A Terraform plan tells you what will change. It does not tell you whether the change is safe.
blastcheck reads terraform show -json and emits an Impact Manifest: a machine-readable change-safety assertion. Free, offline, no credentials, no hosted service.
That file was produced by this tool. It records, for every resource change in a plan, whether the change is reversible, whether anything becomes unrecoverable, whether exposure widens, and — the part that matters most — what could not be determined.
An unknown in that document is not a bug. It means the producer could not verify something, and is saying so rather than guessing. Unproven is not safe, and a consumer must never treat it as such.
pip install blastcheck
terraform plan -out tfplan
terraform show -json tfplan | blastcheck > manifest.jsonIn a pull request:
- run: terraform show -json tfplan > plan.json
- uses: prococonsulting/blastcheck@v0
with:
plan: plan.json| Dimension | Example the plan can actually prove |
|---|---|
reversibility | An Azure managed disk grow is one-way. Azure cannot shrink a disk. |
security_posture | An inbound rule opening 0.0.0.0/0 to 22 or 3389; a storage account turning on public access, lowering TLS, or flipping its firewall to default-allow. |
data_durability | A delete removes the primary copy of a data-bearing resource, and recoverability is unverified rather than assumed. |
state_confidence | Always not_verified offline. A plan trusts recorded state; nothing here checked that trust. |
safeblastcheck is offline by design. It never queries live cloud state, so it is not entitled to certify that a change is safe — it can only report caution, blocked, or unknown. That is not a limitation being apologised for. A tool that says safe when it means I found no problem converts an absence of information into a green light and puts someone's name on it.
A false safe is catastrophic. A false unknown is annoying. The format is built around that asymmetry.
blastcheck --plan plan.json --sign > manifest.json
blastcheck --verify manifest.json--sign attaches a digest over the manifest canonicalized with JCS (RFC 8785), so two conformant producers of the same logical document compute the same bytes. Editing a verdict after the fact breaks verification.
Impact Manifest is an open specification, Apache-2.0, with no assumption of any cloud and no coupling to any implementation. blastcheck is a reference producer of it, not its owner. Other tools are expected to implement it, and the format is only worth anything if they do.