Terraform Destroy Impact Analyzer

The Terraform Destroy Impact Analyzer reads a Terraform plan in JSON format and reports exactly which resources a real apply would destroy, separating plain destroys from replacements that delete and recreate a resource. It turns the often dense plan output into a short, readable report before you approve anything.

You paste the JSON produced by terraform show -json after a plan, and the analyzer walks the resource_changes list to find every action that includes delete. Resources that are both deleted and created are listed as replacements, because the resource is removed and then rebuilt rather than merely updated. Nothing is executed and nothing is uploaded; the tool only inspects the plan you provide, so it is completely safe to use on a laptop or to share in a review. It is a fast way to confirm the blast radius of a change and to catch surprises before they reach production.

The analyzer is especially valuable in continuous integration. By exporting the Markdown report and attaching it to a pull request, reviewers get a plain-language summary of what a plan will tear down, which is far easier to reason about than raw JSON. It also helps answer the common question of whether a change is a safe update or a destructive replacement before any infrastructure is touched. Because the report is plain text, it can be archived alongside the plan for audit purposes later.

Replacement detection deserves special attention. A resource that is both deleted and created is not merely changed; it is destroyed and rebuilt, so any local state or attached data is lost. The analyzer keeps replacements in their own list precisely so this higher-risk outcome is impossible to miss during a hurried review.

• Destroy list - every resource whose action includes delete.
• Replace list - deletes that are also creates, so the resource is rebuilt.
• Totals - counts of destroyed, replaced, and total removed resources.
• Plan JSON input - accepts the output of terraform show -json.
• Client-side only - the plan is parsed in your browser.
• Clear report - a Markdown summary you can paste into a review.
• Copy, download and print - export the report as Markdown.
• No execution - nothing is applied or destroyed by the tool.
• No cloud connection - paste a plan and read the result locally.
• Private - your plan never leaves the page.
• CI friendly - attach the Markdown report to a pull request.
• Replace awareness - highlights resources that will be recreated, not just deleted.
• Auditable - archive the report next to the plan for later review.

1. Create a plan with terraform plan and save its JSON using terraform show -json plan.out then redirect to a file.
2. Open the analyzer and paste the plan JSON into the input box.
3. Click Analyze impact to scan the resource_changes.
4. Review the destroy list to see which resources would be removed.
5. Review the replace list to see which resources would be deleted and recreated.
6. Check the totals at the top for a quick blast-radius summary.
7. Export the report with Copy, Download as Markdown, or Print.
8. Start over with Clear, or load a sample plan with Load sample.
9. Share the report in a pull request so reviewers see the impact.

Example - one destroy and one replace. A plan that deletes null_resource.old and replaces aws_instance.web yields one entry under destroys and one under replaces, with a total of two resources removed from state. A no-op resource such as aws_s3_bucket.keep appears in neither list.

Example - empty plan. A plan with no deletes produces empty destroy and replace lists, confirming the change is safe to apply.

Example - replacement risk. A managed resource whose identity changes, such as an aws_instance with a new ami, shows as a replace: the old instance is destroyed and a new one created, so any data on it is lost. The report makes that explicit so the change can be reviewed with the right urgency.

• Safe preview - see the blast radius before you apply.
• Clear separation - replacements are called out from plain destroys.
• Fast - instant analysis of any plan JSON.
• Reviewable - export a Markdown report for pull requests.
• Local - no uploads and no cloud connection.
• Risk reducing - catch unexpected destroys early.
• CI friendly - drop the report into a pipeline summary.
• Replace aware - surfaces recreate risk explicitly.