菜单
Reviews Terraform/OpenTofu plans and modules with a safety-first, diagnose-first lens — blast radius of destroys/replaces, identity churn, drift, state risks, secret exposure — before any apply. Triggers when reviewing a terraform plan diff, authoring modules, or gating an apply in CI.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill terraform-plan-review命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Gets machine-parseable JSON out of an LLM reliably — prefer provider-enforced grammar (OpenAI `response_format:{type:"json_schema",strict:true}`, Anthropic tool-calling / `tool_choice:{type:"tool"}`, Gemini `responseSchema`) over a "respond in JSON" prompt, define the contract once as a Pydantic/Zod model and validate every response (never trust the string), use constrained decoding / grammars for open weights (Outlines, llguidance, llama.cpp GBNF, vLLM `guided_json`), keep schemas SHALLOW with required fields + enums + `additionalProperties:false`, and build a repair-and-retry loop that handles refusals, `length`/`max_tokens` truncation, and streaming partial JSON (`partial-json-parser`). Schema-guided generation eliminates parse-error retries; validate-and-repair is the backstop, not the primary mechanism.
Builds production data grids that stay fast and accessible at 10k–1M+ rows — decide server-side vs client-side sort/filter/paginate by the dataset-fits-in-memory test (client only under ~10k rows, otherwise push to the API and treat the table as a controlled view of server state), ROW-VIRTUALIZE with TanStack Virtual or react-window so only the visible window mounts (fixed estimateSize, overscan 5–10, measureElement for dynamic rows, contain:strict, and a real scroll container — never table-layout:auto over thousands of rows), build the headless logic with TanStack Table v8 (or AG Grid when you need pinning/grouping/enterprise out of the box), add column resize/reorder/pin, inline edit with optimistic update + rollback on error, row selection with a stable rowId, full keyboard nav with roving tabindex over an ARIA grid (role=grid/row/gridcell, aria-sort, aria-rowcount/aria-rowindex so virtualization stays announced), position:sticky headers, streaming CSV export that doesn't block the main thread, and explici
Builds semantic/vector search — pick an embedding model + dimensionality (and whether to truncate Matryoshka dims) and the matching distance metric (cosine/dot/L2, normalize to unit length so cosine == dot and IP is correct), an ANN index with the recall/latency/memory tradeoff understood (HNSW M/efConstruction/efSearch for low-latency RAM-resident; IVF-PQ nlist/nprobe/PQ for billion-scale compressed; flat/exact for <100k) in pgvector/Qdrant/Milvus/FAISS/Pinecone, chunking + overlap + per-chunk metadata for filtering, HYBRID retrieval fusing BM25 + dense by Reciprocal Rank Fusion (RRF, k≈60) not score addition, a cross-encoder/Cohere reranker over the top-50→k, correct pre-filter-vs-ANN interaction (filterable HNSW, not post-filter that starves k), and offline eval with recall@k / nDCG@10 / MRR against a labeled qrels set. Quantize (scalar/PQ) only after measuring recall loss; tune efSearch/nprobe to a recall target, not a guess.
基于 SOC 职业分类
正在显示 SKILL.md
| name | terraform-plan-review |
| description | Reviews Terraform/OpenTofu plans and modules with a safety-first, diagnose-first lens — blast radius of destroys/replaces, identity churn, drift, state risks, secret exposure — before any apply. Triggers when reviewing a terraform plan diff, authoring modules, or gating an apply in CI. |
| when_to_use | ก่อน terraform/tofu apply, รีวิว plan diff, เขียน/ตรวจ module, มี resource destroy/replace น่ากลัว, สงสัย drift |
Use this skill BEFORE any terraform apply / tofu apply, and whenever you:
~/-/-/+ lines, or terraform show -json output).for_each/count, outputs).Core stance: diagnose first, never auto-approve. A plan that only adds (+) is low-risk; one with - (destroy) or -/+ (replace) on stateful resources can be irreversible data loss. Your job is to surface blast radius and force a conscious go/no-go — not to rubber-stamp green output. Treat the plan as the source of truth, ground every claim in provider docs, and never invent resource behavior.
The commands below apply identically to OpenTofu — swap terraform for tofu.
Generate a deterministic, machine-readable plan. Never review live console scroll. Run:
terraform plan -out=tfplan.bin -lock-timeout=120s
terraform show -json tfplan.bin > tfplan.json
Reviewing a saved plan file and then apply tfplan.bin guarantees what you reviewed is exactly what runs (no TOCTOU drift between plan and apply).
Bucket every change by action. Parse tfplan.json → .resource_changes[].change.actions:
["create"] → low risk.["update"] → in-place, usually safe; check WHICH attributes (step 4).["delete","create"] (shown as -/+) → replace = destroy then recreate. High risk.["create","delete"] → replace with create_before_destroy (less downtime, but check capacity/quota).["delete"] → destroy. Highest risk. Flag every single one.
