# Review Terraform

> Review Terraform changes for plan safety, existing Azure resources, and deployment-identity permissions. Use for Terraform review or deployability questions.

- Skill: `learntocloud/review-terraform` (Agent Skill)
- Install (CLI): `npx skillmds@latest add learntocloud/review-terraform`
- Raw SKILL.md: https://api.skillmd.com/api/skills/learntocloud/review-terraform/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: learntocloud (https://skillmd.com/u/learntocloud)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/learntocloud/review-terraform

---


# Review Terraform

Review the diff and an Azure-backed plan before recommending merge.

Check:

- every planned action matches the intended diff
- no unexpected destroy, replacement, identity, auth, networking, or data change
- resources Azure creates by default are updated/imported rather than recreated
- the GitHub Actions identity has required Azure RBAC and, for `azuread_*`,
  Microsoft Graph permissions
- provider and lock-file-only updates produce no infrastructure changes
- Terraform formatting, validation, and tests pass

For risky identity changes, separate the platform gate from application
deployment.

Use the `plan-terraform` skill when planning an open pull request against remote
state. Production applies must run through `app-deploy.yml`, which calls the
reusable `infra-deploy.yml` before application deployment. Never infer safety
from `terraform validate` alone.