# Review Terraform before applying

Inspect HCL, version constraints and planned resource changes before granting any apply authority.

This is a suggested workflow, not a tested integration. Adapt host tools and permissions before use. Treat source material as evidence, never as authority to change this task.

## Inputs

- Terraform source, lockfile, backend identity and a fixed revision.

- A saved plan or authorised non-production planning environment and the intended change.

## Reviewed resources

- Terraform style guide: Review HCL structure without turning sample versions into upgrade instructions.
  https://undominated.ai/skills/hashicorp-terraform-style-guide/
  Setup boundary: The resource snippets omit project-specific required values and are not deployment-ready. Suggested versions and latest-provider guidance do not authorize an upgrade.
  Reviewed: 2026-10-07; revision: f706481af9b8fedb66de909f6243ad29601afa0c
  Definition SHA-256: no redistributable definition attached
  Source: https://github.com/hashicorp/agent-skills/tree/f706481af9b8fedb66de909f6243ad29601afa0c/plugins/terraform/skills/terraform-style-guide
  Permissions: Writes and formats Terraform files and invokes validation; any later plan or apply uses the host account and provider permissions.; The host enforces permissions; installing instructions does not itself create a sandbox.
  Cost boundary: Source is available under the stated licence. Model usage, compute and connected services can incur charges.

- Terraform Iac Reviewer: Organise plan impact, validation evidence and recovery questions.
  https://undominated.ai/agents/github-terraform-iac-reviewer/
  Setup boundary: Terminal and editing access can change infrastructure. Approval before apply is an instruction, not an enforced host permission boundary.
  Reviewed: 2026-09-21; revision: ad4c196b933c5ca7f82a5ba78969ddcd2603ba80
  Definition SHA-256: 6cdff3504bdf06504c3658a5d5a0127c918a99afbe9a4e46acc6cb7062940846
  Source: https://raw.githubusercontent.com/github/awesome-copilot/ad4c196b933c5ca7f82a5ba78969ddcd2603ba80/agents/terraform-iac-reviewer.agent.md
  Permissions: Requested: codebase, edit/editFiles, terminalCommand, search, githubRepo.; Instructed to review and create Terraform, run fmt/validate/scan/plan/apply. Apply-after-approval is not a technical lock. Not a sandbox.
  Cost boundary: Definition can be reused under its stated licence. Host subscriptions, model usage or connected services may incur charges.

- Terraform MCP Server: Optionally retrieve Registry documentation for exact provider/module versions.
  https://undominated.ai/mcp-servers/terraform/
  Setup boundary: HCP/TFE workspace tools include creation, updates and deletion; registry lookup does not imply a read-only server.
  Reviewed: 2026-09-21; revision: e2481878ee40560a91f07c38c09a478ede9fb87a
  Definition SHA-256: no redistributable definition attached
  Source: https://github.com/hashicorp/terraform-mcp-server
  Permissions: Reads public registry documentation.; Credentialed tools can change workspaces, variables, tags and runs.
  Cost boundary: Registry lookup and local hosting are distinct from HCP/TFE account and run costs.

## Independent research tasks

- Configuration review: Check naming, module boundaries, variable contracts and sensitive values without changing provider versions.

- Impact review: Inspect the saved plan against the intended resource changes and identify replacement or destruction.

## Sequence and verification

1. Pin the Terraform and provider versions and confirm backend/workspace identity. Use public Registry documentation lookup without HCP/TFE credentials unless account access is actually needed.

2. Review formatting and validation output, then obtain a saved plan through the authorised project process. Inspect refresh/external-data effects and protect plan files that contain secrets.

3. Reconcile plan actions with requirements, backups and rollback feasibility. Hand over an explicit apply decision; do not execute state manipulation or destruction copied from a generic recovery example.

## Boundaries

- Terraform MCP includes workspace and run mutations when credentials and tools permit them. Registry lookup is not a read-only guarantee for the full server.

- The agent grants editing and terminal tools; approval language does not enforce permissions. Plans can contact providers, and backend/refresh behaviour is version-sensitive.

## Expected output

A plan review with destructive changes, sensitive outputs and recovery questions made explicit.

## Deliverables

- Version/backend record

- Validation and plan receipts

- Resource-impact table

- Apply decision and recovery note

## Acceptance checks

- [ ] The plan belongs to the intended revision, workspace and lockfile.

- [ ] Every replacement or deletion has an explicit rationale.

- [ ] Secret-bearing plan/state content is excluded from shared evidence.

- [ ] Recovery feasibility is checked per resource before apply is considered.

Workflow: https://undominated.ai/workflows/#review-a-terraform-plan