provider "aws" {
  region = "us-east-1"
}

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"

  tags = {
    Name = "infracost-demo-web"
  }
}

resource "aws_s3_bucket" "logs" {
  bucket = "infracost-demo-logs-q1w2e3r4"
}

Shift FinOps Left: Prevent cloud waste and budget overruns before every deploy

Usage:
  infracost [command]

Examples:
  # First-time setup (auth, agents, IDE, CI)
  $ infracost setup

  # Scan the current directory for costs and policy violations
  $ infracost scan

  # View a summary of the latest scan results
  $ infracost inspect --summary

Setup & integrations:
  agent       Manage AI coding agent integrations
  auth        Manage authentication
  ci          Manage CI integrations
  ide         Manage IDE integrations
  org         Manage organizations
  plugin      Manage Infracost plugins
  setup       Set up Infracost integrations

Analyze infrastructure:
  diff        Show the cost change between a saved baseline and your current code
  inspect     Inspect cached analysis results with filtering and grouping
  scan        Scan your IaC and derive FinOps costs and policy violations

Organization settings:
  budgets     List cost budgets for the current organization
  guardrails  List cost guardrails for the current repository
  policies    List all available FinOps and tagging policies

CLI maintenance:
  cache       Inspect and manage the on-disk Infracost cache
  doctor      Run diagnostic checks on your Infracost installation
  mcp         Run as a Model Context Protocol stdio server
  update      Update to the latest version

Additional Commands:
  completion  Generate the autocompletion script for the specified shell

Flags:
      --access-token-use-cache   Read and save access tokens from a cache file (disable to force a fresh login) (default true)
      --debug                    Enable debug logging
  -h, --help                     help for infracost
      --json                     Output logs and command results as JSON
      --llm                      Output command results in a compact, token-efficient format intended for LLM prompts
      --no-color                 Disable colored output
      --oauth-use-device-flow    Use device flow for authentication instead of PKCE (useful when you don't have access to localhost)
      --org string               The organization slug or ID to use
  -v, --version                  version for infracost

Use "infracost [command] --help" for more information about a command.

infracost auth login

Please go to the following URL to log in:
https://login.infracost.io/authorize?audience=https%3A%2F%2Fdashboard.api.infracost.io&client_id=uMF6vrdl42thCHGI6Os6UqMqr2Px412O&code_challenge=Lj5AMvuwgdK2RnrUjOfSlevtlg06PzZrT28iGfYUTdg&code_challenge_method=S256&icSource=cli&redirect_uri=http%3A%2F%2Flocalhost%3A26372%2Fcallback&response_type=code&scope=offline_access+orgs%3Aread+policies%3Aread+prices%3Aread+runs%3Awrite&state=Mfu6z4CkVTDyFL5SZh_Eiw%3D%3D

Press Enter to open the browser automatically...

infracost auth login --oauth-use-device-flow

Please go to the following URL to log in:
https://login.infracost.io/activate
And enter the code:
QRJF-SFZP

infracost auth whoami

Please go to the following URL to log in:
https://login.infracost.io/authorize?audience=https%3A%2F%2Fdashboard.api.infracost.io&client_id=uMF6vrdl42thCHGI6Os6UqMqr2Px412O&code_challenge=I0Ni4aEh--8GaBEqVadEIu6tsGO8CibMJCja5tGxw2o&code_challenge_method=S256&icSource=cli&redirect_uri=http%3A%2F%2Flocalhost%3A26372%2Fcallback&response_type=code&scope=offline_access+orgs%3Aread+policies%3Aread+prices%3Aread+runs%3Awrite&state=veN1_upKSK2H89p0cqc3ZQ%3D%3D

Press Enter to open the browser automatically...

infracost auth logout --no-color

Logged out
exit=0

Scan your IaC and derive FinOps costs and policy violations

Usage:
  infracost scan [path] [flags]

