Terraform Plan Summary Analyzer

Terraform plan source:

Paste one plan, browse a JSON/TXT file, or drop it here. Parsing stays in this browser and the source is excluded from the URL.

{{ fileStatus || 'Drop one JSON, TXT, or LOG file onto the textarea.' }}

Input format:

Auto resolves to JSON for an object-shaped source and to text otherwise; pin a mode when wrapper text makes that ambiguous.

Workspace or stack:

Name the workspace, environment, stack, or CI plan under review.

Destructive review threshold:

Use 0 when every delete or replacement should require explicit review.

resources

Ledger row limit:

The neutral default shows up to 100 highest-review-load rows.

rows

Include read and no-op rows:

Off is neutral for apply review; turn it on only when informational rows belong in the exported ledger.

{{ include_noop ? 'Read and no-op rows included' : 'Changed resources only' }}

Check	Value	Review note	Copy
{{ row.check }}	{{ row.value }}	{{ row.note }}

Resource	Action	Provider	Evidence	Next action	Risk	Copy
{{ row.resource }}	{{ row.action }}	{{ row.provider }}	{{ row.evidence }}	{{ row.next_action }}	{{ row.risk }}

Resource	Action	Type	Provider	Evidence	Signals	Risk score	Copy
{{ row.resource }}	{{ row.action }}	{{ row.type }}	{{ row.provider }}	{{ row.evidence }}	{{ row.signals }}	{{ row.risk_score }}

An infrastructure approval is only as good as the plan evidence behind it. Reviewers need to know what Terraform intends to create, change, remove, or replace, but they also need the context that turns those counts into an operational decision: which stack produced the plan, whether planning completed successfully, where drift appeared, and which downstream outputs may change.

Resource volume and operational risk are different questions. A plan containing many new stateless resources may be routine, while a single database replacement or stateful delete may need backups, a maintenance window, and a tested recovery path. A replacement is especially important because Terraform represents it as delete plus create, even when a text summary makes the overall change count look modest.

Planned change: An action Terraform proposes to move managed infrastructure toward the configuration.
Resource drift: A difference between prior Terraform state and the real infrastructure observed during refresh.
Unknown value: A value the provider cannot determine until apply, so the plan cannot prove its final content yet.
Output change: A changed root-module output that may affect scripts, other stacks, deployment jobs, or people who consume it.

Machine-readable plan JSON preserves the fields needed for a careful review, including action lists, resource addresses, provider names, replacement paths, unknown and sensitive markers, lifecycle flags, drift entries, and output changes. Human-readable plan text is useful when JSON is unavailable, but it is a lower-confidence source. A text scan can recognize common action lines and the final add/change/destroy summary without recovering all of the structured evidence.

The plan still does not authorize an apply. Provider side effects, dependency order, policy checks, credentials, current state, and the age of the saved plan remain outside a summary. If the environment may have changed since planning, regenerate the plan or apply the exact saved plan artifact through the approved workflow rather than assuming an old summary still describes current reality.

How to Use This Tool:

Use structured JSON when possible, set a review threshold that matches the change policy for the stack, and treat the result as a triage record rather than an approval.

Paste or browse to a Terraform plan source, then choose Auto detect, Terraform plan JSON, or Terraform plan text. Auto detection treats content beginning with an object brace as JSON.
Enter a recognizable Workspace or stack label. It provides review context but does not change parsing or risk calculations.
Set the Destructive review threshold. The apply-review gate trips only when deletes plus replacements are greater than this whole-number threshold, so a threshold of zero flags any destructive action.
Choose a Ledger row limit from 10 through 500. Enable Include read and no-op rows only when informational actions belong in the resource ledger.
Read Apply gate snapshot first, then inspect Destructive review queue for replacements, deletes, unknown actions, drift, unknown values, and sensitive markers. Use the ledger and charts to locate provider concentration or a large action mix.
Return to the original Terraform plan and provider documentation before approval. Confirm destructive intent, backups, dependencies, replacement timing, changed outputs, and any values that remain unknown until apply.

