Terraform Plan Risk Viewer

What is the Terraform Plan Risk Viewer?

The Terraform Plan Risk Viewer parses your terraform plan JSON output and classifies every resource change by risk level. It highlights destructive operations — deletions and replacements — on sensitive resources like IAM roles, Security Groups, RDS instances, S3 buckets, and KMS keys, giving you a clear risk summary before you run terraform apply.

How to Use

1. Generate plan JSON: terraform plan -out=plan.tfplan && terraform show -json plan.tfplan
2. Paste the JSON output into the input field
3. Review the color-coded risk breakdown (Critical, High, Medium, Low)
4. Pay attention to destructive operations on sensitive resources
5. Use the summary to make an informed decision about applying changes

Example: Terraform Plan JSON

This is what a typical Terraform plan JSON structure looks like:

{
  "format_version": "1.2",
  "terraform_version": "1.5.7",
  "resource_changes": [
    {
      "address": "aws_security_group.web",
      "type": "aws_security_group",
      "name": "web",
      "change": { "actions": ["delete", "create"] }
    },
    {
      "address": "aws_instance.app",
      "type": "aws_instance",
      "name": "app",
      "change": { "actions": ["update"] }
    },
    {
      "address": "aws_s3_bucket.logs",
      "type": "aws_s3_bucket",
      "name": "logs",
      "change": { "actions": ["create"] }
    }
  ]
}

Risk Level Classification

• Critical — Destructive operations (delete/replace) on sensitive resources: IAM, Security Groups, RDS, S3, KMS
• High — Destructive operations on non-sensitive resources, or updates to sensitive resources
• Medium — Updates to non-sensitive resources
• Low — New resource creation (generally safe)

Sensitive Resource Types

The following AWS resource types are classified as sensitive due to the potential blast radius of destructive changes:

• IAM — aws_iam_* (roles, policies, users, groups)
• Security Groups — aws_security_group* (network access controls)
• RDS — aws_db_instance, aws_rds_cluster (databases)
• S3 — aws_s3_bucket* (object storage)
• KMS — aws_kms_* (encryption keys)

Best Practices for Terraform Plan Review

• Always run terraform plan before apply and review changes carefully
• Pay special attention to replace operations — they destroy and recreate resources
• Use lifecycle prevent_destroy on critical resources to guard against accidental deletion
• Consider using -target flags to limit the scope of risky applies
• Enable deletion protection on RDS instances and S3 buckets where possible
• Keep Terraform state locked during apply to prevent concurrent modifications

Privacy and Security

All analysis happens entirely in your browser using JavaScript. Your Terraform plan JSON — which may contain resource addresses, infrastructure details, and configuration values — is never transmitted to any server. No data is stored, logged, or shared.