The Complete Production SOP: How to Deploy and Run Infracost Cloud Cost Estimates in Pull Requests in Autonomous AI Agents
Step-by-step SOP to install and run Infracost Cloud Cost Estimates in Codex, Claude Code, and Cursor. Includes verified prompts, CI/CD setups, and troubleshooting.
Technical Overview & Architectural Context
Autonomous coding agents frequently hallucinate cloud infrastructure changes when refactoring Terraform, OpenTofu, or Terragrunt configurations. Without deterministic cost-governance guardrails, agents upgrade instance types, provision unbudgeted multi-region failover clusters, or expand provisioned IOPS without calculating the recurring operational expenditure. Standard LLM evaluations fail to quantify infrastructure pricing dynamics, resulting in billing surprises post-merge. The `infracost-cloud-cost-estimates` skill establishes rigorous procedural boundaries for autonomous coding agents (Codex, Claude Code, Cursor, Windsurf). It mandates an immutable 4-step pipeline: generating binary Terraform plans, transforming them into structured JSON, executing localized Infracost breakdowns, and comparing delta differentials against main-branch baseline snapshots. By embedding standard operating procedures directly into the agent's context, the agent reliably generates PR markdown annotations and enforces FinOps budget thresholds before submitting merge requests.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Mount the Infracost skill manifest into your agent runtime configuration hierarchy.
Agent runtimes such as Claude Code, Cursor, and Codex discover tools and procedural manifests via standard paths (`.agents/skills`, `.claude/skills`, or `.cursor/rules`). Mounting the SKILL.md file directly into your repository ensures that any task involving Terraform alterations triggers the cost-evaluation lifecycle before a git commit or PR creation is executed.
mkdir -p .agents/skills/infracost-cloud-cost-estimates && curl -fsSL https://askills.dev/api/skills/infracost-cloud-cost-estimates/raw -o .agents/skills/infracost-cloud-cost-estimates/SKILL.md---
name: "infracost-cloud-cost-estimates"
description: "Estimate cloud cost impact of Terraform pull requests directly in GitHub/GitLab comments."
metadata:
author: "Infracost"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "estimate terraform cost infracost"
- "infracost pull request comment"
- "finops cloud budget"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: true
net_access: true
---
# Infracost Cloud Cost Estimates SOP
1. Ensure INFRACOST_API_KEY is present in environment.
2. Generate target plan: `terraform plan -out=tfplan.binary && terraform show -json tfplan.binary > plan.json`.
3. Run baseline comparison: `infracost diff --path plan.json --compare-to baseline.json --format json --out-file infracost-diff.json`.
4. Format markdown summary for PR commentary: `infracost output --path infracost-diff.json --format github-comment`.Direct the agent to output Infracost reports to JSON first, then consume that JSON with lightweight jq filters to avoid bloating the agent context window with massive raw pricing catalogs.
Do not commit `tfplan.binary` or `plan.json` to source control. Ensure `.gitignore` ignores `*.binary` and `plan.json` because Terraform plan files can contain plain-text database credentials and provider secrets.
Environment Secrets & Dependency Validation
Configure the Infracost API key and verify local binary availability without exposing secrets.
Infracost queries its Cloud Pricing API to calculate per-hour and per-month resource delta figures. Autonomous agents must be restricted from reading your `.env` directly into conversation memory. Instead, set the variable in the host shell environment or `.env.local`, which the agent shell subprocess inherits automatically.
infracost configure set api_key ${INFRACOST_API_KEY} && infracost configure get api_key | grep -q 'ico-' && echo 'Infracost authenticated'name: Infracost PR Cost Assessment
on: [pull_request]
jobs:
infracost:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: hashicorp/setup-terraform@v3
- uses: infracost/actions/setup@v3
with:
api-key: ${{ secrets.INFRACOST_API_KEY }}
- name: Generate Infracost Diff
run: |
terraform init
terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > plan.json
infracost diff --path plan.json --format=json --out-file=/tmp/infracost.json
- name: Post Infracost Comment
run: |
infracost comment github --path=/tmp/infracost.json \
--repo=$GITHUB_REPOSITORY \
--github-token=${{ secrets.GITHUB_TOKEN }} \
--pull-request=${{ github.event.pull_request.number }} \
--behavior=updateUse `behavior: update` in CI/CD instead of `behavior: create-new` to ensure the agent maintains a single sticky PR comment, avoiding notification noise across commit iterations.
