Terraform Plan Explainer

Paste terraform plan output and see creates, updates, deletes and replaces explained, with security findings and a risk score. In-browser, nothing sent.

Advertisement

Terraform Plan Explainer and Risk Analyzer

Paste the output of terraform plan and get a structured, plain-English breakdown of what it is about to do to your infrastructure: how many resources are created, updated, deleted or replaced, which changes are destructive, which attributes force a replacement, and which of them carry a security risk. It reads both the human-readable text plan and the machine-readable JSON produced by terraform show -json, and it runs entirely in your browser — your plan output, which routinely contains resource names, account identifiers and configuration detail, is never transmitted anywhere.

The problem this solves is familiar to anyone who has approved a plan in a hurry. A real plan for a moderately sized stack is hundreds of lines of diff, most of it noise: computed attributes, tag reordering, ARNs that were always going to change. The three lines that matter — the database that will be replaced, the security group that just opened to the world, the S3 bucket losing encryption — are buried in the middle. This tool inverts that: risk first, detail on demand.

What the Analyzer Reports

  • Change summary. Counts of resources to create, update, delete, replace and read, plus a total.
  • Risk score and level. A 0–100 score with a corresponding level, derived from the mix of actions and the security findings, so a plan that only adds resources scores very differently from one that destroys a database.
  • Per-resource annotations. Each resource change gets an expandable card with a plain-English explanation of what is happening, the attributes involved, and recommendations where relevant.
  • Security findings. A separate tab listing issues by severity — Critical, High, Medium — each naming the resource address, the specific problem, and the concrete remediation.
  • Filtering. Narrow the change list by risk level or by action so you can look only at deletions, or only at critical findings.
  • Export. Download the analysis as JSON for tooling, or as Markdown to paste straight into a pull request or change ticket.

How to Use It

  1. Generate a plan. Run terraform plan -out=tfplan in your working directory.
  2. Get the output in a pasteable form. Either copy the console output directly, or — better — run terraform show -json tfplan > plan.json and paste that. The JSON form carries full attribute detail and produces a noticeably richer analysis.
  3. Paste it into the Input tab. The format is detected automatically: JSON is recognised by the presence of format_version or resource_changes, text by the familiar “Terraform will perform the following actions” header or a Plan: N to add line.
  4. Read the Analysis tab. Start with the summary counts and the risk score, then expand any resource whose action is delete or replace.
  5. Read the Security tab before approving. Anything marked Critical should block the apply until it is explained.
  6. Export to Markdown and attach it to the PR so a reviewer sees the same summary you did.

The Five Plan Actions, and Which Ones Should Worry You

SymbolActionMeaningRisk
+createA new resource will be provisionedLow — but check cost and security defaults
~updateModified in place; the resource keeps its identityLow to medium, depending on the attribute
-destroyThe resource and its data are removedHigh — irreversible for stateful resources
-/+replaceDestroyed and recreated because an immutable attribute changedHighest — new identity, new IP, downtime, data loss
<=readA data source will be refreshedNone

Replacement is the action that causes most production incidents, because it looks like a small edit in the source. Changing an RDS instance’s engine_version is an in-place update; changing its identifier is a replacement that destroys the database. Terraform tells you which attribute forced it — the analyzer surfaces that line rather than leaving it in the middle of a 200-line diff.

Security Checks Performed

The analyzer inspects the post-apply state of each resource and raises findings for the patterns that most often turn into incidents:

