Skip to main content

Infracost

The Gruntwork-provided Infracost hook estimates the cost of every unit a Pipelines run affects, so a reviewer can see what a change costs before it is applied. It invokes the Infracost CLI directly.

repository {
  after_hook "infracost_estimate" {
    name     = "Infracost Estimate"
    commands = ["plan"]
    execute  = ["pipelines", "hook", "infracost@v0"]
  }
}

The hook should be configured to run after plan given that it estimates the cost of the change that the plan command describes.

Outputs​

The hook posts the estimate on the pull or merge request:

Cost Estimate CommentCost Estimate Comment

The summary line shows the change to your monthly bill. The table breaks that change down by unit, alongside each unit's new monthly cost. The Baseline Cost and Usage Cost columns appear only when usage costs were projected.

A unit whose cost could not be estimated is marked ⚠️ rather than counted as zero, so a partial estimate is not mistaken for a complete one.

The hook reports pass when every affected unit was estimated, and warn when any could not be. It does not report deny, so it cannot fail a run or block a merge.

Inputs​

Settings are supplied as environment variables. Set them in the block's env, or export them before the hook runs.

Required​

VariableDescription
INFRACOST_API_KEYYour Infracost API key, read by the Infracost CLI. The hook stops before estimating if it is unset. See Providing an API key.

Optional​

VariableDescription
PIPELINES_HOOK_INFRACOST_CLI_VERSIONThe Infracost CLI version the hook installs. Defaults to the version the released hook was tested against.

Infracost CLI settings​

The Infracost CLI reads some of its settings from the environment, and the hook passes them through unchanged. For example, set INFRACOST_CURRENCY to an ISO 4217 currency code to report in a currency other than USD.

repository {
  after_hook "infracost_estimate" {
    name     = "Infracost Estimate"
    commands = ["plan"]
    execute  = ["pipelines", "hook", "infracost@v0"]

    env {
      INFRACOST_CURRENCY = "EUR"
    }
  }
}

The hook also passes an infracost-usage.yml from your repository root to the CLI. See Usage-based costs.

Providing an API key​

Infracost requires an API key, which the hook reads from INFRACOST_API_KEY.

Pipelines does not store secrets for you (see Authentication & Secrets), so fetch the key as part of execute, using the credentials the hook's authentication block provides:

repository {
  after_hook "infracost_estimate" {
    name     = "Infracost Estimate"
    commands = ["plan"]
    execute  = ["bash", "-c", <<-EOT
      export INFRACOST_API_KEY=$(aws ssm get-parameter --name infracost-api-key --with-decryption --query Parameter.Value --output text)
      pipelines hook infracost@v0
    EOT
    ]

    authentication {
      aws_oidc {
        account_id        = "222222222222"
        plan_iam_role_arn = "arn:aws:iam::222222222222:role/infracost-api-key-read"
      }
    }
  }
}

The same approach works with any secret store the hook's identity can reach. For a walkthrough, see Slack Deploy Notification.

Usage-based costs​

Some costs depend on how much a resource is used rather than on it existing, such as requests, storage, and data transfer. Infracost cannot read those figures from a plan, so it projects them.

Commit an infracost-usage.yml at the root of your repository to supply your own projections, and the hook picks it up automatically, with Infracost Cloud usage defaults as a fallback. The footnote under the table names the sources that applied.

See Infracost's usage costs documentation for the file format and how to override individual resources.