11# TFSumPy - Terraform Plan Analyzer
22
3+ [ ![ CI] ( https://github.com/rafaelherik/tfsumpy/actions/workflows/ci.yaml/badge.svg )] ( https://github.com/rafaelherik/tfsumpy/actions/workflows/ci.yaml )
4+
35TFSumPy is a Python-based tool that analyzes Terraform plan files to provide a clear summary of infrastructure changes and identify potential risks. It helps DevOps teams review infrastructure changes more effectively by:
46
57- Summarizing resource changes (create, update, delete)
@@ -13,14 +15,16 @@ TFSumPy is a Python-based tool that analyzes Terraform plan files to provide a c
1315- ⚠️ Identifies high-risk changes (deletions of critical resources, security group modifications)
1416- 🔒 Automatically redacts sensitive information (credentials, IPs, resource names)
1517- 📊 Provides clear summary statistics
16- - 🛡️ Supports both pre and post Terraform 0.12 plan formats
18+ - 🛡️ Supports Terraform 1.0+ plan formats
19+ - 📂 Module-aware resource grouping
20+ - 🔄 Detailed attribute change tracking
1721
1822## Installation
1923
2024Currently, TFSumPy can only be installed from source:
2125
2226``` bash
23- git clone https://github.com/notry-cloud /tfsumpy.git
27+ git clone https://github.com/rafaelherik /tfsumpy.git
2428cd tfsumpy
2529pip install .
2630```
@@ -37,13 +41,34 @@ terraform show -json tfplan > plan.json
3741Then analyze the plan using TFSumPy:
3842
3943``` bash
40- # Using default rules
44+ # Basic usage
4145tfsumpy plan.json
4246
47+ # Show resources grouped by module
48+ tfsumpy plan.json --show-module
49+
50+ # Show detailed attribute changes
51+ tfsumpy plan.json --show-changes
52+
4353# Using custom rules configuration
4454tfsumpy plan.json --config rules_config.json
55+
56+ # Enable debug logging
57+ tfsumpy plan.json --debug
58+
59+ # Show only specific sections
60+ tfsumpy plan.json --risks --details
4561```
4662
63+ ### Command Line Options
64+
65+ - ` --show-module ` : Group resources by their Terraform module
66+ - ` --show-changes ` : Display detailed attribute changes for resources
67+ - ` --risks ` : Show only the risk assessment section
68+ - ` --details ` : Show only the resource details section
69+ - ` --debug ` : Enable debug logging
70+ - ` --config ` : Specify a custom rules configuration file
71+
4772### Custom Rules Configuration
4873
4974You can customize the analysis rules by creating a JSON configuration file. Here's an example structure:
@@ -81,6 +106,10 @@ The configuration file allows you to define:
81106- ` sensitive_patterns ` : Regular expressions to identify and redact sensitive information
82107- ` risk_rules ` : Patterns to identify high and medium risk changes
83108
109+ ## Example Output
110+
111+ ### Default Output (without --show-module)
112+ ```
84113Infrastructure Change Analysis
85114==============================
86115Total Changes: 5
@@ -89,26 +118,64 @@ Update: 2
89118Delete: 1
90119
91120Risk Assessment:
121+ High Risks:
122+ - High risk: Security-related configuration change
123+ Medium Risks:
124+ - Medium risk: Version change could cause compatibility issues
92125
126+ Resource Details:
127+ CREATE aws_s3_bucket: project-storage-[REDACTED]
128+ UPDATE aws_security_group: app-sg-[REDACTED]
129+ ~ ingress = [] -> [{port = 443}]
130+ UPDATE aws_ecs_service: api-service
131+ DELETE aws_iam_role: legacy-role
132+ CREATE aws_lambda_function: processor-function
133+ ```
134+
135+ ### With Module Grouping (--show-module)
136+ ```
137+ Infrastructure Change Analysis
138+ ==============================
139+ Total Changes: 5
140+ Create: 2
141+ Update: 2
142+ Delete: 1
143+
144+ Changes by Module:
145+ root:
146+ Create: 1
147+ Update: 1
148+ module.storage:
149+ Create: 1
150+ Update: 1
151+ Delete: 1
152+
153+ Risk Assessment:
93154High Risks:
94155- High risk: Security-related configuration change
95156Medium Risks:
96- - Medium risk: Version change could cause compatibility issues
157+ - Medium risk: Version change could cause compatibility issues
158+
97159Resource Details:
98- - CREATE aws_s3_bucket: project-storage-[ REDACTED]
99- - UPDATE aws_security_group: app-sg-[ REDACTED]
100- - UPDATE aws_ecs_service: api-service
101- - DELETE aws_iam_role: legacy-role
102- - CREATE aws_lambda_function: processor-function
160+ Module: root
161+ CREATE aws_s3_bucket: project-storage-[REDACTED]
162+ UPDATE aws_security_group: app-sg-[REDACTED]
163+ ~ ingress = [] -> [{port = 443}]
164+
165+ Module: module.storage
166+ UPDATE aws_ecs_service: api-service
167+ DELETE aws_iam_role: legacy-role
168+ CREATE aws_lambda_function: processor-function
169+ ```
103170
104171## Requirements
105172
106- - Python 3.7 or higher
107- - Terraform 0.12 or higher (for plan generation)
173+ - Python 3.10 or higher
174+ - Terraform 1.0 or higher (for plan generation)
108175
109176## Contributing
110177
111- Contributions are welcome! Please feel free to submit a Pull Request.
178+ Contributions are welcome! Please feel free to submit a Pull Request. Visit our [ GitHub repository ] ( https://github.com/rafaelherik/tfsumpy ) for more information.
112179
113180## License
114181
0 commit comments