CloudCostTree reads your infrastructure-as-code — Terraform, CloudFormation, Pulumi, or a raw Terraform state file — and renders a hierarchical cost breakdown, FinOps savings recommendations, governance checks, and a what-if simulator. AWS-only by design, CLI-only by design: no hosted dashboard, no account required to see a cost tree.
>cloudcosttree main.tf
Infrastructure summary
Provider: AWS
Resources: 26 (8 billable)
Current total: $669.62/mo
List price · AWS on-demand · before Savings Plans / Reserved Instances / credits / tax
Infrastructure tree
terraform (AWS)$669.62/mo
├── main VPC + NAT gateway$36.50/mo
├── app ALB$16.43/mo
├── app EC2 m5.large$70.08/mo
├── app_data EBS gp3 100GB$8.00/mo
├── cache ElastiCache r6g.large$150.38/mo
├── primary RDS db.r5.large Multi-AZ$388.00/mo
└── backups S3 bucket$0.23/mo
Cost Score: A (93/100)
FinOps recommendations save ~$194.00/mo
→ primary: RDS Multi-AZ doubles compute cost — run Single-AZ if this DB doesn't need standby HA. −$194.00/mo
→ primary: db.r5.large has a Graviton equivalent (db.r6g.large) — typically 20–40% less.
→ app: m5.large has a Graviton equivalent (m6g.large) — typically 20–40% less.
>
No agents, no cloud account linking, no hosted dashboard. Everything runs locally against your existing IaC files.
Terraform, CloudFormation, Pulumi, Terragrunt, a raw Terraform state file, or CloudCostTree's own YAML/JSON — no cloud credentials needed to see a cost tree.
A hierarchical, per-resource breakdown of what your infrastructure will actually cost per month, before you apply anything.
Right-sizing suggestions, real Reserved Instance and Spot savings from actual usage data, and a what-if simulator for testing changes.
Run cost and tag/FinOps policy checks in your pipeline — Pro can fail a build on violation, so cost overruns never reach production. Or gate it locally with "guard", before code even reaches a PR.
Free is a generous, unlimited cost-visibility tool for local use. Pro adds CI/CD scale and the ability to actually enforce governance.
No, not for the core cost tree — it reads your Terraform, CloudFormation, or Pulumi files and computes estimates entirely on your own machine, with no cloud credentials or account link required. The optional Pro --with-usage flag calls your own read-only AWS credentials (the standard credential chain) to replace static-config guesses with real numbers; nothing about your infrastructure is ever uploaded to us.
Terraform (HCL or a terraform show -json plan), a raw Terraform state file, CloudFormation, a CDK-synthesized template, Pulumi, Terragrunt, an Atmos (Cloud Posse) stack (Pro), or CloudCostTree's own YAML/JSON.
A 0-100 number plus a letter grade (A-F) rolling up every FinOps recommendation and policy violation from a run, weighted by severity and normalized by resource count. It's on every plan — free, unlimited, no dollar figure hidden — and shows up in the console, every export format, and history save/list/compare, so a team can track whether a stack is getting healthier or worse over time the same way it already tracks cost.
Every total is list price — AWS on-demand rates fetched straight from AWS's own price list, before any Savings Plans, Reserved Instances, credits, or tax. That basis is printed under the total on every report, so there's no ambiguity about what the number represents. With the Pro --with-usage flag, CloudCostTree also pulls your real CloudWatch utilization and shows a confidence range around the headline total — a one-standard-deviation band, roughly 68% confidence — combining each resource's measured variance across the tree, so a usage-driven estimate reads as a range, not a false-precision point number.
No — CloudCostTree is AWS-only by design. Staying single-cloud is what lets it price real, fetched-from-AWS rates for ~118 resource types instead of guessing across providers.
Free gives you unlimited local analyses, what-if simulations, and exports, plus the top 3 FinOps recommendations and up to 1,000 CI runs a month — cost data stays informational. Pro ($14.99/mo) unlocks the full FinOps recommendation list, unlimited CI runs, real-dollar Reserved Instance and Spot savings, usage-aware right-sizing, and cost/tag policy enforcement that can fail a build on violation. See the pricing section above for the full comparison.
Yes. Cancel anytime via the customer portal link in your Paddle receipt email, or by emailing us — see the Refund & Cancellation Policy for details. Cancelling stops future billing; your Pro access continues until the end of the period you've already paid for.
Yes — cloudcosttree ci report/check/diff plus a ready-to-use GitHub Action. Free includes 1,000 CI runs a month; Pro is unlimited and can enforce cost guardrails and FinOps/tag policies, failing the build on a violation.
Yes, free. cloudcosttree iam <path> reads the same Terraform, CloudFormation, or Pulumi input and writes the least-privilege policy a deployer role needs — currently 1,706 resource types, each with a real, correctly-scoped Action list — without ever contacting AWS. Every policy uses Resource: "*" today; narrowing that to exact ARNs is a planned Pro capability, not shipped yet, so the generator is identical on Free and Pro. When the resulting Action set enables a documented privilege-escalation technique (iam:PassRole with a compute-launch action, a direct principal-mutation action), it prints a privilege-escalation review naming the technique and the resource that introduced it — a safety disclosure on both tiers, not a gated feature.
Yes — it's included on both Free and Pro. See the VS Code Marketplace listing.
Found a bug, or have feedback?