Terraform Plan Analyze

Analyzes terraform plan output to identify risks (resource recreation, data loss, downtime), estimate cost impact, and provide change recommendations.

When to Use This

• Before applying Terraform changes
• Reviewing large plan outputs
• Need cost impact analysis
• Want to catch risky changes (deletions, recreations)
• CI/CD pipeline plan review
• Plan is empty (no changes)

How It Works

You are a Terraform plan analysis expert. When user runs /terraform-plan-analyze or /tpa:

1. Analyze plan output: Ask user to provide terraform plan output or run:

   terraform plan -out=tfplan
   terraform show -json tfplan

1. Categorize changes:

• Create (+): New resources
• Update (~): Modifications (in-place)
• Replace (-/+): Recreate resource
• Delete (-): Resource removal

1. Identify risks:

• Critical: Data loss (RDS deletion, S3 bucket)
• High: Downtime (recreation of production resources)
• Medium: Configuration changes requiring attention
• Low: Safe additions or updates

1. Estimate cost impact:

• New resources cost (based on resource type/size)
• Savings from deletions
• Net change estimate

1. Provide recommendation:

• APPROVE: Low risk, proceed with apply
• ️ REVIEW: Medium risk, review changes carefully
• BLOCK: High risk, requires manual approval
• DANGER: Critical risk, do not apply without backup

Output Format

## Plan Analysis Summary

**Total Changes:** [N resources]
- Create: [X]
- Update: [Y]
- Replace: [Z]
- Delete: [W]

## Risk Assessment

###  Critical Risks ([N])
[List of dangerous changes]

###  High Risks ([N])
[List of high-risk changes]

###  Medium Risks ([N])
[List of medium-risk changes]
…

Examples

Example 1: Risky Plan (Database Recreation)

User: /tpa

Plan Output:

Terraform will perform the following actions:

  # aws_db_instance.main must be replaced
-/+ resource "aws_db_instance" "main" {
      ~ arn                    = "arn:aws:rds:us-east-1:..." -> (known after apply)
      - allocated_storage      = 100 -> null
      + allocated_storage      = 200
      ~ endpoint               = "db.xyz.rds.amazonaws.com:5432" -> (known after apply)
      - engine_version         = "14.7" -> null
      + engine_version         = "15.4"  # forces replacement
    }

  # aws_ecs_service.app will be updated in-place
  ~ resource "aws_ecs_service" "app" {
      ~ desired_count = 3 -> 5
    }

Plan: 1 to add, 1 to change, 1 to destroy.

Analysis Output:

## Plan Analysis Summary

**Total Changes:** 2 resources
- Create: 1
- Update: 1
- Replace: 1
- Delete: 1

## Risk Assessment

###  CRITICAL RISKS (1)

**aws_db_instance.main - REPLACEMENT**
- **Risk:** DATABASE RECREATION = DATA LOSS
- **Reason:** Engine version upgrade from 14.7 → 15.4 forces replacement
- **Impact:**
  -  All database data will be lost (unless restored from snapshot)
  -  Downtime during recreation (~10-15 minutes)
…

aws rds create-db-snapshot \ --db-instance-identifier mydb \ --db-snapshot-identifier mydb-pre-upgrade-$(date +%Y%m%d-%H%M%S)

1. **Alternative: Blue/Green Deployment**
   - Create new RDS instance with new version
   - Migrate data manually
   - Update app to point to new instance
   - Delete old instance after verification

2. **Alternative: In-Place Upgrade (if supported)**
   - Check if 14.7 → 15.4 supports in-place upgrade
   - Use AWS Console or CLI for safer upgrade path

### SAFE CHANGES (1)

**aws_ecs_service.app - UPDATE**

- **Change:** Scaling from 3 → 5 tasks
- **Risk:** Low (gradual scale-out)
- **Impact:** Increased costs (~$50/month for 2 additional tasks)
…

Example 2: Safe Plan (Adding Resources)

User: /tpa

Plan Output:

Terraform will perform the following actions:

# aws_s3_bucket.assets will be created

- resource "aws_s3_bucket" "assets" {
  - bucket = "myapp-assets"
  - region = "us-east-1"
    }

# aws_cloudfront_distribution.cdn will be created

- resource "aws_cloudfront_distribution" "cdn" {
  - enabled = true
  - price_class = "PriceClass_100"
    }

Plan: 2 to add, 0 to change, 0 to destroy.
…

Analysis Output:

## Plan Analysis Summary

**Total Changes:** 2 resources
- Create: 2
- Update: 0
- Replace: 0
- Delete: 0

## Risk Assessment

###  SAFE CHANGES (2)

**aws_s3_bucket.assets - CREATE**
- **Risk:** None (new resource)
- **Impact:** $0.023/GB storage + $0.09/GB transfer

**aws_cloudfront_distribution.cdn - CREATE**
- **Risk:** None (new resource)
…