Terraform plan declaration review

Worked example

Example input

{"format_version":"1.2","terraform_version":"1.13.3","resource_changes":[{"address":"module.x.sample.a[0]","mode":"managed","type":"sample","name":"a","change":{"actions":["delete","create"],"before":{"id":"old","pass":"s1","nested":[1,null]},"after":{"id":null,"pass":"s2","nested":[2,null]},"after_unknown":{"id":true},"before_sensitive":{"pass":true},"after_sensitive":{"pass":true},"replace_paths":[["nested",0]]}},{"address":"sample.b","mode":"managed","type":"sample","name":"b","change":{"actions":["create","delete"],"before":null,"after":{"z":9007199254740993},"after_unknown":{},"before_sensitive":false,"after_sensitive":false}},{"address":"module.x.sample.a[0]","mode":"managed","type":"sample","name":"a","change":{"actions":["delete"],"before":{"id":"old","pass":"s1","nested":[1,null]},"after":null,"after_unknown":false,"before_sensitive":{"pass":true},"after_sensitive":false,"replace_paths":[["nested",0]]},"deposed":"deadbeef"}],"applyable":true,"complete":false,"errored":false,"variables":{"password":{"value":"NEVER_EXPORT_RAW_VARIABLE_SECRET"}},"planned_values":{"secret":"NEVER_EXPORT_PLANNED_SECRET"},"prior_state":{"secret":"NEVER_EXPORT_STATE_SECRET"},"configuration":{"secret":"NEVER_EXPORT_CONFIG_SECRET"},"extra":{"secret":"NEVER_EXPORT_UNKNOWN_SECRET"},"resource_drift":[{"address":"sample.drift","change":{"actions":["delete"],"before":{"id":"drift"},"after":null,"before_sensitive":false,"after_sensitive":false,"after_unknown":false}}],"output_changes":{"public":{"actions":["update"],"before":1,"after":2,"before_sensitive":false,"after_sensitive":false,"after_unknown":false},"private":{"actions":["create"],"before":null,"after":"NEVER_EXPORT_OUTPUT_SECRET","after_sensitive":true,"after_unknown":false}}}

{"secondary":"","params":{"spreadsheetSafe":true}}

Example output

{"format":"Terraform-plan1-local-change-declarations","summary":{"formatVersion":"1.2","resourceChanges":3,"driftChanges":1,"outputChanges":2,"create":2,"update":0,"delete":3,"read":0,"noOp":0,"replacements":2,"sensitiveSubtrees":4,"unknownSubtrees":1,"jsonNodes":116,"unreviewedTopFields":5},"flags":{"applyable":true,"complete":false,"errored":false},"sections":[{"name":"resource_changes","values":[{"section":"resource_changes","address":"module.x.sample.a[0]","deposed":null,"actions":["delete","create"],"replacement":true,"replacementOrder":"delete→create","beforePresence":"present","afterPresence":"present","beforeSensitiveStatus":"declared","afterSensitiveStatus":"declared","afterUnknownStatus":"declared","beforeSensitive":["/pass"],"afterSensitive":["/pass"],"afterUnknown":["/id"],"before":{"id":"old","pass":{"$neatboState":"redacted-sensitive"},"nested":[1,null]},"after":{"id":{"$neatboState":"unknown"},"pass":{"$neatboState":"redacted-sensitive"},"nested":[2,null]},"replacePaths":[["nested",0]],"declarations":{"mode":"managed","type":"sample","name":"a"},"unreviewedFields":[],"unreviewedChangeFields":[]},{"section":"resource_changes","address":"sample.b","deposed":null,"actions":["create","delete"],"replacement":true,"replacementOrder":"create→delete","beforePresence":"null","afterPresence":"present","beforeSensitiveStatus":"declared","afterSensitiveStatus":"declared","afterUnknownStatus":"declared","beforeSensitive":[],"afterSensitive":[],"afterUnknown":[],"before":null,"after":{"z":9007199254740993},"replacePaths":[],"declarations":{"mode":"managed","type":"sample","name":"b"},"unreviewedFields":[],"unreviewedChangeFields":[]},{"section":"resource_changes","address":"module.x.sample.a[0]","deposed":"deadbeef","actions":["delete"],"replacement":false,"replacementOrder":null,"beforePresence":"present","afterPresence":"null","beforeSensitiveStatus":"declared","afterSensitiveStatus":"declared","afterUnknownStatus":"declared","beforeSensitive":["/pass"],"afterSensitive":[],"afterUnknown":[],"before":{"id":"old","pass":{"$neatboState":"redacted-sensitive"},"nested":[1,null]},"after":null,"replacePaths":[["nested",0]],"declarations":{"mode":"managed","type":"sample","name":"a","deposed":"deadbeef"},"unreviewedFields":[],"unreviewedChangeFields":[]}]},{"name":"resource_drift","values":[{"section":"resource_drift","address":"sample.drift","deposed":null,"actions":["delete"],"replacement":false,"replacementOrder":null,"beforePresence":"present","afterPresence":"null","beforeSensitiveStatus":"declared","afterSensitiveStatus":"declared","afterUnknownStatus":"declared","beforeSensitive":[],"afterSensitive":[],"afterUnknown":[],"before":{"id":"drift"},"after":null,"replacePaths":[],"declarations":{},"unreviewedFields":[],"unreviewedChangeFields":[]}]},{"name":"output_changes","values":[{"section":"output_changes","address":"public","deposed":null,"actions":["update"],"replacement":false,"replacementOrder":null,"beforePresence":"present","afterPresence":"present","beforeSensitiveStatus":"declared","afterSensitiveStatus":"declared","afterUnknownStatus":"declared","beforeSensitive":[],"afterSensitive":[],"afterUnknown":[],"before":1,"after":2,"replacePaths":[],"declarations":{},"unreviewedFields":[],"unreviewedChangeFields":[]},{"section":"output_changes","address":"private","deposed":null,"actions":["create"],"replacement":false,"replacementOrder":null,"beforePresence":"null","afterPresence":"present","beforeSensitiveStatus":"no-declaration","afterSensitiveStatus":"declared","afterUnknownStatus":"declared","beforeSensitive":[],"afterSensitive":[""],"afterUnknown":[],"before":null,"after":{"$neatboState":"redacted-sensitive"},"replacePaths":[],"declarations":{},"unreviewedFields":[],"unreviewedChangeFields":[]}]}],"omittedTopFields":["variables","planned_values","prior_state","configuration","extra"],"scope":"Actions and flags are snapshot declarations, not apply success/safety/impact. before/after use explicit $neatboState markers for sensitive/unknown/absent subtrees; presence fields distinguish actual null. Only supplied sensitive masks redact; unmarked values/addresses/import IDs may be private. Omitted top fields are not reviewed and their values are never exported. Unknown resource/change fields are named as unreviewed, not exported. Numeric tokens in retained declared values remain exact."}

When something does not work

Re-export a complete supported1.x plan; correct duplicate address+deposed identities, masks, actions or JSON. Unsupported deferred/new action semantics require another workflow. Rerun a valid source after failure/cancellation.

Frequently asked questions