If working in private Terraform module registries, the agent must inherit `TF_TOKEN_app_terraform_io` or SSH keys; otherwise `terraform init` will fail during binary plan generation.
Intent Matching & Trigger Invocation
Trigger deterministic Infracost execution using natural language queries matching registered SKILL.md keywords.
When prompted with FinOps instructions, the runtime matches patterns in `triggers: [...]`. The agent executes the plan extraction, checks the baseline against `origin/main`, and constructs a deterministic cost delta table prior to proposing any pull request creation.
#!/usr/bin/env bash
set -euo pipefail
# Generate current baseline from main branch
git fetch origin main
git checkout origin/main
terraform init
terraform plan -out=baseline.binary
terraform show -json baseline.binary > baseline.json
# Switch back and generate diff
git checkout -
terraform plan -out=branch.binary
terraform show -json branch.binary > plan.json
infracost diff --path plan.json --compare-to baseline.jsonTrigger the agent with explicit budget thresholds (e.g., 'Fail if delta exceeds +$50/month') so the agent uses Infracost's `--cost-guardrail` or custom JSON parsing to evaluate compliance automatically.
Verification, Linting & Output Quality Gate
Run structural validations on the generated cost output before confirming PR readiness.
Ensure the generated delta JSON contains valid numeric nodes and contains no unmapped resources. The agent must parse the breakdown, surface top cost drivers, and exit cleanly with return code 0 before marking the task complete.
infracost breakdown --path plan.json --format json | jq '.totalMonthlyCost, .diff.totalMonthlyCost' && rm -f tfplan.binary branch.binary baseline.binary plan.json baseline.jsonDirect the agent to automatically clean up all generated `*.binary` and `*.json` artifacts as part of its verification step to keep the git working tree clean.
Terraform files containing provider credentials or remote backend configurations can throw silent failures if your agent invokes `terraform plan` without backend initialization flags.
Real-World Scenario: Upgrade AWS RDS Aurora Postgres Cluster and Calculate Monthly Budget Impact
“Refactor terraform/rds.tf to upgrade our production Aurora cluster from db.t4g.medium to db.r6g.xlarge, increase storage autoscaling max to 1000 GB, and estimate terraform cost infracost to produce a pull request comment.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent attempted to invoke `infracost breakdown` or `infracost diff` against a raw directory where `terraform init` was never run, or where `.terraform.lock.hcl` is absent.
cd /workspace/terraform && terraform init -backend=false && terraform plan -out=tfplan.binary && terraform show -json tfplan.binary > plan.json && infracost diff --path plan.jsonRoot Cause: The agent subshell did not inherit the host environment variables, or the skill runner sandbox isolated network execution from local config files.
export INFRACOST_API_KEY=$(cat /run/secrets/infracost_key 2>/dev/null || echo "$INFRACOST_API_KEY") && infracost configure set api_key "$INFRACOST_API_KEY"Frequently Asked Questions (Infracost Cloud Cost Estimates in Pull Requests SOP)
Q:Can I use Infracost Cloud Cost Estimates in Pull Requests across Codex, Claude Code, and Cursor simultaneously?
Yes. The SKILL.md file conforms to the universal agent skills format. Placing this definition in your repository at `.agents/skills/infracost-cloud-cost-estimates/SKILL.md` or `.claude/skills` allows Codex, Claude Code CLI, Cursor, and Windsurf to detect the identical triggers and execution rules seamlessly.
Q:How does Infracost Cloud Cost Estimates in Pull Requests prevent context window overflow during long agent sessions?
Instead of feeding hundreds of lines of Terraform code and massive raw cloud price matrices into the prompt context, this skill instructs the agent to run CLI commands locally and ingest only the condensed JSON output produced by `infracost diff --format json | jq ...`. This reduces token consumption by over 90%.
Q:Does this skill require escalated root or container permissions?
No. The skill runs completely inside user-space workspace sandboxes. It only requires read access to your Terraform definitions and write access to generate temporary local plan files. Network access is restricted to Infracost's pricing API endpoint.
Ready to equip your autonomous agent with Infracost Cloud Cost Estimates in Pull Requests?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.