Terraform · Infrastructure change review
Terraform Pull Request Checklist
A review template for Terraform plans, provider changes, state impact, identity boundaries, destructive operations and rollback evidence.
Choose the right control
Use this template when
- A Terraform pull request can change managed infrastructure or provider behaviour.
- A plan includes replacements, deletions, identity changes or state-sensitive operations.
Use another workflow when
- The change only updates prose or comments and produces an empty plan.
- You are recovering damaged state; use a state-recovery checklist with stricter lineage controls.
Before you start
Collect these inputs before review so unchecked controls become evidence-backed decisions rather than placeholders.
Access to the correct backend and workspace
A plan generated from the reviewed commit
Named apply authority and post-change verifier
How to use this template
1
Attach the plan produced from the target workspace and commit.
2
Explain every replacement or deletion in the review.
3
Re-plan immediately before apply if upstream state can change.
Copyable template
# Terraform change review ## Scope - [ ] Target account, subscription, project and region are explicit - [ ] Workspace and state backend are correct - [ ] Terraform and provider version changes are intentional - [ ] Generated plan corresponds to the reviewed commit ## Plan review - [ ] Create, update, replace and delete counts are recorded - [ ] Every replacement and deletion has an impact explanation - [ ] Sensitive values are not exposed in plan output or logs - [ ] Unknown values and apply-time dependencies are understood ## Security and reliability - [ ] Execution role has only the permissions required for this change - [ ] Public exposure, IAM, encryption and logging changes are reviewed - [ ] Availability-zone and failure-domain effects are considered - [ ] Lifecycle ignores and prevent_destroy settings remain justified ## Delivery - [ ] Dependencies and sequencing are documented - [ ] Rollback or forward-fix path is viable - [ ] Post-apply checks identify successful convergence - [ ] Drift and a final no-change plan will be reviewed
Evidence to retain
Review record
- Plan summary and explanations for destructive actions
- Provider lock-file and version changes
- Post-apply validation and final no-change plan
Definition of done
Acceptance criteria
- The reviewed commit and applied plan are cryptographically or operationally linked.
- Every replace or delete action has an approved impact statement.
- The change has a viable rollback or explicitly approved forward-fix path.
Worked adaptation
Apply it to a real change
A pull request upgrades an AWS provider and replaces a launch template while preserving an Auto Scaling Group. Reviewers need to separate provider-driven drift from the intended rollout.
- Attach plans from before and after the provider upgrade.
- Explain the launch-template replacement and instance-refresh sequence.
- Require a final plan after the refresh completes.
Related KBY resources
Engineering signal
Follow Terraform failures and fixes
A useful digest about twice a week with new error references, tools, integration notes and production lessons. No daily noise.