Terraform plan risk check

Why plans get approved without being read

A Terraform plan can run to thousands of lines, and the line that matters, such as a database marked for replacement, looks just like the hundreds of harmless tag changes around it. Reviewers skim, the apply runs, and a forced replacement deletes data or takes a service down. This check reads the plan's JSON and puts the risky changes at the top.

What it checks

• Stateful resources destroyed (PG001). Databases, buckets, volumes, queues, keys and other resources that hold data, marked for deletion or replacement, with any skip_final_snapshot or force_destroy settings that make it worse.
• Replacements and deletions (PG002, PG003). With the attribute that forces the replacement, and resources removed from the configuration that may only have been renamed.
• Large blast radius (PG004) when a plan deletes or replaces many resources at once, and deletion protection switched off (PG005).
• Ingress open to the internet (PG101) on AWS security groups, Google Cloud firewalls and Azure network security rules, rated critical for SSH, RDP and database ports.
• Public storage (PG102), public databases (PG103), storage created without encryption (PG104), over-broad IAM (PG105) and databases without deletion protection (PG106).

The rules are the same ones our PlanGuard product uses, and the free check is tested to give the same findings on PlanGuard's sample plans. PlanGuard adds a dependency map of everything that relies on a resource being destroyed, data-residency rules, and comments on every pull request.

How to get the plan as JSON

terraform plan -out tfplan
terraform show -json tfplan > plan.json

The binary plan file itself can't be read here; convert it with terraform show -json. OpenTofu works the same way with tofu show -json. The JSON can include resource values, so check your organisation's rules before sharing it; this page reads it in your browser only.

Making plans safer

• Add lifecycle { prevent_destroy = true } to databases, buckets and other resources you can't recreate.
• Turn on deletion protection for databases and load balancers.
• Use moved blocks when renaming resources or moving them into modules, so Terraform doesn't destroy and recreate them.
• Require a second reviewer whenever a plan replaces or deletes a stateful resource.
• Run a check like this one in CI on every pull request, so reviewers see the risk without reading the whole plan.