Datadog

Connect Datadog to bring live usage metrics from your running infrastructure into Infracost, to enrich any static parsing of your estate.

The integration is read-only. Infracost queries metrics through a Datadog service account access token (SAT) scoped to reading metrics, and writes nothing back to Datadog.

Prerequisites

• Permission in Datadog to create a service account and an access token, which usually means the Datadog Admin Role.
• The Datadog Agent reporting the metrics Infracost reads. See Metrics Infracost reads for what each source requires.

1. Create a service account access token

Create a dedicated read-only service account for Infracost rather than reusing a personal API key, so the access is scoped, auditable, and survives people leaving your team.

Datadog UI

1. In Datadog, go to Organization Settings → Service Accounts, then click New Service Account.
2. Name it Infracost and use the email infracost@<YOUR_DOMAIN.COM>. The email doesn't need to exist, it's only an identifier.
3. Assign the Datadog Read Only Role from the dropdown, then create the account.
4. Open the new account and select + New Token under Access Tokens.
5. Apply these scopes to the token:
   • metrics_read
   • timeseries_query
6. Copy the token. Datadog shows it once.

Terraform

Set credentials for the Datadog Terraform provider, apply, then read the token from the output. Replace <VERSION> with the provider version you want to pin and <YOUR_DOMAIN.COM> with your own domain.

terraform {
  required_providers {
    datadog = {
      source  = "DataDog/datadog"
      version = "<VERSION>"
    }
  }
}

provider "datadog" {
  api_key = var.datadog_api_key
  app_key = var.datadog_app_key
}

data "datadog_role" "read_only" {
  filter = "Datadog Read Only Role"
}

resource "datadog_service_account" "infracost" {
  email = "infracost@<YOUR_DOMAIN.COM>" # The email doesn't need to exist, it's only an identifier
  name  = "Infracost"
  roles = [data.datadog_role.read_only.id]
}

resource "datadog_service_access_token" "infracost" {
  service_account_id = datadog_service_account.infracost.id
  name               = "Infracost"
  scopes = [
    "metrics_read",
    "timeseries_query",
  ]
}

output "infracost_datadog_token" {
  value     = datadog_service_access_token.infracost.key
  sensitive = true
}

Read the token with:

terraform output -raw infracost_datadog_token

See the provider docs for the service account and access token resources.

2. Connect the token in Infracost Cloud

1. In Infracost Cloud, go to Org Settings → Integrations → Add integrations → Datadog.
2. Select the Datadog site your organization is hosted in, for example datadoghq.com for US1 or datadoghq.eu for EU1.
3. Paste the access token and click Save.

The token is encrypted at rest and is never shown again after you save it. Ensure it is saved somewhere safely in your estate.

3. Verify the connection

Saving runs a set of health checks automatically, and the result appears on the integration page within about a minute. You can re-run them at any time with Test.

If Infracost can read everything it needs, you'll see All checks passed. Otherwise you'll see Some checks are failing, naming each check that failed with a Details expander for the specific reason. See Troubleshooting for what each failure means and how to fix it.

A failing check doesn't discard your token. The integration is saved either way, so you can fix the problem in Datadog and re-run Test without re-entering anything.

Rotating the access token

Open the integration from Org Settings → Integrations → Installed integrations → Datadog. Create a new token in Datadog following step 1, paste it into the Access token field, and click Save. The new token replaces the stored one. Revoke the old token in Datadog afterwards.

Removing the integration

Open the integration from Installed integrations and click Delete. Infracost stops querying Datadog and discards the stored token. Delete the service account in Datadog too if nothing else uses it.

Metrics Infracost reads

Infracost reads only the metrics listed below from your Datadog organization.

Kubernetes metrics

These require the Datadog Agent running on your Kubernetes clusters, with both the kubelet check and the kube-state-metrics check enabled. The kubelet check reports measured usage; kube-state-metrics reports the requests and limits set in your manifests. Infracost needs both.

Input	Metrics
CPU usage	kubernetes.cpu.usage.total
CPU requests	kubernetes.cpu.requests kubernetes_state.container.cpu_requested
CPU limits	kubernetes.cpu.limits kubernetes_state.container.cpu_limit
CPU throttling	kubernetes.cpu.cfs.periods kubernetes.cpu.cfs.throttled.periods kubernetes.cpu.cfs.throttled.seconds
Memory usage	kubernetes.memory.usage kubernetes.memory.working_set
Memory requests	kubernetes.memory.requests kubernetes_state.container.memory_requested
Memory limits	kubernetes.memory.limits kubernetes_state.container.memory_limit
Out-of-memory kills and restarts	kubernetes.containers.state.terminated kubernetes_state.container.restarts
Desired workload shape	kubernetes_state.deployment.replicas_desired kubernetes_state.statefulset.replicas_desired kubernetes_state.daemonset.scheduled

The usage, requests and limits inputs are required. Throttling, out-of-memory and workload-shape signals are read when available, as additional context on how a container behaves under its current configuration.

Troubleshooting

Only failing checks are listed on the integration page. Start with Credentials: while it fails the others aren't evaluated, so fix it and re-run Test before reading anything into the rest.

Check	What a failure means
Credentials	The site or the token is wrong. Confirm the Datadog site matches the URL you use to reach Datadog, and that the token carries the metrics_read and timeseries_query scopes. A service account that lost its role also fails here.
Datadog Agent metrics	No kubernetes.* or kubernetes_state.* metrics are visible at all. Check the Agent is installed on your clusters with its Kubernetes integration enabled.
Kubernetes rightsizing metrics	The Agent is reporting but a required metric is missing, named in the Details expander. Missing requests and limits mean kube-state-metrics is disabled; missing usage means the kubelet check is.
Kubernetes workload ingest	Infracost's nightly ingest found no data, which again points at kube-state-metrics.

If a check still fails after fixing the cause, or the workload ingest hasn't reported 24 hours after the others pass, contact support.