interragate

interragate

Terraform and OpenTofu plans,
explained before you apply.

Open the live report Install

Critical risk

Destroys an S3 bucket, replaces an RDS database instance and opens SSH to the internet.

5 destroyed

5 replaced

23 updated

13 only touch tags or formatting

3 created

- aws_s3_bucket.logs

S3 bucket

Its block was removed from the configuration.

Destroys an S3 bucket

aws-webappTerraform 1.16.6branch encrypt-orders-dbOpen the sample plan

What each change will do.

Seven changes from that plan, played out.

Encrypting the database replaces it.

-/+ aws_db_instance.orders

Replacing aws_db_instance.orders (an RDS database instance) destroys it, along with all data in the database, and creates a new, empty one.

Critical

  1. Your edit
  2. Can't be done in place
  3. Destroyed, with its data
  4. Created again, empty

Then the apply stops halfway.

$ terraform apply

The apply will fail when it tries to replace aws_db_instance.orders: deletion_protection is still on for the existing RDS database instance. Turning it off in this same plan does not help, because Terraform destroys the old object with its current settings.

High

  1. The apply starts
  2. Deletion protection stops it
  3. 22 resources skipped
  4. 3 left destroyed

Deleting a block empties a bucket.

- aws_s3_bucket.logs

Destroying aws_s3_bucket.logs (an S3 bucket) deletes every object in the bucket. Its block was removed from the configuration. force_destroy is on, so everything in it is deleted too.

Critical

  1. Block removed
  2. force_destroy is on
  3. Every object deleted
  4. Then the bucket

A temporary rule opens SSH to everyone.

~ aws_security_group.app

Opens SSH (22/tcp) to the internet on aws_security_group.app. The rule is described as "TEMP: debug access".

Critical

  1. A temporary rule
  2. Port 22, from anywhere
  3. Open to the internet

Removing a zone moves every subnet after it.

-/+ module.network.aws_subnet.private[1]

Removing 1 item from the middle of the list behind count shifts module.network.aws_subnet.private and module.network.aws_subnet.public the same way: [1] is changed to become what [2] was, and [2] is destroyed.

High

  1. One zone removed
  2. [2] slides into [1]
  3. [1] rebuilt, [2] destroyed
  4. Keyed by zone, one goes

A rename rebuilds the server.

- aws_instance.web + aws_instance.app

aws_instance.web is destroyed and aws_instance.app is created with the same settings. If you renamed it, a moved block keeps the existing EC2 instance instead of recreating it.

High

  1. Renamed
  2. Destroyed and created
  3. With the same settings
  4. A moved block keeps it

A fix made by hand is undone.

~ aws_security_group.alb

aws_security_group.alb was changed outside Terraform (ingress gained 8443/tcp from 0.0.0.0/0 ("hotfix: partner callback")), and this plan reverts it.

High

  1. Added by hand
  2. No edit asked for this
  3. This plan removes it
  4. Keep it, if it was meant

What your branch did, and what it didn't.

interragate compares the plan with git, so a change no edit explains stands out.

32 from your edits to main.tf

3 follow from them

1 not tied to an edit

aws_security_group.alb, the hand-made fix above

36 changes: 32 edit, 3 follows, 1 untied.

Put it in the review.

The same reading, as a comment on the pull request.

- uses: Jeecabs/interragate@main
Set up the action

github-actionsbotcommented

interragate · aws-webapp: critical risk

Destroys an S3 bucket, replaces an RDS database instance and opens SSH to the internet.

+3 create · ~23 update · -/+5 replace · −5 destroy · 13 cosmetic · 5 follow from other changes · 2 drifted

  • Destroying aws_s3_bucket.logs (an S3 bucket) deletes every object in the bucket.
  • Replacing aws_db_instance.orders (an RDS database instance) destroys it, along with all data in the database, and creates a new, empty one.
  • Opens SSH (22/tcp) to the internet on aws_security_group.app.
  • The apply will fail when it tries to replace aws_db_instance.orders: deletion_protection is still on for the existing RDS database instance.
The start of interragate demo aws -f markdown.

Follow the details.

One report. Every resource, dependency and diff.

The report overview: a critical risk verdict, one square per changed resource, and the most important consequences.
Open the overview
The dependency map focused on aws_db_instance.orders, with its dependants and findings.
Open the map
The apply timeline, with the expected database failure marked by a stop line.
Open the apply
The IAM policy diff showing the new statement that allows s3:* on every resource.
Open the diff

Read your next plan.

Install with Go. Try the sample, or run it in your Terraform directory.

go install github.com/Jeecabs/interragate/cmd/interragate@latest
$ interragate demointerragate  aws-webapp · terraform 1.16.6 · sample plan

Critical risk. Destroys an S3 bucket, replaces an RDS database instance and
opens SSH to the internet.

+3 create   ~23 update   -/+5 replace   -5 destroy     13 cosmetic · 2 drifted · 2 output changes

What matters
  ● Destroying aws_s3_bucket.logs (an S3 bucket) deletes every object in the
    bucket.
  ● Replacing aws_db_instance.orders (an RDS database instance) destroys it,
    along with all data in the database, and creates a new, empty one.
  ● Opens SSH (22/tcp) to the internet on aws_security_group.app.
  ● The apply will fail when it tries to replace aws_db_instance.orders:
    deletion_protection is still on for the existing RDS database instance.
  ● Adds a statement ("DebugEverything") to policy on aws_iam_role_policy.app
    that allows s3:* on every resource.
  ● Turns off block_public_policy and restrict_public_buckets on
    aws_s3_bucket_public_access_block.assets, so a bucket policy or ACL can make
    the bucket public.
  ● Removing 1 item from the middle of the list behind count shifts
    module.network.aws_subnet.private and module.network.aws_subnet.public the
    same way: [1] is changed to become what [2] was, and [2] is destroyed.
The start of what interragate demo prints.
interragate demo
Try the sample
interragate
Plan and explain
interragate --open
Open the report
interragate watch
Replan when you save
interragate apply
Apply the plan you reviewed
interragate show tfplan
Explain a saved plan
interragate check
Check findings in CI

Give your agent the skill.

Claude Code

/plugin install interragate --marketplace Jeecabs/interragate

Codex

codex plugin marketplace add Jeecabs/interragate
codex plugin add interragate@interragate

Copilot CLI

copilot plugin marketplace add Jeecabs/interragate
copilot plugin install interragate@interragate

Cursor and others

npx skills add Jeecabs/interragate