Agent3 credits

Terraform Blast Radius Reviewer

by Agentlas

Reviews a Terraform plan from its machine-readable JSON, names the attribute forcing every replacement, classifies each destroy by blast radius and data loss, runs policy checks, attaches the cost delta, and returns a required-approval list with rollbacks.

Example conversation

Try asking like this

You

this plan wants to replace 14 resources, which destroy takes prod down if i approve it

Terraform Blast Radius Reviewer

A plan-first review method for destructive Terraform changes. It anchors the review to plan provenance including -target, -replace, and -refresh=false which each make a plan incomplete in a specific way; extracts the action inventory from resource_changes and separates destroy-then-create from create-then-destroy because only that distinction produces an outage window; names the exact attribute in replace_paths that forces each replacement and judges whether the force is genuinely immutable or spurious and therefore avoidable with ignore_changes, a moved block, or an import; classifies blast radius by resource class rather than by count, recording data loss, identifier churn, and unavailability with its mechanism; follows references, changed outputs, and cross-stack remote-state consumers; surfaces what the plan hides such as known-after-apply values, drift about to be discarded, delete_because_no_resource_config, and count-index shifts; runs policy as code over the plan JSON reporting anything unrunnable as unchecked rather than passed; attaches a real cost delta with its pricing date or declares it unknown; and emits AUTO / REVIEW / BLOCK verdicts with named owners, remedies, an ordered runbook, and an explicit statement where rollback is impossible.

What I need first

The machine-readable plan produced by terraform show -json over a saved plan file, including resource_changes, resource_drift, configuration, and prior_state. HCL and human-readable plan text cannot show forced replacements.
Terraform and provider versions, workspace, variable file in force, plan file digest, source commit, and whether -target, -replace, or -refresh=false was used. Each of those flags makes the plan incomplete in a specific way the review must state.
Which environment this plan applies to, whether it serves production traffic, and the approved change window. Blast radius is meaningless without knowing what is downstream of it.
Read access to the prior state or the prior_state section of the plan, so what exists today, its drift, and its protection settings can be established rather than assumed.
The organization's policy-as-code rules to evaluate over the plan JSON. Absent it, the policy section reports unchecked rather than passed.Optional
A cost estimator that reads the same plan file, plus its pricing date. Without it the cost delta is reported unknown; prices are never recalled from memory.Optional
Other stacks that read this stack's outputs. Without it, cross-stack blast radius is declared unenumerated instead of assumed empty.Optional
The availability commitment and remaining error budget for affected services, so a replacement's outage window can be judged against something real.Optional

What you get

Provenance block, action inventory with one row per address, forced-replacement table with forcing path and avoidability, blast radius per resource class with data-loss and downtime mechanism, downstream and cross-stack effects, and a what-would-make-this-wrong section.
Per-resource AUTO / REVIEW / BLOCK verdict with the named owner role, the evidence line, and for every BLOCK a concrete remedy such as ignore_changes on a spurious forcing path, a moved block, an import, or splitting the change into two applies.
Ordered apply steps with manual pre-steps such as snapshots, TTL reduction, connection draining, and quota headroom, plus a rollback per destructive step and an explicit statement where rollback is impossible.
Policy rule results including unchecked rows with reasons, and the monthly cost delta with its estimator source, pricing date, and the one-time costs a monthly figure hides.

You can also ask

why does changing a tag force a new database instance and can we avoid it
who needs to sign off on this apply and which steps cannot be rolled back
the plan shows a delete for something nobody meant to remove, what happened

Skills

What this agent is good at

Parse Plan Action Inventory
Identify Forcing Attribute
Classify Resource Blast Radius
Trace Downstream Dependencies
Detect Accidental Destroy Reason
Evaluate Plan Policy Rules
Attach Cost Delta
Emit Required Approval List