Chapter 16: AWS Cost & Performance Optimization Guide for Terraform

Cut your AWS bill by 40% and speed up Terraform pipelines. Technical guide to Spot Instances, Right-Sizing, and Terragrunt Caching.

Parallelism

Default Parallelism:

• Terraform defaults to 10 parallel operations
• Can be increased for faster applies

Configuration:

export TF_CLI_ARGS="-parallelism=20"
terragrunt apply

Best Practices:

• Increase parallelism for independent resources
• Reduce parallelism for dependent resources
• Monitor AWS API rate limits

State Size Optimization

Strategies:

• Separate components into modules
• Use isolated state files (already implemented)

1. Exclude unnecessary data sources:
2. Remove unused data sources
3. Use specific filters
4. Clean up old state:
5. Remove deleted resources from state
6. Compact state files

State Cleanup:

# Remove old resources from state
terragrunt state rm aws_instance.old

# Compact state
terraform state pull | terraform state push

Module Caching

Terraform Cache:

• Modules cached in .terraform/
• Provider plugins cached
• Speeds up subsequent runs

Cache Location:

# Default cache
~/.terraform.d/plugins/

# Custom cache
export TF_PLUGIN_CACHE_DIR=/path/to/cache

Right-Sizing

VPC:

• Use single NAT Gateway for dev/test
• Use one-per-AZ for production

EKS:

• Use smaller instance types for dev (t3.medium)
• Use larger types for production (t3.large, m5.large)
• Use Spot instances for dev/test

RDS:

• Use db.t3.micro for dev
• Use db.t3.small or larger for production
• Enable auto-scaling for storage

Reserved Instances

EKS Nodes:

• Purchase Reserved Instances for predictable workloads
• 1-year or 3-year terms
• Up to 72% savings vs On-Demand

RDS:

• Purchase Reserved Instances for databases
• Match instance types to usage
• Consider Multi-AZ for production

Spot Instances

EKS:

eks:
  primary:
    capacity_type: "SPOT"
    instance_types: ["t3.medium", "t3.large"]  # Multiple for fallback

Cost Savings:

• Up to 90% discount vs On-Demand
• Best for dev/test environments
• Use On-Demand for production

NAT Gateway Optimization

Cost:

• Single NAT: ~$32/month + data transfer
• Per-AZ NAT: ~$96/month + data transfer

Optimization:

# Dev: Single NAT
vpc:
  single_nat_gateway: true

# Prod: Per-AZ for HA
vpc:
  single_nat_gateway: false
  one_nat_gateway_per_az: true

Alternative:

• Use NAT Instances (cheaper but less reliable)
• Use VPC endpoints (eliminate NAT for AWS services)

VPC Endpoints

S3 Endpoint:

resource "aws_vpc_endpoint" "s3" {
  vpc_id       = module.vpc.vpc_id
  service_name = "com.amazonaws.us-east-1.s3"
  route_table_ids = module.vpc.private_route_table_ids
}

Benefits:

• No NAT Gateway charges
• Lower latency
• Private connectivity

Cost:

• Free for S3 endpoints
• $7.20/month per endpoint for other services

EKS Performance

Node Group Configuration:

• Use larger instance types (fewer nodes)
• Reduce cluster overhead
• Better resource utilization

Example:

# Good: Fewer, larger nodes
eks:
  primary:
    instance_types: ["m5.large"]
    desired_size: 3

# Bad: Many, smaller nodes
eks:
  primary:
    instance_types: ["t3.small"]
    desired_size: 10

RDS Optimization

Instance Types:

• Use db.t3.medium or larger for production
• Match instance size to workload
• Enable auto-scaling

Storage:

• Use GP3 (cheaper, faster)
• Enable auto-scaling
• Configure backup retention

Multi-AZ:

• Required for production (HA)
• 2x cost but 2x availability
• Automatic failover

Cost Monitoring

AWS Cost Explorer:

• Track costs by resource
• Set budgets
• Create alerts

Cost Allocation Tags:

• All resources automatically tagged
• Track costs by environment, project
• Enable chargeback

Script:

#!/bin/bash
# scripts/cost-report.sh

START_DATE=$(date -d '30 days ago' +%Y-%m-%d)
END_DATE=$(date +%Y-%m-%d)

aws ce get-cost-and-usage \
  --time-period Start=$START_DATE,End=$END_DATE \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=TAG \
  --filter file://filter.json

Performance Monitoring

CloudWatch Metrics:

• EKS cluster metrics
• RDS performance insights
• VPC flow log analysis

Dashboards:

• Create CloudWatch dashboards
• Monitor key metrics
• Set up alarms

Initial Setup

• [ ] Use single NAT Gateway for dev
• [ ] Use smaller instance types for dev
• [ ] Use Spot instances for dev
• [ ] Enable auto-scaling

Ongoing Optimization

• [ ] Review instance sizes monthly
• [ ] Purchase Reserved Instances
• [ ] Use VPC endpoints where possible
• [ ] Clean up unused resources
• [ ] Review backup retention

Production Checklist

• [ ] Use per-AZ NAT for HA
• [ ] Use On-Demand instances
• [ ] Enable Multi-AZ for RDS
• [ ] Configure backup retention
• [ ] Monitor costs daily