terraform-plan-reviewer

terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json

- run: terraform init
- run: terraform plan -out=plan.tfplan
- run: terraform show -json plan.tfplan > plan.json
- uses: actions/upload-artifact@v4
  with: { name: tf-plan, path: plan.json }

# scripts/tf-review.py
import json, sys

plan = json.load(open(sys.argv[1]))
findings = []

for change in plan.get('resource_changes', []):
    actions = change['change']['actions']
    addr = change['address']
    type_ = change['type']

    if 'delete' in actions and 'create' not in actions:
        findings.append(('high', f"Destroying {addr}"))
    if actions == ['delete', 'create']:
        findings.append(('high', f"Replacing {addr} (destroy + recreate)"))
    # ... etc.

for severity, msg in findings:
    print(f"[{severity}] {msg}")

# Drift = current state differs from terraform state without code change
for change in plan.get('resource_changes', []):
    if change['change']['actions'] == ['no-op']:
        # Check for drift annotations
        if change.get('change', {}).get('after_unknown'):
            # Some attribute differs at runtime
            findings.append(('warning', f"Drift detected at {change['address']}: runtime state differs"))

def detect_risky_combos(changes):
    deletes = [c for c in changes if 'delete' in c['change']['actions']]
    creates = [c for c in changes if 'create' in c['change']['actions']]

    risky = []
    # DB destroy + new DB without import — likely data loss
    db_deletes = [d for d in deletes if d['type'] in ('aws_db_instance', 'aws_rds_cluster')]
    db_creates = [c for c in creates if c['type'] in ('aws_db_instance', 'aws_rds_cluster')]
    if db_deletes and db_creates:
        risky.append(('critical', 'Destroying + recreating a database — data loss likely. Use moved/import block.'))

    # IAM role destroy + new role without import — broken permissions
    # ... etc.
    return risky

## Terraform plan review — `<sha>`

**Resources affected:** 12
**Verdict:** ⚠ REVIEW REQUIRED — 3 high-severity flags

### High-severity (must address)

| Severity | Resource                              | Issue                                         |
|----------|---------------------------------------|-----------------------------------------------|
| critical | `aws_s3_bucket.public-data`            | ACL changing private → public-read             |
| critical | `aws_db_instance.orders-prod`          | Destroy + recreate detected (data loss likely) |
| high     | `aws_iam_policy.deploy`                 | Adding "Action": "*" — overly broad             |

### Medium-severity (review)

| Severity | Resource                              | Issue                                         |
|----------|---------------------------------------|-----------------------------------------------|
| medium   | `aws_security_group_rule.app`          | Allow-list expanding from /16 to /8           |

### Low-severity (informational)

| Resource                          | Action       | Notes                          |
|-----------------------------------|--------------|--------------------------------|
| `aws_instance.app-server`          | update        | AMI change (expected)           |
| `aws_route53_record.api`           | update        | TTL change                     |
| ...                                |              |                                |

### Recommended actions

1. **Block this PR.** The S3 bucket public-read change appears
   unintentional (commit message doesn't mention it).
2. **Move-block the DB.** Use `moved {}` or `import {}` blocks to
   migrate without destroy + recreate.
3. **Narrow the IAM policy.** "*" Action is rarely correct; specify
   the needed actions.