Skip to content

Infracost API Key

Service Name: Infracost

Service Description: Infracost shows cloud cost estimates for infrastructure-as- code projects. It helps developers and organizations understand the cost implications of their infrastructure changes before deploying to the cloud.

Service Address: https://www.infracost.io/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants access to Infracost's cloud pricing API and enables cost estimation for infrastructure code.

Secret Revokement URL: https://www.infracost.io/docs/integrations/infracost_cloud/#api-keys

Secret Example: ico-1234567890abcdef1234567890abcdef

Suspicious Activity Investigation Instructions:

  • Review Infracost Cloud dashboard for unusual activity or unauthorized usage
  • Check for unexpected cost estimation runs or API calls
  • Monitor for unusual infrastructure cost reports being generated
  • Verify if the API key is being used from unexpected locations or IP addresses
  • Review version control system logs for unauthorized commits containing the API key

Mitigation Instructions:

  • Log in to your Infracost Cloud account
  • Navigate to the API Keys section in your account settings

  • Delete the compromised API key

  • Generate a new API key with appropriate permissions

  • Update the API key in all legitimate applications and CI/CD pipelines
  • Consider implementing environment variables or secrets management solutions

to store the new API key securely

  • Review and update access controls for your Infracost account