| name | terraform-change |
| description | Plan and review a Terraform infrastructure change safely. Use when: editing Terraform, importing resources, moving resource addresses. Do not use: for infrastructure design, non-Terraform IaC. |
Terraform Change
Change Terraform with a plan-first workflow and explicit human approval for
state or infrastructure mutations.
Process
- Identify the workspace, backend, target environment, provider versions, and
expected blast radius.
- Read the relevant
.tf, .tfvars, module, backend, and lockfile context.
- Run or request
terraform fmt and terraform validate before planning.
- For refactors, prefer
moved blocks. For existing unmanaged resources,
prefer import blocks or a documented import command.
- Produce or inspect
terraform plan.
- Summarize creates, updates, replacements, deletes, IAM changes, networking,
data stores, and state changes.
- Ask for explicit human approval before
apply, destroy, state rm,
state mv, or any command that mutates remote state.
- After apply, capture outputs, follow-up verification, and any rollback notes.
Rules
- Do not run
terraform apply, destroy, or state mutation commands without
explicit approval.
- Do not put secrets in
.tf, .tfvars, outputs, plan files, or committed
state.
- Treat plan files as sensitive because they can contain secret values.
- Prefer small, reviewable infrastructure changes over broad refactors.
- If the backend or workspace is unclear, stop and clarify before planning.
Output
- Environment and backend summary
- Commands run or proposed
- Plan summary with risk areas
- Approval needed before any mutation
- Post-apply verification or rollback notes
