A Budget Somebody Actually Hears About
A budget with no notification tracks correctly and tells nobody, so the invoice is the first notice; ACTUAL-only alerts arrive after the money is gone. And include_credit defaults true, so a budget on a credited account reports runway rather than spend - until the credits end and nothing crosses a threshold.
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested on registry.opentofu.org/hashicorp/aws - applied, verified, destroyed
Last verified 2026-10-31 · tofu 1.12.1 · how we verify
Use it from the registry
terraform · opentofumodule "budgets" {
source = "www.iac-bazaar.com/iac-bazaar/aws-budgets/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/aws-budgets?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [A Budget Somebody Actually Hears About](https://www.iac-bazaar.com/catalog/aws-budgets?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "budgets" {
source = "www.iac-bazaar.com/iac-bazaar/aws-budgets/aws"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-budgets
A budget somebody actually hears about, measured on money you are really going
to be charged. Works with Terraform and OpenTofu (>= 1.6), AWS provider
>= 6.0, < 7.0.
A budget with no notification is a number nobody sees. AWS creates one happily: it appears on the Budgets page, tracks correctly, and tells nobody anything - so the first notice of an overrun is the invoice. A precondition refuses it, and a second refuses a notification with no subscribers at all, which fires into nothing.
An ACTUAL-only notification arrives after the money is spent. ACTUAL
fires once you have already crossed the threshold; FORECASTED fires while
there is still time left in the period to do something. Most budgets are created
with ACTUAL only, which makes them a receipt rather than a warning. A
precondition refuses that unless accept_actual_only states it.
include_credit defaults to true, and that is the subtle one. A budget that
counts credits reports you comfortably under budget for as long as the credits
last - and the month they run out, the bill changes shape with no warning and no
threshold crossed, because from the budget's point of view nothing changed. If
you are running on credits, this single setting decides whether your budget
measures your spend or your runway. false here, and measures_real_spend is
an output.
use_amortized defaults to false, which puts the whole of a Savings Plan or
Reserved Instance purchase into the month you bought it: one breach, then eleven
months of a budget that looks wrong. true here.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-control-tower
A Control Tower landing zone from a manifest the module writes: the governed regions (the only usable ones), the Security and Sandbox units, centralized logging in the log archive account you name kept a year (access logs ten) under your KMS key (the AWS-managed key by name), the audit account, Identity Center access, and the controls you map to organizational units.
aws-account-baseline
The IAM password policy, S3 account-wide Block Public Access and, per region, default EBS encryption, snapshot and AMI sharing blocks, IMDSv2 as the default and the serial console off. Five of these are per region, so the module covers a list. The password policy follows NIST SP 800-63-4, and the module says which settings destroying it turns back off.
aws-cost-anomaly-detection
AWS Cost Anomaly Detection with monitors and the alerts that make them useful. A monitor alone leaves anomalies in the console; AWS sends immediate alerts only over SNS and summaries only by email, so this module builds both, with a topic encrypted by a key the service may use. It needs a cost threshold, and says an account holds one AWS services monitor.
aws-organizations
The organization, its organizational units, member accounts and the service control policies attached to them. Root attachment is off by default, because an SCP sets the ceiling on what anybody may do - including the account root user who would have to undo it.
aws-account-contacts
The alternate contacts AWS uses when something is wrong with an account. Without a security contact, abuse reports and vulnerability notices go only to the root user's mailbox - what Security Hub's Account.1 and CIS v5.0.0 control 1.2 check for. The module refuses to run without one unless told to, and validates what the API accepts, which is not what the provider checks.
gcp-billing-budget
The API accepts a budget with default recipients disabled and no channel, topic or threshold rule - a number that is tracked and never sent anywhere. Refuses that, insists on a FORECASTED_SPEND rule, and defaults credit_types_treatment to EXCLUDE_ALL_CREDITS, because a budget that counts credits measures your runway, not your spend, and looks healthy until the month they run out.