# Terraform Plan & Drift Explorer

> Paste terraform show -json: drift, replacement reasons, attribute diffs and risky deletes. Paste the JSON of a saved plan (`terraform show -json tfplan`) or the `terraform plan -json` stream. You get counts per action, every resource change with Terraform's own reason (tainted, cannot update, removed from config…), attribute-level before/after diffs with sensitive values masked and "known after apply" marked, the drift Terraform detected outside of Terraform during refresh, and risk flags for deleting or replacing databases, buckets and other stateful resources or for opening access.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://terraformdriftexplorer.usefulweb.site/ (interactive tool at https://terraformdriftexplorer.usefulweb.site/tool)
- JSON API: POST https://terraformdriftexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://terraformdriftexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://terraformdriftexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://terraformdriftexplorer.usefulweb.site/mcp - tool `terraform_drift_explorer`

## Inputs
- text (textarea): Terraform plan JSON - Run `terraform plan -out=tfplan && terraform show -json tfplan` (full detail) or paste `terraform plan -json` output (actions and reasons only, no attribute values).
- file (file): Or upload the file - Read in memory as UTF-8 text and not stored. Max 5 MiB.
- showNoOp (boolean): List unchanged (no-op) resources too

## Method
- Reads the documented Terraform JSON plan format: resource_changes[].change.actions (["delete","create"] = destroy-then-create replacement, ["create","delete"] = create_before_destroy), action_reason, replace_paths, previous_address (moved), importing; resource_drift[] for changes made outside Terraform; output_changes.
- Attribute diffs flatten before/after into dotted paths; after_unknown marks values "known after apply"; any path covered by before_sensitive/after_sensitive is replaced by "(sensitive value)" and never shown.
- Drift: before = last state, after = refreshed real-world value. If the same address has an update planned, applying reverts the drift; a no-op plan means the configuration already matches (or ignore_changes).
- Risk: delete/replace of a stateful type (databases, buckets, volumes, queues, keys, secrets, DNS zones…) is critical; other deletes high; other replacements medium; updates that open 0.0.0.0/0, grant "*" principals/actions, disable deletion protection, encryption, backups or S3 public-access blocks are high; force_destroy / skip_final_snapshot on deletion escalate.
- The plan -json stream contains actions and reasons but no attribute values, so attribute diffs and value-based checks need the show -json form.