Paste terraform plan output and see creates, updates, deletes and replaces explained, with security findings and a risk score. In-browser, nothing sent.
Paste the output of terraform plan and get a structured, plain-English breakdown of what it is about to do to your infrastructure: how many resources are created, updated, deleted or replaced, which changes are destructive, which attributes force a replacement, and which of them carry a security risk. It reads both the human-readable text plan and the machine-readable JSON produced by terraform show -json, and it runs entirely in your browser — your plan output, which routinely contains resource names, account identifiers and configuration detail, is never transmitted anywhere.
The problem this solves is familiar to anyone who has approved a plan in a hurry. A real plan for a moderately sized stack is hundreds of lines of diff, most of it noise: computed attributes, tag reordering, ARNs that were always going to change. The three lines that matter — the database that will be replaced, the security group that just opened to the world, the S3 bucket losing encryption — are buried in the middle. This tool inverts that: risk first, detail on demand.
terraform plan -out=tfplan in your working directory.terraform show -json tfplan > plan.json and paste that. The JSON form carries full attribute detail and produces a noticeably richer analysis.format_version or resource_changes, text by the familiar “Terraform will perform the following actions” header or a Plan: N to add line.| Symbol | Action | Meaning | Risk |
|---|---|---|---|
+ | create | A new resource will be provisioned | Low — but check cost and security defaults |
~ | update | Modified in place; the resource keeps its identity | Low to medium, depending on the attribute |
- | destroy | The resource and its data are removed | High — irreversible for stateful resources |
-/+ | replace | Destroyed and recreated because an immutable attribute changed | Highest — new identity, new IP, downtime, data loss |
<= | read | A data source will be refreshed | None |
Replacement is the action that causes most production incidents, because it looks like a small edit in the source. Changing an RDS instance’s engine_version is an in-place update; changing its identifier is a replacement that destroys the database. Terraform tells you which attribute forced it — the analyzer surfaces that line rather than leaving it in the middle of a 200-line diff.
The analyzer inspects the post-apply state of each resource and raises findings for the patterns that most often turn into incidents:
0.0.0.0/0 or ::/0 is flagged High; if the same rule touches a sensitive port — 22 (SSH), 3389 (RDP), 3306 (MySQL), 5432 (PostgreSQL), 1433 (MSSQL), 27017 (MongoDB), 6379 (Redis), 9200 (Elasticsearch) — it is raised to Critical.public-read or public-read-write is Critical, with the recommendation to use a scoped bucket policy plus S3 Block Public Access.publicly_accessible = true on an RDS instance or cluster is Critical.* is flagged High against the principle of least privilege.force_destroy = true are flagged Medium, because that flag deletes contents without prompting.These are heuristics run against your plan text, not a substitute for a full policy engine such as OPA/Conftest, Sentinel, tfsec or Checkov in CI. Think of it as the review you do with your own eyes, made faster and harder to skip — particularly useful when you are looking at a plan from a repository you do not normally own.
Suppose a teammate changes an aws_db_instance from db.t3.micro to db.t3.small and, in the same commit, renames the resource’s identifier. The plan shows a single resource block. The analyzer reports one replace rather than one update, explains that the identifier change forces new, and raises a Critical finding for the destruction of a database resource with the recommendation to verify snapshots. That is the difference between a two-minute maintenance window and an outage with data loss — visible before the apply, from a summary rather than a diff.
No. Parsing and analysis happen entirely in your browser; the exports are generated locally as blob downloads. Plan output frequently contains account IDs, resource names and configuration values, which is precisely why this tool has no server side.
JSON, if you can. terraform show -json tfplan gives the analyzer complete before/after attribute maps, which makes the security checks and change explanations substantially more accurate. The text format is supported for convenience when all you have is a console log or a CI job output.
-/+ mean in a Terraform plan?Destroy and then create — a replacement. Terraform cannot change the attribute in place, so the existing resource is deleted and a new one is provisioned. For stateful resources this means data loss unless you have a snapshot, and for anything with an address it means a new IP or endpoint that dependent systems must pick up.