Examples:
  # Scan the current directory
  $ infracost scan

  # Scan a specific project path
  $ infracost scan ./terraform

  # Scan against a different organization's policies & prices
  $ infracost scan --org acme

Flags:
      --currency string       ISO 4217 currency code to use for prices (e.g. USD, EUR, GBP)
  -h, --help                  help for scan
      --include-warnings      Also show warning-severity diagnostics in the summary
  -o, --option stringArray    Specify a plugin-specific option e.g. -o infracost/terraform.option=yes
      --ssh-key-file string   Comma-separated SSH private key file(s) to use for fetching private modules over SSH (defaults to the standard ~/.ssh keys)

Global Flags:
      --access-token-use-cache   Read and save access tokens from a cache file (disable to force a fresh login) (default true)
      --debug                    Enable debug logging
      --json                     Output logs and command results as JSON
      --llm                      Output command results in a compact, token-efficient format intended for LLM prompts
      --no-color                 Disable colored output
      --oauth-use-device-flow    Use device flow for authentication instead of PKCE (useful when you don't have access to localhost)
      --org string               The organization slug or ID to use

cd /root/demo-terraform
infracost scan --no-color

Please go to the following URL to log in:
https://login.infracost.io/authorize?audience=https%3A%2F%2Fdashboard.api.infracost.io&client_id=uMF6vrdl42thCHGI6Os6UqMqr2Px412O&code_challenge=I0Ni4aEh--8GaBEqVadEIu6tsGO8CibMJCja5tGxw2o&code_challenge_method=S256&icSource=cli&redirect_uri=http%3A%2F%2Flocalhost%3A26372%2Fcallback&response_type=code&scope=offline_access+orgs%3Aread+policies%3Aread+prices%3Aread+runs%3Awrite&state=veN1_upKSK2H89p0cqc3ZQ%3D%3D

Press Enter to open the browser automatically...

Show the cost change between a saved baseline and your current code

Usage:
  infracost diff [path] [flags]

Examples:
  # Save a baseline, change the code, then diff against it
  $ infracost scan --json > infracost-base.json
  $ infracost diff --compare-to infracost-base.json

  # Diff a specific project path
  $ infracost diff ./terraform --compare-to infracost-base.json

Flags:
      --compare-to string     Path to an Infracost JSON file to compare against (defaults to the last cached scan of this path)
      --currency string       ISO 4217 currency code to use for prices (e.g. USD, EUR, GBP)
  -h, --help                  help for diff
  -o, --option stringArray    Specify a plugin-specific option e.g. -o infracost/terraform.option=yes
      --ssh-key-file string   Comma-separated SSH private key file(s) to use for fetching private modules over SSH (defaults to the standard ~/.ssh keys)

Global Flags:
      （与 scan 相同的 7 个全局 flags）

cd /root/demo-terraform
# 1. 保存基线：把当前成本固化成 JSON
infracost scan --json > infracost-base.json
# 2. 修改代码（改实例规格/加资源/换 region）……
# 3. 对比：输出相对基线的成本增减
infracost diff --compare-to infracost-base.json

Examples:
  # Headline numbers (totals + per-policy counts):
  $ infracost inspect --summary

  # Single scalar from the summary (e.g. "how many failing FinOps policies?"):
  $ infracost inspect --summary --fields failing_policies

  # Top 10 most expensive resources:
  $ infracost inspect --top 10

  # Total potential yearly savings if every FinOps issue were fixed:
  $ infracost inspect --total-savings

  # Top 5 FinOps issues, just the addresses (one per line):
  $ infracost inspect --top-savings 5 --fields address

  # Top 5 FinOps issues with a custom column projection (aligned table):
  $ infracost inspect --top-savings 5 --fields address,yearly_savings,policy

  # Every resource missing the 'team' tag, one address per line:
  $ infracost inspect --missing-tag team

  # Same, with extra columns for context (add --llm/--json for scripting):
  $ infracost inspect --missing-tag team --fields address,type,monthly_cost

