Loading page content
Analyze a Terraform plan for what it will destroy or replace, surfacing the destructive changes buried in a plan output too long for anyone to read line by line.
Paste terraform plan output (text) or terraform show -json plan.out (JSON). Destructive changes are flagged and risk-weighted: IAM, security groups, databases, and storage score higher. 100% client-side; your plan never leaves the browser.
aws_db_instance.ordersrisk 10/10aws_security_group.webrisk 9/10aws_s3_bucket.audit_logsrisk 9/10aws_iam_policy.deployrisk 3/10aws_route53_record.apirisk 3/10aws_instance.worker[0]risk 0/10aws_instance.worker[1]risk 0/10create_before_destroy, deletion protection, and final snapshots before applying.Heuristic scoring; it reads resource names, not your architecture. Why this tool exists: vibe infrastructure will page you at 3 AM. Pair with Claude Code hook guardrails (including a terraform destroy guard) and the $47K near-miss story.
The dangerous line in any plan is the replacement, shown as destroy and then create replacement. It means the resource cannot be updated in place and Terraform will delete it and build a new one, which for a database, a load balancer, or anything holding state is an outage and possibly data loss. A 900-line plan makes it easy to miss, and the summary count at the bottom does not distinguish a replaced security group from a replaced RDS instance.
The habit to build is reviewing plans by blast radius rather than by line count. Which resources are stateful, which are referenced by others, which carry traffic. Everything else (tag changes, description updates) is noise you can skim.