No. Those scan your Terraform source or plan with hundreds of maintained policies and belong in CI. This tool analyses a single plan interactively, at the moment of review, and is aimed at making the destructive and risky changes obvious to a human before approval.
A public load balancer or a static website bucket will legitimately trigger the 0.0.0.0/0 or public-ACL checks. The finding is informational in that case — the value of the check is that it forces the intent to be stated rather than assumed. The Markdown export is a convenient place to record the justification.
Anything that produces standard Terraform plan output works, because that is all the parser looks at. OpenTofu’s plan format is compatible; Terragrunt wraps Terraform and emits the same plan text.
Yes — that is what the Markdown export is for. It contains the summary counts, risk level and score, and the findings, formatted to paste directly into a PR comment or a change-management ticket.
The input is missing the markers the parser looks for. Make sure you have included the header line and the Plan: N to add, N to change, N to destroy summary, or switch to the JSON output, which is unambiguous.
For the Kubernetes side of the same review, the Kubernetes manifest validator applies equivalent security checks to YAML workloads. If you are converting plan JSON between formats, the YAML to JSON converter and JSON formatter are useful companions, and the diff checker helps when comparing two plans across commits.
A Terraform plan explainer interprets and summarizes the output of terraform plan—the command that previews infrastructure changes before they are applied. Terraform, by HashiCorp, is the leading infrastructure-as-code (IaC) tool used to provision and manage cloud resources across AWS, Azure, GCP, and hundreds of other providers. The plan output shows exactly what Terraform will create, modify, or destroy, but its raw format can be dense and difficult to parse quickly.
Reading Terraform plans correctly is critical: a misunderstood plan can lead to accidental resource deletion, security group changes that expose services, or cost overruns from oversized instances. A plan explainer breaks down the raw output into clear summaries, highlights risky changes, and identifies the resources affected.
When you run terraform plan, Terraform compares your configuration files (.tf) against the current state file (terraform.tfstate) and the actual cloud infrastructure. It then generates an execution plan showing the difference:
| Symbol | Meaning | Risk Level |
|---|---|---|
| + | Resource will be created | Low |
| - | Resource will be destroyed | High |
| ~ | Resource will be updated in-place | Medium |
| -/+ | Resource must be replaced (destroy then create) | High |
| <= | Data source will be read | None |
Key sections of a plan:
A typical plan output line looks like:
# aws_instance.web will be updated in-place
~ resource "aws_instance" "web" {
~ instance_type = "t3.micro" -> "t3.large"
}
terraform apply without reviewing the plan first, especially in production- and -/+ symbols indicate data loss risk; understand why before proceeding-target for scoped changes — When making large changes, plan against specific resources to reduce blast radiusterraform plan -out=plan.tfplan to save plans that can be applied exactly as reviewedaws_security_group, aws_iam_policy, and encryption settings deserve extra scrutinyThis tool supports both the human-readable text output from terraform plan and the JSON output from terraform show -json. It automatically detects the format and parses the plan accordingly. JSON output provides more detailed information for analysis.
Risk scores are calculated based on several factors including the type of action (create, update, delete, replace), the resource type, and specific attribute changes. Destructive actions like delete or replace score higher risk, and critical resources like databases or security groups receive additional risk weighting.
The tool identifies common security issues such as overly permissive security group rules (like 0.0.0.0/0 access), publicly accessible resources, missing encryption settings, and SSH access from the internet. Each issue includes a severity rating and specific remediation recommendations.
Yes, you can export the analysis in two formats. JSON format is ideal for CI/CD integration and automated processing. Markdown format is better suited for pull request comments, documentation, and human-readable reports. Both exports include the full analysis with risk scores and security findings.
A replace action (shown as -/+ in Terraform output) means the resource will be destroyed and recreated. This happens when certain attributes are changed that cannot be updated in-place, such as changing an instance class that forces replacement. Replace actions carry higher risk because they cause temporary resource unavailability.
No, all analysis is performed entirely in your browser. Your Terraform plan data never leaves your device and is not transmitted to any servers. This makes the tool safe to use with sensitive infrastructure configurations without any data privacy concerns.