Preview Infrastructure Cost and Blast Radius Before You Deploy

Now suppose a teammate changes the DB instance class and generates a new plan:

╔══════════════════════════════════════════════════════════╗
║                   DeployDiff Cost Estimate                ║
╠══════════════════════════════════════════════════════════╣
║ Resource                        Current     New      Δ   ║
║ ──────────────────────────────────────────────────────── ║
║ aws_db_instance.main           $17.52   $267.43 +$249.91║
╚══════════════════════════════════════════════════════════╝
⚠ Cost increase: $249.91/mo — above default threshold

5. Generate Rollback Commands

When things go wrong, every second counts. Don't google Terraform rollback syntax under incident pressure:

╔══════════════════════════════════════════════════════════╗
║                   DeployDiff Rollback                     ║
╠══════════════════════════════════════════════════════════╣
║ To roll back the last apply:                             ║
║                                                          ║
║   1. terraform plan -destroy -out=rollback.tfplan        ║
║   2. terraform apply rollback.tfplan                     ║
║                                                          ║
║ Resources that would be removed:                         ║
║   aws_db_instance.main                                   ║
║   aws_s3_bucket.logs                                     ║
║   aws_iam_role.app_role                                  ║
╚══════════════════════════════════════════════════════════╝

These are ready to copy-paste — no syntax guessing under fire.

6. CI/CD Pipeline — Gate on Cost and Destructive Changes

Here's the real value: gating deployments automatically. Add this GitHub Actions workflow to your IaC repo:

# .github/workflows/deploy-preview.yml
name: Deploy Preview

on:
  pull_request:
    paths:
      - 'terraform/**'
      - '*.tf'

jobs:
  preview:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Plan
        run: |
          terraform init
          terraform plan -out=plan.tfplan
          terraform show -json plan.tfplan > plan.json

      - name: Install DeployDiff
        run: pip install deploydiff

      - name: Preview infrastructure changes
        run: deploydiff preview --tf plan.json

      - name: Check cost impact
        id: cost
        run: |
          deploydiff cost --tf plan.json --threshold 200
          echo "cost_exceeded=$?" >> $GITHUB_OUTPUT

      - name: Check for destructive changes
        id: destructive
        run: |
          deploydiff preview --tf plan.json --exit-on-destroy
          echo "has_destroys=$?" >> $GITHUB_OUTPUT

      - name: Comment PR with report
        if: always()
        uses: actions/github-script@v7
        with:
          script: |
            const costExceeded = '${{ steps.cost.outputs.cost_exceeded }}' === '1';
            const hasDestroys = '${{ steps.destructive.outputs.has_destroys }}' === '1';
            let body = '## DeployDiff Preview\n\n';
            if (costExceeded) body += '⚠️ **Cost exceeds $200/mo threshold**\n';
            if (hasDestroys) body += '🚨 **Destructive changes detected (resources will be replaced/destroyed)**\n';
            body += '\nReview the DeployDiff output above before approving.';
            await github.rest.issues.createComment({
              ...context.repo,
              issue_number: context.issue.number,
              body
            });

Now every PR that touches infrastructure gets:

• ✅ A resource-level diff summary
• ✅ Cost impact flagged if above threshold
• ✅ Alert if any resources are being destroyed or replaced
• ✅ A PR comment with any warnings

Command Reference

Supported Providers

Real-World Scenario: The $2,400 Cost Regression

A fintech team was reviewing a PR that bumped their RDS instance class "for better performance." The change would have cost an extra $2,400/month across their multi-region setup. DeployDiff caught it in the PR — the reviewer saw the cost column and said "let's benchmark first." They optimized queries instead and never needed the upgrade. Without DeployDiff, the change would have sailed through code review (it was a one-line diff) and shown up on next month's AWS bill.

Next Steps

DeployDiff is one of 10 tools in the Revenue Holdings suite. Each one runs in CI to catch problems before they hit production:

• ConfigDrift — Detect environment drift before it breaks production (tutorial)
• API Contract Guardian — Catch breaking API schema changes in PRs
• json2sql — Convert JSON to SQL INSERT statements (tutorial)
• DeadCode — Remove unused exports, dead routes, and orphaned CSS

Read the full docs →