DevOps & Cloud · Terraform plan review

PlanGuard

Read the plan that matters.

The five lines that decide whether an apply is safe, at the top of every Terraform pull request, before anything in production is destroyed.

Platform teamsTerraform consultanciesRegulated startups

Book a PlanGuard demo See pricing

planguard

$ planguard --help
→ Risk summary on every pull request
→ Blast-radius report
→ CI integration

What the product produces.

Readsterraform show -json

FlagsDestroys, replaces, exposures

Runs onYour laptop, server or CI

Shows inPull request comment

The problem

Nobody reads a 2,000-line plan carefully at 6 pm. Destroyed databases and replaced resources slip through review.

What it does

Flags destroys, replacements and changes to protected resources

Blast-radius analysis that follows dependencies and module variables

Pull request comment for GitHub Actions and GitLab CI

Data residency guard: flags databases, replicas and backups created outside your allowed regions

Custom rules for protected resources and required tags

Local workbench for reviewing a plan JSON

How it works

Run terraform show -json on the plan
Plan Guard scores the change and its blast radius
Block or approve the pull request with the summary

Works with

TerraformOpenTofuGitHub ActionsGitLab CI

Runs in your CI

GitHub Actions workflow step

- run: terraform plan -out plan.out && terraform show -json plan.out > plan.json
- uses: ./.github/actions/terraform-plan-guard
  with:
    plan-json: plan.json
    fail-on: critical
    allowed-regions: ap-south-1,ap-south-2   # data residency guard

Licensed customers get the action or command-line tool installed in their own organisation; it runs on your runners, so your code and plans never leave them. The command-line tools run in GitLab CI the same way.

Your data

Runs in your pipeline on the plan file; no cloud credentials needed.
Nothing is applied or changed.
Plans never leave your runners.

Who it's for

Platform teamsTerraform consultanciesRegulated startups

Questions

What does it flag?

Destroyed or replaced stateful resources, public exposure, IAM widening and other changes worth a second look.

Will it block merges?

Only if you ask it to; by default it comments and leaves the decision to the reviewer.

Often used with PlanGuard

DevOps & Cloud

BlastRadar

Change impact analysis

Know what a change will touch. Before a release, see every service a change can affect and the line of code that links it. After the release, confirm those services are still healthy.

$300–600 (₹10,000–20,000 in India)View product → DevOps & Cloud

SLOStudio

SLOs and error budgets

Reliability you can measure. Define each SLO in a few lines and get correct burn-rate alerts, an error budget everyone understands, and a release gate, on the monitoring you already run.

$1,500–3,000 (₹40,000–80,000 in India)View product → DevOps & Cloud

TestScope

Test impact selection

Run the tests that matter. Every pull request runs the tests its change can affect, each with a stated reason, and the full suite whenever a change is too broad to trust.

$1,000–2,500 (₹25,000–60,000 in India)View product →

← PreviousCostLeak Next →ContractCheck

See PlanGuard on your own data

A 30-minute call. We run the product on your export, repository or document and walk you through the results.

Book a demo