| name | terraform-azurerm-set-diff-analyzer |
| description | Analyze Terraform plan JSON output for AzureRM Provider Set-type attributes and distinguish false-positive order-only diffs from actual resource changes. Use when reviewing Terraform plans for Azure Application Gateway, Load Balancer, Firewall, Front Door, Network Security Group, route table, virtual network, private endpoint, or other azurerm resources with noisy nested block diffs. |
Terraform AzureRM Set Diff Analyzer
Source: adapted from github/awesome-copilot skill terraform-azurerm-set-diff-analyzer.
When to Use
terraform plan shows many nested-block changes after a small AzureRM edit- A plan for NSG rules, Application Gateway, Load Balancer, Front Door, Firewall, route tables, virtual networks, or private endpoints is hard to review
- CI needs to separate order-only diffs from actual Set element additions, removals, or modifications
Background
Terraform Set-type attributes do not guarantee element ordering. AzureRM resources often model nested blocks as Sets, so adding one item can make unchanged items appear modified. This skill uses a small Python analyzer plus an AzureRM attribute catalog to compare elements by stable keys.
Basic Usage
Run from this skill folder or pass paths explicitly.
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json
python .github/skills/terraform-azurerm-set-diff-analyzer/scripts/analyze_plan.py plan.json
Common options:
python .github/skills/terraform-azurerm-set-diff-analyzer/scripts/analyze_plan.py plan.json --format summary
python .github/skills/terraform-azurerm-set-diff-analyzer/scripts/analyze_plan.py plan.json --format json
python .github/skills/terraform-azurerm-set-diff-analyzer/scripts/analyze_plan.py plan.json --exit-code
Output Interpretation
ORDER_ONLY: Elements exist before and after but Terraform changed ordering. Usually safe to treat as no behavior change.ACTUAL_SET_CHANGE: A Set element was added, removed, or modified. Review carefully.REPLACE: Terraform plans delete/create replacement. Check downtime and data-loss risk.OTHER_CHANGE: A non-Set attribute changed. Review normally.
References
