# Managing Infracost Deep > Use when working with Infracost Deep — advanced Infracost cost estimation and FinOps management. Covers multi-project cost breakdown, diff analysis between branches, CI/CD integration inspection, policy enforcement with OPA/Sentinel, usage-based estimation, cost anomaly detection, and Infracost Cloud dashboard analysis. Use for deep cost analysis, cross-project comparison, policy-driven cost guardrails, or usage file configuration. - Skill: `cloudthinker-ai/managing-infracost-deep` (Agent Skill) - Install (CLI): `npx skillmds@latest add cloudthinker-ai/managing-infracost-deep` - Raw SKILL.md: https://api.skillmd.com/api/skills/cloudthinker-ai/managing-infracost-deep/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: cloudthinker-ai (https://skillmd.com/u/cloudthinker-ai) - Updated: 2026-09-08 - Page: https://skillmd.com/skills/cloudthinker-ai/managing-infracost-deep --- # Infracost Deep Management Skill Advanced cost estimation, policy enforcement, and FinOps analysis with Infracost. ## MANDATORY: Discovery-First Pattern **Always generate a baseline cost breakdown before comparing or enforcing policies.** ### Phase 1: Discovery ```bash #!/bin/bash echo "=== Infracost Version ===" infracost --version 2>/dev/null echo "" echo "=== Configuration ===" infracost configure get api_key 2>/dev/null | sed 's/./*/g' | head -1 infracost configure get pricing_api_endpoint 2>/dev/null infracost configure get currency 2>/dev/null echo "" echo "=== Project Detection ===" if [ -f infracost.yml ]; then cat infracost.yml | head -20 elif [ -f terraform.tf ] || [ -f main.tf ]; then echo "Terraform project detected" ls *.tf 2>/dev/null | head -10 fi echo "" echo "=== Baseline Breakdown ===" infracost breakdown --path . --format table 2>/dev/null | tail -25 ``` ### Phase 2: Analysis ```bash #!/bin/bash echo "=== Detailed Cost Breakdown ===" infracost breakdown --path . --format json 2>/dev/null | jq '{ totalMonthlyCost: .totalMonthlyCost, totalHourlyCost: .totalHourlyCost, currency: .currency, projects: [.projects[] | { name: .name, monthlyCost: .pastBreakdown.totalMonthlyCost, resourceCount: (.pastBreakdown.resources // []) | length }], topResources: [.projects[].pastBreakdown.resources[]? | {name: .name, monthlyCost: .monthlyCost}] | sort_by(-.monthlyCost) | .[0:10] }' 2>/dev/null | head -40 echo "" echo "=== Cost Diff (vs main) ===" infracost diff --path . --compare-to infracost-base.json --format table 2>/dev/null | tail -20 || echo "No baseline file for comparison. Generate one with: infracost breakdown --path . --format json --out-file infracost-base.json" echo "" echo "=== Usage Estimation ===" if [ -f infracost-usage.yml ]; then echo "Usage file found:" cat infracost-usage.yml | head -20 else echo "No usage file found. Create infracost-usage.yml for usage-based estimates." fi echo "" echo "=== Policy Check ===" if [ -f infracost-policy.rego ]; then infracost breakdown --path . --format json 2>/dev/null | infracost output --format json --policy-path infracost-policy.rego 2>&1 | tail -10 else echo "No policy file found. Create .rego files for cost guardrails." fi ``` ## Output Format ``` INFRACOST DEEP STATUS: Monthly Cost: $/mo | Hourly: $/hr Currency: Projects: | Resources: Top Cost Drivers: 1. : $/mo 2. : $/mo 3. : $/mo Diff: +$/mo (+%) vs baseline Policy: ( violations) Issues: ``` ## Safety Rules - **Infracost is read-only** -- it estimates costs but does not modify infrastructure - **Review cost estimates carefully** -- estimates depend on accurate usage files for usage-based resources - **Always generate a baseline** before comparing -- stale baselines produce misleading diffs - **Policy violations should block PRs** only after thorough testing ## Anti-Hallucination Rules 1. **NEVER assume resource names** — always discover via CLI/API in Phase 1 before referencing in Phase 2. 2. **NEVER fabricate metric names or dimensions** — verify against the service documentation or `--help` output. 3. **NEVER mix CLI commands between service versions** — confirm which version/API you are targeting. 4. **ALWAYS use the discovery → verify → analyze chain** — every resource referenced must have been discovered first. 5. **ALWAYS handle empty results gracefully** — an empty response is valid data, not an error to retry. ## Counter-Rationalizations | Shortcut | Counter | Why | |----------|---------|-----| | "I'll skip discovery and check known resources" | Always run Phase 1 discovery first | Resource names change, new resources appear — assumed names cause errors | | "The user only asked for a quick check" | Follow the full discovery → analysis flow | Quick checks miss critical issues; structured analysis catches silent failures | | "Default configuration is probably fine" | Audit configuration explicitly | Defaults often leave logging, security, and optimization features disabled | | "Metrics aren't needed for this" | Always check relevant metrics when available | API/CLI responses show current state; metrics reveal trends and intermittent issues | | "I don't have access to that" | Try the command and report the actual error | Assumed permission failures prevent useful investigation; actual errors are informative | ## Common Pitfalls - **Usage-based resources**: Resources like data transfer, API calls, and storage have zero cost without usage files - **Module support**: Some Terraform modules may not be fully parsed -- check for warnings in output - **Currency configuration**: Default is USD -- set currency before comparing across teams - **Baseline staleness**: Old baseline files produce incorrect diffs -- regenerate regularly - **Multi-project configs**: infracost.yml must list all project paths correctly for aggregate costs - **Free tier exclusion**: Infracost does not account for AWS/GCP/Azure free tiers -- actual costs may be lower - **Spot/reserved pricing**: Estimates use on-demand pricing by default -- use usage files to specify commitment discounts