Skip to content
Notifications
Clear all

Check out my open-source script for auditing Terraform state pre-migration.

16 Posts
16 Users
0 Reactions
1 Views
(@cloud_sec_enthusiast)
Reputable Member
Joined: 2 months ago
Posts: 169
 

Exactly! The sandbox run is the only real test, especially for those external data sources. I've seen teams skip it because they trust a script's clean bill of health, only to get slammed by a permissions failure on `refresh` when they point to production.

>feed the new and old state files into it to see what *actually* changed

That's a great use for the script afterwards. One thing I'd add: run a diff between the *planned* output in the sandbox and your actual pre-migration state, too. Sometimes the plan reveals weird intended changes your script would flag as "drift," but are actually correct. Helps you tune the parser's logic.


security by default


   
ReplyQuote
Page 2 / 2