terraform-reviewlisted

# Terraform Review Read a plan for what it will destroy, not for what it will create. ## Purpose **Use this when:** - Reviewing a `terraform plan` before it is applied. - Reviewing an infrastructure pull request. - Assessing a module before adopting it. - Someone asks "is this change safe?" **Do not use this when:** - You are executing the change — use `terraform-safe-changes`, which covers the apply procedure. - The plan or apply is erroring — use `terraform-troubleshooting`. **What this skill assumes:** access to the plan output, and ideally the machine-readable plan (`terraform show -json`). Reviewing the human-readable diff alone is error-prone on large plans; the JSON form is what you should reason from. ## Operating Procedure 1. **Read the summary line first.** `Plan: 3 to add, 1 to change, 2 to destroy`. The destroy count is the only number that can end your day badly. 2. **Enumerate every destroy and every replace.** A replace (`-/+`) is a destroy followed by a create; for a database, a disk, or anything holding state, that is data loss. 3. **For each replacement, find the forcing attribute.** Terraform prints `# forces replacement`. Decide whether that attribute *had* to change. 4. **Assess blast radius.** What depends on the replaced resource? A replaced security group means every attached instance loses its rules for the duration. 5. **Review the code**, not only the diff: provider pinning, secrets, lifecycle blocks, count/ for_each keys, re