vscode-infracost VS terraform-docs

Hi, we are Ali, Hassan, and Alistair, co-founders of Infracost (https://www.infracost.io/). Infracost helps engineers see the cost of each Terraform change before launching resources. When changes are made, it posts a comment with the cloud cost impact. For example, “you’ve added 2 instances and volumes, and change an instance type from medium to large, your bill will increase by 25% next month, from $1000 to $1250 per month”.

We launched in February 2021 (https://news.ycombinator.com/item?id=26064588), and Infracost is now being actively used by over 3,000 companies. However, there is a shift happening in the cloud cost management space. New teams, called FinOps teams (a combination of "Finance" and "DevOps"), are being formed within companies to manage cloud costs.

One of the first tasks assigned to these teams is to determine "who is using what" - that is, which teams, business units, products, etc. are spending the most on cloud. To accomplish this, they use tags. Tags are labels that all cloud resources should have and are key-value pairs. For example, a server could be tagged with: product=HackerNews; environment=production; team=blueTeam. So if resources are not tagged properly, then you can’t tell who is using what.

However, FinOps teams face challenges because their tools are reactive. These tools begin by analyzing cloud bills and providing visibility of tags from there. This means that they are looking at resources that are already running in production and costing money. A customer recently shared, “I want all resources to be properly tagged. But if they are not, I would rather a resource not be tagged at all than be tagged incorrectly.”

My "aha" moment! FinOps teams can define a tagging policy that can be validated in CI/CD before resources are launched. This is important because if code is shipped with the wrong tags, FinOps teams will have to fight for sprint time to fix them. Even if you shut down an untagged resource directly in the cloud, the next time Terraform runs, the resource will launch again with no tag. You need to fix the issue at its root.

I’d love your feedback on our solution to the tagging problem. You define your tag key-value policy in our SaaS product, and Infracost checks all Terraform resources per change. If anything fails the policy, it posts a comment with the details of which resources need tags, and what the allowed values are. Once fixed, it will let the code be shipped to production.

Try it out by going to https://dashboard.infracost.io/, setting up with the GitHub app or GitLab app, and defining your tagging policy. It will then scan your repository and inform you of any missing tags and their file and line number. You can use the free trial, but if you need more time, please message me and I’ll extend it for you.

I would also love to hear how others ensure that the correct tag keys and values are applied to all resources, and whether this is done proactively or reactively. Additionally, I would be interested in hearing about any lessons learned in the process.

Cheers

Great toolchain, including Infracost or tfsec.

Infracost is an open-source tool for estimating the cost of cloud infrastructure using Infrastructure as Code templates.

Throughout this post, you will see me mention the cost of running this using an estimate. I have been using for a while, a tool called infracost which is an open source (with subscription based additions) cost estimator tool - https://www.infracost.io/. For this demonstration, using the sample code listed above, it would cost an estimated $76.65/month - so if you don't want rack up a bill, only deploy when you want to test, and use Terraform to destroy the services when you are done.

Infracost : Infracost is an open-source tool that allows users to see the cost of running their infrastructure, such as AWS resources, in near real-time. It uses the AWS Price List API to determine the costs of resources, and can be integrated into CI/CD pipelines to provide cost feedback during the development process. This allows developers to make informed decisions about their infrastructure and optimize costs. Additionally, Infracost can be used to create alerts based on cost thresholds, so you can be notified when your infrastructure costs exceed a certain amount. This can be especially useful for teams that operate on a tight budget or need to manage costs closely.

An Infracost API key. You can get one by signing up for free at Infracost.io.

Since Wing compiles to Terraform, you should be able to manually run Infracost (https://www.infracost.io) to get an idea of costs.

Having that capability baked into the language/compiler would be a great addition.

Documentation is really important, so having a README.md file inside your Terraform repository that explains how to use the automation (including descriptions of variables and outputs) really help in understanding what has been implemented. To easily generate the description of variables and outputs, you can leverage tfdocs.

‍Terraform-docs is a tool that automatically generates documentation from Terraform modules in various output formats, including markdown, JSON, and others. It's particularly useful for maintaining up-to-date documentation of your Terraform modules' inputs, outputs, providers, and resources.

