# Terraform Cost Review

> Use when reviewing Terraform components for AWS cost optimization, right-sizing, or identifying unnecessary expensive resources like NAT gateways or over-provisioned subnets

- Skill: `tomevault-io/terraform-cost-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/terraform-cost-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/terraform-cost-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/terraform-cost-review

---


# Terraform Cost Review

## Overview

Cost analysis framework for Terraform AWS components. Every resource must be toggleable or right-sizable per environment so non-production environments never pay production prices.

## When to Use

- Reviewing a new Terraform component before deployment
- Evaluating existing components for cost optimization
- Planning environment-specific variable overrides in Atmos stacks
- After receiving a surprisingly high AWS bill
- During FinOps review of infrastructure components

## When NOT to Use

- Pure application code changes with no infrastructure impact
- Reviewing Atmos stack YAML without underlying component changes
- Terraform modules that don't create AWS resources (e.g., label/naming modules)
- When the user explicitly asks for a security or compliance review only

## Cost Analysis Process

### Step 1: Resource Inventory

Read all `.tf` files and inventory every resource that incurs AWS charges. Categorize by networking, compute, storage, database, monitoring, and security. See `pricing-reference.md` for resource categories and approximate costs.

### Step 2: Configuration Analysis

For each cost-driving resource, check:

- **Toggleability** -- Is there an `enable_*` variable to disable in dev?
- **Sizing** -- Are instance types, CIDR sizes, counts configurable via variables?
- **Scaling** -- Can counts be reduced (AZs, replicas, NAT gateways)?
- **Retention** -- Are log retention periods configurable and bounded?
- **Tier selection** -- Are storage classes, instance families configurable?
- **Data transfer** -- Are there unnecessary cross-AZ or cross-region transfers?

### Step 3: Environment-Specific Recommendations

For each variable that affects cost, recommend values for dev, staging, and production. See `pricing-reference.md` for common variable patterns.

## Common Cost Traps

| Trap | Typical Monthly Cost | Fix |
|------|---------------------|-----|
| 3 NAT gateways in dev | ~$100 + data transfer | Add `enable_nat_gateway` and `nat_gateway_count` variables |
| Flow logs to CloudWatch (high traffic) | $50-500 at scale | Set bounded `retention_in_days`, consider S3 destination |
| /16 subnets from IPAM | Wastes IP space | Use /20 or /24, make configurable |
| VPC interface endpoints everywhere | $7.50/endpoint/AZ/month | Toggle with `enable_vpc_endpoints`, use free gateway endpoints for S3/DynamoDB |
| Infinite CloudWatch log retention | Grows unbounded | Always set explicit `retention_in_days` |
| EIPs without NAT gateways | $3.60/month each unused | Conditional creation tied to NAT gateway enable flag |
| Cross-AZ data transfer | $0.01/GB | Co-locate when possible, or accept as HA cost |

## Supporting Files

- **`pricing-reference.md`** -- AWS resource pricing, inventory categories, and environment variable patterns
- **`report-template.md`** -- Full output format template for cost review reports

---
> Source: [infraspecdev/tesseract](https://github.com/infraspecdev/tesseract) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-16 -->