Example 35: z2

Type this:

echo 'Keep COST and RULE files beside the module README'

You will see:

Keep COST and RULE files beside the module README

What it means: Habit.

Example 36: z3

Type this:

echo 'Next chapter: Ansible projects 61-66'

You will see:

Next chapter: Ansible projects 61-66

What it means: Bridge.

Check yourself

Q1. Who fixed Freshworks NAT surprise?

Divya

Q2. Plan JSON flag tip?

terraform show -json

Q3. Tool name?

Infracost

Q4. Merge without cost diff?

Q5. Hidden cost example?

NAT Gateway

Q6. Cleanup?

terraform destroy

Friends, you added a cost estimate step before apply. Did you understand? Let us try it once more. Wire the breakdown as a required PR check in your CI notes.

Lab: try at home

Create a sample cost table.
Document plan JSON.
Document infracost CLI tips.
Add PR habit and acceptance.

Recap

Cost belongs in review.
Plan JSON feeds estimators.
NAT and RDS dominate surprises.
PR comments catch weekend labs.
Destroy forgotten labs.

Lab

Finish all six projects; keep COST and RULE files in your notes.
Keep a notebook of import steps, change-set commands, and CI stages.
Never commit plan.json or credentials.
After each project, write one paragraph: what broke and how you fixed it.
Next batch starts Ansible projects 61-66.

Practice task

Pick the CI plan-on-PR drill and the Infracost PR habit. Prove both before you call the chapter done.

Ravindra Bagale's Tip

Read every plan. Keep RDS private. OIDC in CI. Import brownfield; do not state-rm drift away. Cost diff before merge.

In short

Private data tier.
Pin EKS versions.
Plan artifact before apply.
Import then plan.
Change sets for CFN.
Cost diff on every PR.