Review Shift Completed! ๐
Here is your SRE Code Review Performance Report:
0 PTS
Simulated Outage Cost Averted: $0
Mastery Deep Dive
Read Full Guide โ
Read: How to Review Terraform Plans Without Destroying Production
10 critical traps, Conftest OPA guardrails, and the declarative moved block tutorial.
๐ The Terraform PR Reviewer's Field Guide
What does
- /+ really mean in a Terraform plan?
The symbol
- /+ denotes a destroy-and-recreate cycle. Terraform cannot update the existing cloud resource in-place because an immutable attribute was modified (marked with # forces replacement). For persistent infrastructure like Amazon RDS, S3, or EBS volumes, applying this without a replica or maintenance window causes instant data loss or downtime.
How does a refactor from
count to for_each trigger unexpected destruction?
When you switch from
count to for_each, Terraform sees your existing resources at integer indices (aws_instance.app[0], [1]) as deleted, and proposes creating brand new resources at string map keys (aws_instance.app["web"]). In Terraform 1.1+, you must declare moved {} blocks to migrate the state addresses safely with zero recreation downtime.
Why does
lifecycle { prevent_destroy = true } save production databases?
When
prevent_destroy = true is attached to a resource block, Terraform halts execution immediately during terraform plan or apply if any change triggers a destruction or replacement. It prevents human error by refusing to proceed until the flag is explicitly removed.