Terraform Review

Terraform Review

Use for an IaC review before plan or apply.

1. Read changed .tf, lock, and variable files; identify resource replacement and state movement.
2. Run format/validate tools only when installed. Run python terraform-review/scripts/review.py <directory> for offline source checks.
3. Review provider pinning, remote-state assumptions, sensitive outputs, identity/RBAC scope, network exposure, lifecycle behavior, and destructive operations.
4. Report findings by severity with file evidence. Distinguish static suspicion from validated risk.
5. plan needs suitable credentials and may expose sensitive values; redact its output. Never run apply, import, state mutation, force-unlock, or destroy without an explicit request and approval.

Azure guidance: prefer managed/workload identity, least-privilege RBAC, private endpoints where required, diagnostic settings, current supported AKS versions, and deletion protection appropriate to the environment. No commercial provider is needed; if one is added, credentials stay in a secret manager or environment variable.