Quick triage:jq -r '.resource_changes[] | select(.change.actions != ["no-op"]) | "\(.change.actions | join(",")) \(.address)"' tfplan.json | sort | uniq -c
Flag blast radius — these block go by default:
prevent_destroy before approving.change.replace_paths in the JSON; it names the exact attribute forcing recreation (e.g. changing an availability zone, name, or engine version). Confirm the change is intended, not an accidental edit.count → for_each migrations or reordered count lists → index churn: removing element 0 of a count list shifts every later index, destroying/recreating unrelated resources. for_each with stable string keys avoids this. If you see a wide swath of replaces from one small edit, this is almost always the cause.-target used to scope the apply → silently skips dependency graph; flag as partial apply that can leave state inconsistent. Allowed only as a deliberate break-glass, noted in the PR.null_resource/terraform_data with triggers churning → re-runs provisioners; check the provisioner isn't destructive.Walk the failure-mode table (diagnose, don't assume):
| Failure mode | What to grep / inspect | Why it bites |
|---|---|---|
| Identity / IAM churn | replaces or deletes on roles, policies, bindings, service accounts, key pairs | Recreating identity revokes live access → cascading outages; new keys break dependents mid-apply |
| Secret exposure | sensitive values surfacing in outputs, local_file/template_file writing secrets to disk, secrets in plain variable defaults or committed .tfvars, plan JSON containing raw credentials | Plaintext secrets land in state, logs, CI artifacts, or git — state is NOT encrypted by default |
| Blast radius | count of destroy+replace vs intended scope; one-line edit → many resources changing | A typo in a shared local/module input can ripple across an entire environment |
| CI drift | terraform plan -detailed-exitcode returns 2 (changes) on a "no-change" branch; resources changed outside Terraform | State no longer matches reality; next apply may revert manual fixes or fail mid-run |
| State corruption / lock | missing or stale state lock, two pipelines applying same state, local state instead of remote backend, no versioning on the state bucket | Concurrent applies corrupt state; lost state = orphaned real infra you can no longer manage |
Inspect module structure & state hygiene (when authoring or auditing):
type, validation blocks); no untyped any on security-relevant inputs.sensitive = true where needed (note: this only redacts CLI output, NOT state).terraform.tfstate in a team repo is a finding. Confirm backend config locks (DynamoDB table / native lock / blob lease) and the state store has versioning so you can roll back.required_providers with ~> constraints, module version/ref). Unpinned latest = non-reproducible plans.Ground every resource-behavior claim in provider docs (anti-hallucination). Before asserting "this attribute forces replacement" or "this is safe in-place," confirm against the actual provider documentation for that resource/version. Do not infer behavior from the resource name. If you cannot verify, say so and mark the finding as uncertain rather than guessing.
Run static security/policy scans and read the findings:
tfsec . --soft-fail # or: trivy config .
checkov -d . --compact
Triage real issues (public exposure, unencrypted storage, permissive IAM, open security groups) vs. accepted/false-positive rules. Don't dump raw scanner output — summarize what actually matters for this change.
Emit a go / no-go verdict. Structure: counts by action → list every destroy/replace with its replace_paths cause → secret/IAM findings → scan findings → explicit GO or NO-GO with the single most dangerous line called out, and the exact remediation (snapshot first / add prevent_destroy / switch to for_each / pull secret into a vault). Never end with just "looks fine."
plan output, then running a fresh apply. State or remote data can change in between → you apply something you never reviewed. Always -out a plan file and apply that exact file.-detailed-exitcode. Plain plan exits 0 even when there are changes. Use -detailed-exitcode: 0 = no changes, 1 = error, 2 = changes present. CI gates must check for 2.+/- summary lines. A -/+ (replace) on a database reads almost like a normal update at a glance but destroys data. Parse actions from JSON, don't eyeball the colored summary.sensitive = true protects the secret. It only redacts CLI/log output. The value is still stored in plaintext in state and may appear in plan JSON artifacts. The fix is to not put the secret in Terraform-managed values at all — reference a secrets manager.count-based list and triggering mass recreation. Inserting/removing a middle element shifts all later indices → cascade of destroy/replace. Migrate to for_each with stable keys; expect the migration plan itself to churn (use moved {} blocks to avoid destroy on refactor).-target apply as if it were a full plan. -target bypasses parts of the dependency graph and can leave state half-applied. It is break-glass only.moved {} blocks. Renaming an address makes Terraform plan destroy-old + create-new instead of a no-op rename. Add moved {} (or import/state mv) so refactors stay free of real destroys.A review is complete only when ALL of these hold:
tfplan.json (create / update / replace / destroy) — not eyeballed from console color.replace_paths root cause and an explicit data-loss assessment.prevent_destroy, OR the verdict is NO-GO..tfvars checked for plaintext secrets; remote state confirmed encrypted + versioned + locked.terraform plan -detailed-exitcode interpreted correctly in any CI gate (treats exit 2 as "changes present").tfsec/checkov (or equivalent) run; findings triaged, not ignored.apply tfplan.bin), so there's no gap between review and execution.