  • Security groups open to the world. A rule containing 0.0.0.0/0 or ::/0 is flagged High; if the same rule touches a sensitive port — 22 (SSH), 3389 (RDP), 3306 (MySQL), 5432 (PostgreSQL), 1433 (MSSQL), 27017 (MongoDB), 6379 (Redis), 9200 (Elasticsearch) — it is raised to Critical.
  • Public S3 buckets. An ACL of public-read or public-read-write is Critical, with the recommendation to use a scoped bucket policy plus S3 Block Public Access.
  • Publicly accessible databases. publicly_accessible = true on an RDS instance or cluster is Critical.
  • Missing encryption at rest. S3 buckets, EBS volumes and RDS resources created without encryption, or with it explicitly disabled, are flagged High.
  • Over-broad IAM policies. An Allow statement whose resource is * is flagged High against the principle of least privilege.
  • Plain-text credentials. A password attribute that is not a hash is Critical, with a pointer to a secret manager instead.
  • force_destroy on stateful resources. S3 buckets and DynamoDB tables with force_destroy = true are flagged Medium, because that flag deletes contents without prompting.
  • Deletion of database resources. Any planned destroy of an RDS, SQL or similar resource is Critical, with a reminder to confirm restorable snapshots exist.

These are heuristics run against your plan text, not a substitute for a full policy engine such as OPA/Conftest, Sentinel, tfsec or Checkov in CI. Think of it as the review you do with your own eyes, made faster and harder to skip — particularly useful when you are looking at a plan from a repository you do not normally own.

A Worked Example

Suppose a teammate changes an aws_db_instance from db.t3.micro to db.t3.small and, in the same commit, renames the resource’s identifier. The plan shows a single resource block. The analyzer reports one replace rather than one update, explains that the identifier change forces new, and raises a Critical finding for the destruction of a database resource with the recommendation to verify snapshots. That is the difference between a two-minute maintenance window and an outage with data loss — visible before the apply, from a summary rather than a diff.

Frequently Asked Questions

Is my Terraform plan sent to a server?

No. Parsing and analysis happen entirely in your browser; the exports are generated locally as blob downloads. Plan output frequently contains account IDs, resource names and configuration values, which is precisely why this tool has no server side.

Should I paste the text plan or the JSON plan?

JSON, if you can. terraform show -json tfplan gives the analyzer complete before/after attribute maps, which makes the security checks and change explanations substantially more accurate. The text format is supported for convenience when all you have is a console log or a CI job output.

What does -/+ mean in a Terraform plan?

Destroy and then create — a replacement. Terraform cannot change the attribute in place, so the existing resource is deleted and a new one is provisioned. For stateful resources this means data loss unless you have a snapshot, and for anything with an address it means a new IP or endpoint that dependent systems must pick up.

Does this replace tfsec, Checkov or Sentinel?

No. Those scan your Terraform source or plan with hundreds of maintained policies and belong in CI. This tool analyses a single plan interactively, at the moment of review, and is aimed at making the destructive and risky changes obvious to a human before approval.

Why does it flag a resource I know is intentionally public?

A public load balancer or a static website bucket will legitimately trigger the 0.0.0.0/0 or public-ACL checks. The finding is informational in that case — the value of the check is that it forces the intent to be stated rather than assumed. The Markdown export is a convenient place to record the justification.

Does it support Terraform Cloud, OpenTofu or Terragrunt?

Anything that produces standard Terraform plan output works, because that is all the parser looks at. OpenTofu’s plan format is compatible; Terragrunt wraps Terraform and emits the same plan text.

Can I use the export in a pull request?

Yes — that is what the Markdown export is for. It contains the summary counts, risk level and score, and the findings, formatted to paste directly into a PR comment or a change-management ticket.

What if it says it cannot detect the format?

The input is missing the markers the parser looks for. Make sure you have included the header line and the Plan: N to add, N to change, N to destroy summary, or switch to the JSON output, which is unambiguous.

Related Tools

For the Kubernetes side of the same review, the Kubernetes manifest validator applies equivalent security checks to YAML workloads. If you are converting plan JSON between formats, the YAML to JSON converter and JSON formatter are useful companions, and the diff checker helps when comparing two plans across commits.

What Is a Terraform Plan Explainer

A Terraform plan explainer interprets and summarizes the output of terraform plan—the command that previews infrastructure changes before they are applied. Terraform, by HashiCorp, is the leading infrastructure-as-code (IaC) tool used to provision and manage cloud resources across AWS, Azure, GCP, and hundreds of other providers. The plan output shows exactly what Terraform will create, modify, or destroy, but its raw format can be dense and difficult to parse quickly.

