Terraform Plan & Drift Explorer

How it works

Paste the JSON of a saved plan (`terraform show -json tfplan`) or the `terraform plan -json` stream. You get counts per action, every resource change with Terraform's own reason (tainted, cannot update, removed from config…), attribute-level before/after diffs with sensitive values masked and "known after apply" marked, the drift Terraform detected outside of Terraform during refresh, and risk flags for deleting or replacing databases, buckets and other stateful resources or for opening access.

• Reads the documented Terraform JSON plan format: resource_changes[].change.actions (["delete","create"] = destroy-then-create replacement, ["create","delete"] = create_before_destroy), action_reason, replace_paths, previous_address (moved), importing; resource_drift[] for changes made outside Terraform; output_changes.
• Attribute diffs flatten before/after into dotted paths; after_unknown marks values "known after apply"; any path covered by before_sensitive/after_sensitive is replaced by "(sensitive value)" and never shown.
• Drift: before = last state, after = refreshed real-world value. If the same address has an update planned, applying reverts the drift; a no-op plan means the configuration already matches (or ignore_changes).
• Risk: delete/replace of a stateful type (databases, buckets, volumes, queues, keys, secrets, DNS zones…) is critical; other deletes high; other replacements medium; updates that open 0.0.0.0/0, grant "*" principals/actions, disable deletion protection, encryption, backups or S3 public-access blocks are high; force_destroy / skip_final_snapshot on deletion escalate.
• The plan -json stream contains actions and reasons but no attribute values, so attribute diffs and value-based checks need the show -json form.