Infrastructure Plan Reviewer

Redacted local IaC review

Review redacted Terraform plan JSON and Kubernetes changes with practical risk policies.

No infrastructure command is executed

Plans and manifests are parsed, redacted and compared locally. This page never contacts a state backend, cluster or cloud account.

Terraform plan JSON

Run terraform show -json tfplan and open or paste the resulting JSON; do not paste a binary plan.

{
  "format_version": "1.2",
  "terraform_version": "1.12.0",
  "resource_changes": [
    {
      "address": "aws_security_group.web",
      "mode": "managed",
      "type": "aws_security_group",
      "name": "web",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": [
          "update"
        ],
        "before": {
          "ingress": [
            {
              "cidr_blocks": [
                "10.0.0.0/8"
              ],
              "from_port": 443
            }
          ]
        },
        "after": {
          "ingress": [
            {
              "cidr_blocks": [
                "0.0.0.0/0"
              ],
              "from_port": 443
            }
          ]
        },
        "before_sensitive": {},
        "after_sensitive": {},
        "after_unknown": {}
      }
    },
    {
      "address": "aws_db_instance.primary",
      "mode": "managed",
      "type": "aws_db_instance",
      "name": "primary",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": [
          "delete",
          "create"
        ],
        "before": {
          "identifier": "primary",
          "encrypted": true,
          "password": "old-secret"
        },
        "after": {
          "identifier": "primary-v2",
          "encrypted": false,
          "password": "new-secret"
        },
        "before_sensitive": {
          "password": true
        },
        "after_sensitive": {
          "password": true
        },
        "after_unknown": {
          "endpoint": true
        },
        "replace_paths": [
          [
            "identifier"
          ]
        ]
      },
      "action_reason": "replace_because_cannot_update"
    },
    {
      "address": "aws_s3_bucket.logs",
      "mode": "managed",
      "type": "aws_s3_bucket",
      "name": "logs",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": [
          "create"
        ],
        "before": null,
        "after": {
          "bucket": "example-logs",
          "public": false
        },
        "before_sensitive": {},
        "after_sensitive": {},
        "after_unknown": {
          "arn": true
        }
      }
    }
  ],
  "resource_drift": [
    {
      "address": "aws_instance.worker",
      "type": "aws_instance",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": [
          "update"
        ],
        "before": {
          "instance_type": "t3.small"
        },
        "after": {
          "instance_type": "t3.medium"
        },
        "before_sensitive": {},
        "after_sensitive": {},
        "after_unknown": {}
      }
    }
  ],
  "relevant_attributes": []
}

How to use it

01
Load change evidence
Open Terraform show JSON or compare baseline and current Kubernetes YAML.
02
Inspect blast radius
Filter resources, review redacted attributes, drift, graph edges and high-risk evidence.
03
Apply review policy
Configure local guardrails and export a redacted human or CI report.

Frequently asked questions

Can this open a binary tfplan file?

No. Convert it with terraform show -json first; binary plans are intentionally not executed.

Are sensitive plan values protected?

Terraform sensitivity masks and common secret field names are redacted before display and export, but plan files should still be handled securely.

Does it apply infrastructure?

No. It never runs Terraform, kubectl or cloud APIs.

Are risk findings authoritative policies?

No. They are transparent local heuristics for review and do not replace OPA, Sentinel, provider schemas or organizational approval.

Keep working with other focused browser utilities.

All tools

How to use it

Load change evidence

Inspect blast radius

Apply review policy

Frequently asked questions

Related tools

Terraform & OpenTofu Validator

Kubernetes Manifest Validator

Git Repository & Patch Reviewer