Earlier this year I wrote about the challenges I faced creating a Terraform module. I mentioned then that I was leveraging terraform-docs and GitHub Actions to automate documentation, but a full workflow walkthrough was out of that post's scope.

### Muti-Stage pipeline for windows trigger: - main variables: terraformDocsVersion: '0.16.0' serviceConnectionName: 'Terraform-SPN-DevOps-MagiconionM' keyvaultName: 'pwd9000-core-kv' pool: vmImage: 'windows-latest' stages: - stage: GenerateTerraformDocumentation jobs: - job: Generate_Terraform_Documentation steps: - checkout: self persistCredentials: true # this allows the later scripts to use the system-provided git token to push changes back to the repo ### Link to key vault. - task: AzureKeyVault@1 inputs: azureSubscription: $(serviceConnectionName) #ADO service connection (Service principal) KeyVaultName: $(keyvaultName) SecretsFilter: 'TerraformDocsPAToken' RunAsPreJob: true displayName: Get PAToken from Keyvault ### Install Terraform-Docs. - powershell: | Invoke-WebRequest -Uri "https://github.com/terraform-docs/terraform-docs/releases/download/v$(terraformDocsVersion)/terraform-docs-v$(terraformDocsVersion)-windows-amd64.zip" -OutFile "terraform-docs.zip" Expand-Archive -Path "terraform-docs.zip" -DestinationPath "$(System.DefaultWorkingDirectory)\terraform-docs" -Force $env:Path += ";$(System.DefaultWorkingDirectory)\terraform-docs" displayName: 'Install terraform-docs' ### Remove all old README.md files and generate new README.md files for each TF module. - powershell: | # Set Modules Root Directory Set-Location "$(Build.SourcesDirectory)\@TF_Modules" # Get all subdirectories (Terraform module directories) $terraformModuleDirs = Get-ChildItem -Path (Get-Location) -Directory # Loop through each directory to cleanup/remove old README files foreach ($dir in $terraformModuleDirs) { # Get all files in the directory $readMeFiles = Get-ChildItem -Path $dir.FullName -Filter 'README.md' # Loop through each file in each terraform module foreach ($file in $readMeFiles) { # Check if README file already exists and remove if ($file) { # Remove the file Remove-Item $file.FullName -Confirm:$false Write-Output "Old file '$($file.Name)' removed from '$($dir.FullName)'" } } #After cleanup create a new README.md file with 'terraform-docs' based on latest TF module code in current folder(terraform module) $tfFiles = Get-ChildItem -Path $dir.FullName -Filter *.tf if ($tfFiles.Count -gt 0) { # Create new README.md file $(System.DefaultWorkingDirectory)\terraform-docs\terraform-docs.exe markdown table $dir.FullName --output-file "README.md" } else { Write-Output "No .tf files found." } } displayName: 'Cleanup and Generate new README for each TF module' ### Commit and push updated README.md files for TF modules. - powershell: | git config --local user.email "[email protected]" git config --local user.name "Terraform Docs" git add *.md git commit -m "Update README.md for each TF module" git push origin HEAD:$(Build.SourceBranchName) displayName: 'Commit and Push updated README.md files for TF modules' env: SYSTEM_ACCESSTOKEN: $(TerraformDocsPAToken)

I'm going to have to figure out how to run terraform-docs.io against each module. I have zero terraform experience.

Terraform-docs: This tool generates documentation for your Terraform modules in various formats, such as Markdown, HTML, and JSON. Terraform-docs parses your Terraform code and extracts documentation from comments, variable and output descriptions, and input/output examples. The tool then generates a table of contents with links to the relevant documentation for each module, which makes it easy to understand the purpose and usage of each module.

Terraform docs

I have been using https://terraform-docs.io to generate documentation of my terraform modules. However creating nested objects with optionals makes the documentation rather ugly and hard to read. See gh issue which also describes this type of issue: https://github.com/terraform-docs/terraform-docs/issues/656

I am looking for a way to automate doc creation and updates for ansible roles. I recently discovered terraform-docs and I am curious if there is something similar for ansible.

terraform-docs: https://github.com/terraform-docs/terraform-docs

Do you have other Terraform-related open-source tools that you recommend? Please go ahead and add in the comments!