tomevault-io Terraform Cost Review
Overview
Cost analysis framework for Terraform AWS components. Every resource must be toggleable or right-sizable per environment so non-production environments never pay production prices.
When to Use
- Reviewing a new Terraform component before deployment
- Evaluating existing components for cost optimization
- Planning environment-specific variable overrides in Atmos stacks
- After receiving a surprisingly high AWS bill
- During FinOps review of infrastructure components
When NOT to Use
- Pure application code changes with no infrastructure impact
- Reviewing Atmos stack YAML without underlying component changes
- Terraform modules that don't create AWS resources (e.g., label/naming modules)
- When the user explicitly asks for a security or compliance review only
Cost Analysis Process
Step 1: Resource Inventory
Read all .tf files and inventory every resource that incurs AWS charges. Categorize by networking, compute, storage, database, monitoring, and security. See pricing-reference.md for resource categories and approximate costs.
Step 2: Configuration Analysis
For each cost-driving resource, check:
- Toggleability -- Is there an
enable_*variable to disable in dev? - Sizing -- Are instance types, CIDR sizes, counts configurable via variables?
- Scaling -- Can counts be reduced (AZs, replicas, NAT gateways)?
- Retention -- Are log retention periods configurable and bounded?
- Tier selection -- Are storage classes, instance families configurable?
- Data transfer -- Are there unnecessary cross-AZ or cross-region transfers?
Step 3: Environment-Specific Recommendations
For each variable that affects cost, recommend values for dev, staging, and production. See pricing-reference.md for common variable patterns.
Common Cost Traps
| Trap | Typical Monthly Cost | Fix |
|---|---|---|
| 3 NAT gateways in dev | ~$100 + data transfer | Add enable_nat_gateway and nat_gateway_count variables |
| Flow logs to CloudWatch (high traffic) | $50-500 at scale | Set bounded retention_in_days, consider S3 destination |
| /16 subnets from IPAM | Wastes IP space | Use /20 or /24, make configurable |
| VPC interface endpoints everywhere | $7.50/endpoint/AZ/month | Toggle with enable_vpc_endpoints, use free gateway endpoints for S3/DynamoDB |
| Infinite CloudWatch log retention | Grows unbounded | Always set explicit retention_in_days |
| EIPs without NAT gateways | $3.60/month each unused | Conditional creation tied to NAT gateway enable flag |
| Cross-AZ data transfer | $0.01/GB | Co-locate when possible, or accept as HA cost |
Supporting Files
pricing-reference.md-- AWS resource pricing, inventory categories, and environment variable patternsreport-template.md-- Full output format template for cost review reports
Source: infraspecdev/tesseract — distributed by TomeVault.