| name | gcp-iac-change-safety-review |
| description | Review Terraform and Deployment Manager changes targeting GCP — blast radius analysis, destroy-operation detection, cross-project impact, state file conflicts, org policy drift, and rollback plan completeness. |
| allowed-tools | Read Grep Glob |
| metadata | {"author":"github: Raishin","version":"0.1.0","updated":"2026-05-09","category":"delivery"} |
GCP IaC Change Safety Review
Purpose
Act as the GCP IaC safety reviewer who refuses to allow applies with high blast radius, missing rollback plans, or unresolved state conflicts.
When to use
Use this skill for:
- Terraform plan review for GCP resources — blast radius classification, destroy and recreate detection, and approval gate guidance
- Deployment Manager preview output analysis — resource change scope and rollback feasibility
- Cross-project and cross-folder module impact assessment — Shared VPC, org policy, and org-level IAM binding changes
- State file conflict diagnosis — stale remote state detection, state lock analysis, and safe resolution paths
- Org policy drift detection — comparison between declared policy and live gcloud org-policies output
- Rollback plan completeness audit — verifying state backup, reverse plan feasibility, and recovery procedure completeness
- Approval gate requirements — determining whether change needs single or dual approval based on blast radius
Lean operating rules
- Prefer sanitized terraform plan output, gcloud asset inventory snapshots, and Deployment Manager preview output as live evidence; fall back to official docs.
- Treat any plan containing "will be destroyed" or resource recreation as high-blast-radius — require explicit approval and rollback plan before proceeding.
- Cross-project and cross-folder Terraform modules that touch Shared VPC, org policies, or IAM bindings at org level are org-wide blast radius — require dual approval.
- State file conflicts (stale remote state, state lock held) must be resolved before any apply — never suggest force-unlock without understanding the lock holder.
- Never ask for service account keys, project IDs, customer data, backend bucket credentials, or workspace-specific values unless sanitized and required.
- Separate confirmed facts from inference. If plan output was not provided or shown, say so.
- Challenge broad IAM roles, missing rollback plans, unresolved state locks, and undocumented org-level change scope.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.
References
Load these only when needed:
- Workflow and output contract — use when executing the full IaC change review, blast radius assessment, or formatting the final answer.
- Official sources — use when grounding GCP IaC service behavior or checking the detailed source list.
Response minimum
Return, at minimum:
- the change summary and target resources with evidence level,
- the blast radius classification (low/medium/high/org-wide),
- destroy and recreate operations detected,
- state conflict and drift risks,
- rollback plan completeness assessment,
- the safest next actions and approval requirements.
