Use terraform-plan-review

Review a terraform plan before apply, from the plan text or terraform show -json output

Review a terraform plan before apply, from the plan text or terraform show -json output. Flags every destroy and replace with the attribute forcing it, changes to stateful resources such as databases, buckets and volumes, IAM and security-group widening, drift nobody made in code, and changes outside the intended scope, then gives a SAFE TO APPLY, APPLY WITH CARE or DO NOT APPLY verdict with reasons.

Reach for it when the user pastes a plan, says "review this terraform plan", "is this plan safe to apply", "why is terraform replacing my database", or "check the plan before I apply".

Install it

npx skilldrop-cli install terraform-plan-review                 # Claude Code, your user folder
npx skilldrop-cli install terraform-plan-review --project       # Claude Code, this repo
npx skilldrop-cli install terraform-plan-review --ide cursor    # or kiro, codex, antigravity, copilot

It is part of the Infrastructure as code pack: --pack infra-as-code installs it with its neighbours.

It ships scripts, so it needs Python 3 (standard library only, nothing to install). What they may touch is declared in its manifest.

Ask for it

Say it the way you would to a colleague. Requests like these route to it:

• "Review this terraform plan before I apply it"
• "Why does terraform want to replace my RDS instance? Plan output attached"
• "Here's terraform show -json for tomorrow's change, is it safe to apply?"
• "Check this plan for destroys, IAM widening and drift before we run apply in prod"

Requests like these belong to a different skill, so it shouldn't answer them:

• "Review the Terraform changes in this pull request diff before I merge"
• "Plan the migration of our Postgres database to an encrypted instance with cutover and rollback"
• "Write the on-call runbook for applying infrastructure changes and rolling them back"

If another skill answers instead, ask for this one by name: "use terraform-plan-review".

Check what you get

A good result:

• Every destroy and replace is listed by full address with its cause. The attribute forcing the replacement is named, from replace_paths or # forces replacement.
• Every stateful resource that is destroyed or replaced says what data is at risk and what recovers it. Missing backups are called out, not assumed.
• Access changes quote the before and after of the rule or statement, and say whether access widens or narrows.
• Drift is reported separately from intended change, with whether the plan reverts it.
• Out-of-scope changes are listed against the user's stated intent.
• Exactly one verdict, with the reasons behind it and a numbered "Before you apply" list.
• No invented resources or attributes. Every address and attribute in the review appears in the plan the user supplied.
• No secret values are echoed from the plan, even when the plan contains them.

See a worked example

• northwind orders

Use something else when

• Reviewing the HCL or application code diff in a pull request: use pre-merge-review
• Writing a new Terraform module: use terraform-module
• Planning a data or platform migration end to end, with cutover and rollback: use migration-plan
• Estimating what the new infrastructure will cost: use capacity-cost-model
• Writing the step-by-step apply and rollback procedure for on-call: use runbook-generator

Next

• SKILL.md, the instructions the agent reads
• Its page on the site
• Related: capacity-cost-model, migration-plan, pre-merge-review, runbook-generator, terraform-module

Edit this page on GitHub · View source