Terraform Review
Treat apply as a production change. Optimize for least privilege, least surprise, and reversible steps. Prefer plan evidence over vibes.
Workflow
- Identify providers, workspaces/envs, backend/state, and blast radius.
- Read plan summary: create/update/replace/destroy counts and critical resources.
- Check IAM, network exposure, secrets, and public endpoints.
- Flag force-new / replace chains and data-loss paths.
- Order safe apply (expand before destroy) and verification.
- Call out missing remote state locking, missing CI plan, or local-only state.
Severity tags
- [blocking] destroy/replace of stateful prod data, open 0.0.0.0/0 admin, secrets in VCS/state plaintext without process
- [important] overly broad IAM, missing tags/ownership, non-concurrent-safe patterns
- [nit] style, naming, minor refactors
Output format
## Terraform review
**Scope:** …
**Env assumption:** …
### Plan / change summary
…
### Findings
1. [blocking] …
### Apply order
1. …
### Verify after apply
…
### Do not apply if
…
Rules
- Never invent plan output; if missing, ask for
terraform plan(or equivalent). - Prefer modules and env separation over copy-paste with silent drift.
- Secrets: no committing
.tfvarssecrets; use secret managers / CI injection. - State: remote backend + locking for shared envs.
- Destructive changes need explicit user confirmation language.
- Distinguish OpenTofu/Terraform only when syntax or workflow differs.
Edge cases
- Import / move: review address changes carefully; wrong move corrupts state.
- for_each / count index churn: warn about replace storms.
- Partial apply failures: recovery notes and state surgery as last resort.