Interpreting Results:

Plan reported errors and Plan not applyable are stop conditions taken from structured plan flags. Apply review required means the destructive count is above the selected threshold. Destructive change present means at least one delete or replacement exists but the count is still at or below the threshold. Gate clear means none of those conditions was found; it does not mean the plan is safe or approved.

Prefer JSON evidence when drift, output changes, lifecycle flags, provider grouping, or sensitive and unknown markers matter.
Review replacements before ordinary updates because the existing object may be destroyed and recreated.
Treat the review-load score as a sorting aid. It is a local heuristic, not a Terraform policy, severity standard, or probability of failure.
Verify a surprising row against the original plan. Text recognition can misclassify prose, and structured markers show presence rather than the business impact of a value.

Technical Details:

Plan JSON is accepted when its top level is an object and its format major version is 1. Structured analysis reads planned resource changes, resource drift, root-module output changes, and the reported applyable, complete, and errored flags. Text analysis recognizes common Terraform action phrases and the final plan summary; it cannot reconstruct structured drift, output, lifecycle, sensitive, or provider evidence that the text does not expose.

Transformation Core

Each action list is reduced to one review class in priority order. Delete plus create becomes a replacement so that destructive recreation is not split across two harmless-looking categories.

Terraform action classification rules
Evidence in action list	Review class	Operational meaning
Delete and create	Replace	Destroy the current object and create another.
Delete	Delete	Remove the managed object.
Create	Create	Add a managed object.
Update	Update	Change the object in place.
Read	Read	Read a data source during apply.
No-op	No-op	No material resource change.
No recognized action	Unknown	Inspect the raw evidence before approval.

Formula Core

The destructive count adds deletes and replacements. The gate uses a strict greater-than comparison, so a count equal to the threshold does not trip it.

D = N_{delete} + N_{replace}

Gate tripped \Leftrightarrow D > T

Here, D is the destructive count and T is the selected destructive review threshold, an integer from 0 through 999,999.

The review-load score gives higher-risk rows more weight, then adds one point for each unknown leaf, sensitive leaf, and changed output. Drift adds two points to its row. The base action weights are 0 for read or no-op, 1 for create, 2 for update, 3 for unknown, 6 for delete, and 7 for replacement.

R = \sum_{i = 1}^{n} (w_{i} + u_{i} + s_{i} + 2 d_{i}) + N_{outputs}

R is the review-load score; w is the action weight; u and s count unknown and sensitive leaves; d is 1 for a drift row and 0 otherwise. The score is not normalized and has no pass/fail cutoff.

Rule Core

Terraform apply gate status decision order
First matching condition	Status
Plan reports an error	Plan reported errors
Plan explicitly reports applyable as false	Plan not applyable
Destructive count > threshold	Apply review required
Destructive count > 0	Destructive change present
None of the conditions above	Gate clear

Input is limited to 8,388,608 characters. Workspace labels accept 1 to 120 characters, and the resource ledger accepts 10 to 500 rows. The destructive queue can retain up to 500 rows, provider summaries show at most 12 providers, and rows are ordered by descending review weight before action class and resource address.

Privacy and Safety Notes:

Plan analysis runs in the browser and does not upload the pasted source for server-side processing. Terraform plan and state material can still contain credentials, tokens, passwords, addresses, and other sensitive infrastructure details. A sensitive marker tells the review queue that protected fields exist; it does not remove or encrypt values already present in the pasted JSON.

Prefer a redacted plan when full values are not required for review.
Do not treat the threshold or review-load score as apply authorization.
Keep the original plan, policy checks, provider documentation, backup evidence, and change approval record available for the final decision.

References:

Terraform JSON output format, HashiCorp.
Terraform plan command reference, HashiCorp.
Manage sensitive data in Terraform, HashiCorp.
Manage resource drift, HashiCorp.