Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -78,3 +78,6 @@ Pipfile.lock

# poetry
poetry.lock

# cursor rules
.cursorrules
91 changes: 79 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# TFSumPy - Terraform Plan Analyzer

[![CI](https://github.com/rafaelherik/tfsumpy/actions/workflows/ci.yaml/badge.svg)](https://github.com/rafaelherik/tfsumpy/actions/workflows/ci.yaml)

TFSumPy is a Python-based tool that analyzes Terraform plan files to provide a clear summary of infrastructure changes and identify potential risks. It helps DevOps teams review infrastructure changes more effectively by:

- Summarizing resource changes (create, update, delete)
Expand All @@ -13,14 +15,16 @@ TFSumPy is a Python-based tool that analyzes Terraform plan files to provide a c
- ⚠️ Identifies high-risk changes (deletions of critical resources, security group modifications)
- 🔒 Automatically redacts sensitive information (credentials, IPs, resource names)
- 📊 Provides clear summary statistics
- 🛡️ Supports both pre and post Terraform 0.12 plan formats
- 🛡️ Supports Terraform 1.0+ plan formats
- 📂 Module-aware resource grouping
- 🔄 Detailed attribute change tracking

## Installation

Currently, TFSumPy can only be installed from source:

```bash
git clone https://github.com/notry-cloud/tfsumpy.git
git clone https://github.com/rafaelherik/tfsumpy.git
cd tfsumpy
pip install .
```
Expand All @@ -37,13 +41,34 @@ terraform show -json tfplan > plan.json
Then analyze the plan using TFSumPy:

```bash
# Using default rules
# Basic usage
tfsumpy plan.json

# Show resources grouped by module
tfsumpy plan.json --show-module

# Show detailed attribute changes
tfsumpy plan.json --show-changes

# Using custom rules configuration
tfsumpy plan.json --config rules_config.json

# Enable debug logging
tfsumpy plan.json --debug

# Show only specific sections
tfsumpy plan.json --risks --details
```

### Command Line Options

- `--show-module`: Group resources by their Terraform module
- `--show-changes`: Display detailed attribute changes for resources
- `--risks`: Show only the risk assessment section
- `--details`: Show only the resource details section
- `--debug`: Enable debug logging
- `--config`: Specify a custom rules configuration file

### Custom Rules Configuration

You can customize the analysis rules by creating a JSON configuration file. Here's an example structure:
Expand Down Expand Up @@ -81,6 +106,10 @@ The configuration file allows you to define:
- `sensitive_patterns`: Regular expressions to identify and redact sensitive information
- `risk_rules`: Patterns to identify high and medium risk changes

## Example Output

### Default Output (without --show-module)
```
Infrastructure Change Analysis
==============================
Total Changes: 5
Expand All @@ -89,26 +118,64 @@ Update: 2
Delete: 1

Risk Assessment:
High Risks:
- High risk: Security-related configuration change
Medium Risks:
- Medium risk: Version change could cause compatibility issues

Resource Details:
CREATE aws_s3_bucket: project-storage-[REDACTED]
UPDATE aws_security_group: app-sg-[REDACTED]
~ ingress = [] -> [{port = 443}]
UPDATE aws_ecs_service: api-service
DELETE aws_iam_role: legacy-role
CREATE aws_lambda_function: processor-function
```

### With Module Grouping (--show-module)
```
Infrastructure Change Analysis
==============================
Total Changes: 5
Create: 2
Update: 2
Delete: 1

Changes by Module:
root:
Create: 1
Update: 1
module.storage:
Create: 1
Update: 1
Delete: 1

Risk Assessment:
High Risks:
- High risk: Security-related configuration change
Medium Risks:
- Medium risk: Version change could cause compatibility issues
- Medium risk: Version change could cause compatibility issues

Resource Details:
- CREATE aws_s3_bucket: project-storage-[REDACTED]
- UPDATE aws_security_group: app-sg-[REDACTED]
- UPDATE aws_ecs_service: api-service
- DELETE aws_iam_role: legacy-role
- CREATE aws_lambda_function: processor-function
Module: root
CREATE aws_s3_bucket: project-storage-[REDACTED]
UPDATE aws_security_group: app-sg-[REDACTED]
~ ingress = [] -> [{port = 443}]

Module: module.storage
UPDATE aws_ecs_service: api-service
DELETE aws_iam_role: legacy-role
CREATE aws_lambda_function: processor-function
```

## Requirements

- Python 3.7 or higher
- Terraform 0.12 or higher (for plan generation)
- Python 3.10 or higher
- Terraform 1.0 or higher (for plan generation)

## Contributing

Contributions are welcome! Please feel free to submit a Pull Request.
Contributions are welcome! Please feel free to submit a Pull Request. Visit our [GitHub repository](https://github.com/rafaelherik/tfsumpy) for more information.

## License

Expand Down
62 changes: 53 additions & 9 deletions makefile
Original file line number Diff line number Diff line change
@@ -1,28 +1,72 @@
.PHONY: help test clean build release
.PHONY: help install dev-install clean build test lint check release run-sample debug-sample venv

VERSION ?= $(error Please set VERSION variable to create a release: make release VERSION=0.1.0)
VENV = .venv
PYTHON = $(VENV)/bin/python3
PIP = $(VENV)/bin/pip

help:
@echo "Available commands:"
@echo " make test - Run tests"
@echo " make clean - Remove build artifacts"
@echo " make build - Build the package"
@echo " make release - Create a new release (requires VERSION=X.Y.Z)"
@echo " make venv - Create virtual environment"
@echo " make install - Install package in production mode"
@echo " make dev-install - Install package in development mode with test dependencies"
@echo " make test - Run tests"
@echo " make lint - Run linting checks"
@echo " make check - Run all checks (lint + test)"
@echo " make clean - Remove build artifacts"
@echo " make build - Build the package"
@echo " make release - Create a new release (requires VERSION=X.Y.Z)"
@echo " make run-sample - Run tfsumpy with sample1.json plan file"
@echo " make debug-sample - Run tfsumpy with sample1.json plan file and custom config"

test:
pytest
# Virtual environment
venv:
python3 -m venv $(VENV)
$(PIP) install --upgrade pip

# Installation targets
install: venv
$(PIP) install .

dev-install: venv
$(PIP) install -e ".[dev]"
$(PIP) install pytest pylint mypy

# Development commands
test: dev-install
$(PYTHON) -m pytest tfsumpy/tests/



lint: dev-install
$(PYTHON) -m pylint tfsumpy
$(PYTHON) -m mypy tfsumpy

check: lint test

# Build commands
clean:
rm -rf build/
rm -rf dist/
rm -rf *.egg-info
rm -rf .pytest_cache
rm -rf .mypy_cache
rm -rf .coverage
find . -type d -name __pycache__ -exec rm -rf {} +
find . -type f -name "*.pyc" -delete

build: clean
python -m build
$(PYTHON) -m build

# Sample commands
run-sample: install
$(PYTHON) -m tfsumpy samples/sample1.json --debug

debug-sample: install
$(PYTHON) -m tfsumpy samples/sample1.json --debug --config tfsumpy/rules_config.json

release: test clean
# Release command (unchanged)
release: check clean
@echo "Creating release for version $(VERSION)"
@# Update version in __init__.py (works on both Linux and macOS)
@sed -i.bak "s/__version__ = .*/__version__ = '$(VERSION)'/" tfsumpy/__init__.py && rm -f tfsumpy/__init__.py.bak
Expand Down
Loading