  # Resources whose 'environment' tag is set but uses a disallowed value:
  $ infracost inspect --invalid-tag environment

  # Resources with monthly cost > $100:
  $ infracost inspect --min-cost 100

  # Composable filter: missing 'team' tag AND on AWS:
  $ infracost inspect --filter "tag.team=missing,provider=aws"

  # All addresses failing a specific policy (full list, no truncation):
  $ infracost inspect --policy "Required Tags" --addresses-only

  # Per-project diagnostics from the latest scan (errors + warnings):
  $ infracost inspect --diagnostics

  # Machine-readable, token-efficient output for LLM pipelines:
  $ infracost inspect --summary --llm

# 成本盘点：最贵资源 + 汇总
infracost inspect --summary
infracost inspect --top 10

# FinOps 行动清单：按「修复后年省多少」排序取前 5，只要地址（可喂给脚本/AI 代理）
infracost inspect --top-savings 5 --fields address

# 标签治理：缺 team 标签的资源地址清单（门禁脚本直接消费）
infracost inspect --missing-tag team --addresses-only

# 组合过滤：AWS 上缺 team 标签、月成本超 100 的资源
infracost inspect --filter "tag.team=missing,provider=aws" --min-cost 100

# 给 LLM 的紧凑输出
infracost inspect --summary --llm

Walk through setting up Infracost for your coding agents, IDE, and CI pipeline

Usage:
  infracost setup [flags]

Examples:
  # Run the interactive setup walkthrough
  $ infracost setup

No AI agents with Infracost skills detected. Run infracost agent setup to install them.

Run as a Model Context Protocol (MCP) stdio server.

Exposes the same operations as the top-level CLI commands as MCP tools,
backed by the same Go functions. Intended to be launched by an MCP-aware
client (an IDE assistant, for example) which communicates over
stdin/stdout.

infracost completion bash | head -3

# bash completion V2 for infracost                            -*- shell-script -*-

__infracost_debug()

infracost completion bash > /etc/bash_completion.d/infracost
source /etc/bash_completion.d/infracost

Inspect and manage the on-disk Infracost cache

Usage:
  infracost cache [command]

Available Commands:
  clear       Wipe the results and parser caches
  info        Show on-disk size of each Infracost cache
  prune       Remove old cache entries and any stray files

infracost cache info

Cache root: /root/.cache/infracost

results cache          0 B
parser cache           0 B
parser results cache   0 B

Run diagnostic checks on your Infracost installation

Infracost Doctor 2.18.2 - running 7 checks

Authentication
  ✗  No credentials found
     →  Run `infracost auth login` to authenticate
  ⊘  Token valid
     →  skipped (No credentials found)
  ⊘  Organization accessible
     →  skipped (No credentials found)
  ⊘  API reachable
     →  skipped (Organization accessible)

CLI
  ✔  Version 2.18.2 (latest)

Configuration
  ✔  Config file valid
  !  Default org set
     →  No organization data available

  ✔  2 passed  !  1 warning  ✗  1 issue  ⊘  3 skipped

Run infracost doctor --fix to attempt auto-remediation
Info: 1 health check(s) failed

infracost update --no-color    # 成功时无输出，退出码 0
infracost --version

infracost version 2.18.2

✔  Already up to date (2.18.2).

Update: A new version of Infracost is available: 2.17.0 → v2.18.2
  $ infracost update

Manage Infracost plugins

Usage:
  infracost plugin [command]

Available Commands:
  list        List Infracost parser and provider plugins
  update      Update all Infracost plugins to the latest version

Plugins
Path: /root/.cache/infracost/plugins

Parsers:
  infracost/terraform                not installed
  infracost/terragrunt               not installed
  infracost/cloudformation           not installed
  infracost/ciscostacks              not installed
  infracost/arm                      not installed
  infracost/terraform-plan           not installed
  infracost/kubernetes               not installed

Providers:
  infracost/aws                      not installed
  infracost/google                   not installed
  infracost/azure                    not installed
  infracost/kubernetes               not installed

infracost output is no longer supported. This command has been removed.
infracost configure is no longer supported. This command has been removed.