Reading Terraform plans correctly is critical: a misunderstood plan can lead to accidental resource deletion, security group changes that expose services, or cost overruns from oversized instances. A plan explainer breaks down the raw output into clear summaries, highlights risky changes, and identifies the resources affected.

How Terraform Plans Work

When you run terraform plan, Terraform compares your configuration files (.tf) against the current state file (terraform.tfstate) and the actual cloud infrastructure. It then generates an execution plan showing the difference:

SymbolMeaningRisk Level
+Resource will be createdLow
-Resource will be destroyedHigh
~Resource will be updated in-placeMedium
-/+Resource must be replaced (destroy then create)High
<=Data source will be readNone

Key sections of a plan:

  • Resource changes: The core of the plan, showing each resource and its planned changes
  • Known after apply: Values that can only be determined after creation (like auto-generated IDs)
  • Outputs: Changes to output values that may affect dependent configurations
  • Move summary: Resources being refactored to new addresses without destruction

A typical plan output line looks like:

# aws_instance.web will be updated in-place
~ resource "aws_instance" "web" {
    ~ instance_type = "t3.micro" -> "t3.large"
  }

Common Use Cases

  • Change review: Understand exactly what infrastructure changes will occur before applying
  • Pull request review: Include plan output in PR descriptions for team review of IaC changes
  • Cost impact analysis: Identify resource size changes that will affect cloud spending
  • Security review: Spot changes to security groups, IAM policies, or encryption settings
  • Blast radius assessment: Determine how many and which resources a change affects

Best Practices

  1. Always run plan before apply — Never use terraform apply without reviewing the plan first, especially in production
  2. Watch for destroy operations — The - and -/+ symbols indicate data loss risk; understand why before proceeding
  3. Use -target for scoped changes — When making large changes, plan against specific resources to reduce blast radius
  4. Save plans for CI/CD — Use terraform plan -out=plan.tfplan to save plans that can be applied exactly as reviewed
  5. Review security-sensitive resources carefully — Changes to aws_security_group, aws_iam_policy, and encryption settings deserve extra scrutiny

Frequently Asked Questions

What formats of Terraform plan output does this tool support?+

This tool supports both the human-readable text output from terraform plan and the JSON output from terraform show -json. It automatically detects the format and parses the plan accordingly. JSON output provides more detailed information for analysis.

How does the tool calculate risk scores for resource changes?+

Risk scores are calculated based on several factors including the type of action (create, update, delete, replace), the resource type, and specific attribute changes. Destructive actions like delete or replace score higher risk, and critical resources like databases or security groups receive additional risk weighting.

What types of security issues does the tool detect?+

The tool identifies common security issues such as overly permissive security group rules (like 0.0.0.0/0 access), publicly accessible resources, missing encryption settings, and SSH access from the internet. Each issue includes a severity rating and specific remediation recommendations.

Can I export the analysis results for documentation or CI/CD pipelines?+

Yes, you can export the analysis in two formats. JSON format is ideal for CI/CD integration and automated processing. Markdown format is better suited for pull request comments, documentation, and human-readable reports. Both exports include the full analysis with risk scores and security findings.

What does it mean when a resource shows replace action?+

A replace action (shown as -/+ in Terraform output) means the resource will be destroyed and recreated. This happens when certain attributes are changed that cannot be updated in-place, such as changing an instance class that forces replacement. Replace actions carry higher risk because they cause temporary resource unavailability.

Is my Terraform plan data sent to any external servers?+

No, all analysis is performed entirely in your browser. Your Terraform plan data never leaves your device and is not transmitted to any servers. This makes the tool safe to use with sensitive infrastructure configurations without any data privacy concerns.

This tool is provided for informational and educational purposes only. All processing happens in your browser — no data is sent to or stored on our servers. While we strive for accuracy, we make no warranties about the completeness or reliability of results.