Cloud Cost Landmine Lint for Terraform, CloudFormation and Kubernetes

$470.85 every month, from six lines of Terraform - for the platform engineer on AWS us-east-1 who owns the module somebody else pays for. The extension's own output on that file, unedited:

line  3  [error]  map_public_ip_on_launch = true
                  A public IPv4 at $0.005 per hour, in use or idle - $3.65 a month per instance, charged since 2024-02-01
line  6  [error]  resource "aws_nat_gateway" "nat" {
                  $0.045 an hour - $32.85 a month at 730 hours - plus $0.045 for every GB it processes
line 12  [error]  version = "1.34"
                  $0.60 per cluster-hour instead of $0.10 from 2026-12-02 - $365 more a month, per cluster
line 16  [warn]   vpc_endpoint_type = "Interface"
                  $0.01 an hour per availability zone plus $0.01 per GB - about $14.60 a month across two zones
line 19  [warn]   resource "aws_ec2_transit_gateway_vpc_attachment" "spoke" {}
                  $0.05 an hour - $36.50 a month each - plus $0.02 for every GB processed
line 21  [warn]   resource "aws_globalaccelerator_accelerator" "edge" {}
                  $0.025 an hour - about $18.25 a month - whether it is enabled or disabled
--- 6 findings over 27 rules ---

$3.65 + $32.85 + $365 + $14.60 + $36.50 + $18.25 = $470.85 a month at us-east-1 list prices, 730 hours, before any traffic moves. Nothing is broken: terraform validate passes, plan is clean, and the money starts the hour you apply.

The date nobody put in the code

There is nothing wrong with version = "1.34". It was right when it was written and it is right today. On 2026-12-02 it becomes expensive: that is the day Kubernetes 1.34 leaves Amazon EKS standard support. From the start of that day, in UTC, the same untouched cluster bills $0.60 per cluster-hour instead of $0.10 - $438 a month instead of $73, $365 more every month, per cluster. The only thing that changed was the calendar.

It is already true behind you: 1.33 left standard support on 2026-07-29, 1.32 on 2026-03-23, 1.31 on 2025-11-26 - force-upgraded on 2026-11-26. A repository that pinned a version eighteen months ago has paid the higher rate ever since, and no alert fired, because nothing went wrong.

Why the assistant cannot see it

An assistant writes map_public_ip_on_launch = true for a private subnet because in most of the text it learned from, a public IPv4 was free. It stopped being free on 2024-02-01: $0.005 per hour per address, in use or idle - $3.65 a month per instance. The model is not lying; it is quoting a world that ended.

The gap runs through the other rules too. single_nat_gateway = false reads like a high-availability setting - it is also one NAT gateway per availability zone at $0.045 an hour each, $98.55 a month across three zones. gp2 is $0.10 per GB-month against $0.08 for gp3. And retention_in_days = 0 is not "no retention": it is Never Expire, at $0.50 per GB ingested.

What a cost estimator does not tell you

Cost estimators price what you asked for: they will tell you the NAT gateway costs $32.85 a month. They will not tell you the line did not have to exist, nor that a version string nobody touched changes price by itself on a date already in the calendar.

What it is

A VS Code and Open VSX extension, and a free web page that runs the identical 27 rules. Open a .tf, a CloudFormation template or a Kubernetes manifest: every line that starts a standing charge is named, with its published us-east-1 price and, where the price moves on a date, the date.

Checking the file you have open is free and complete - all 27 rules, no key, no limit, no watermark. The licence covers a different job: every file in the repository at once, a CSV, JSON or HTML report for a budget review, and machine output that exits non-zero so a pipeline can stop a merge that adds a standing charge. $29 once, one licence key per person or team seat.