A few weeks ago I was learning Terraform on AWS, doing exactly what every
beginner does — following a tutorial, copy-pasting a VPC + NAT Gateway
setup because "it's the standard pattern." I didn't know that a NAT
Gateway is billed ~$32.40/month the moment it exists, whether it's
handling traffic or sitting completely idle.
AWS Free Tier isn't one big "everything's free" cap. It's a patchwork —
some things are always free, some are free for 12 months, some are free
up to a limit, and some things are never free, no matter how "free" the
subnet around them looks. Nothing tells you this at terraform plan
time. You find out when the bill shows up.
So I built TierGuard — a small, free, open-source CLI that reads
your Terraform plan and tells you, resource by resource, whether it's
actually going to stay free.
What it looks like
$ terraform plan -out plan.tfplan
$ terraform show -json plan.tfplan > plan.json
$ tierguard check plan.json
Before — a plan with a NAT Gateway I thought was free:
BLOCK aws_nat_gateway.nat NAT Gateway is never free
A NAT Gateway is ALWAYS billed (~$32.40/month) even with zero traffic.
Remove the NAT Gateway. For learning, keep instances on a PUBLIC subnet...
Exiting with code 1 - fix the 1 blocking finding(s) before terraform apply.
After — remove it, re-check:
$ tierguard check plan.json
All clear - every resource fits the AWS Free Tier.
It catches this before apply — not after AWS Budgets emails you a
week later.
Why not just use Infracost?
Infracost is a great tool, but it's built for teams estimating total
cloud spend. TierGuard is the opposite: a single-purpose, zero-setup
"yes/no, is this Free Tier safe" answer for students and self-learners
who don't have — and don't want — a billing account to worry about.
No AWS credentials needed. No signup. Just a plan file.
What it checks right now (v0.1)
NAT Gateways, EC2 instance types, RDS instance class + storage, load
balancers, unattached Elastic IPs, EBS volume size + provisioned IOPS,
Secrets Manager, ElastiCache, ECS/Fargate, Lambda memory, DynamoDB
capacity, CloudWatch alarms, S3 storage — 18 rules total, based on
current AWS Free Tier terms (and yes, it accounts for the July 2025
restructure to credit-based plans for new accounts).
Rules live in a plain YAML file, not hardcoded — so when AWS changes
what's covered, it's a data update, not a code change.
Try it
pip install tierguard
Repo (open source, MIT): https://github.com/NikkG-300/TierGuard
It's genuinely v0.1 — built, tested against real Terraform plans (not
just mock JSON), but definitely not exhaustive. I'd love to hear what
you think, especially if you hit a resource type it doesn't catch or a
rule that seems off. Feel free to open an issue or drop a comment here —
I'm genuinely happy to hear feedback of any kind, good or critical, as
I figure out what the next version should focus on.
Top comments (0)