Terraform AzureRM Set Diff Analyzer

A skill to identify "false-positive diffs" in Terraform plans caused by AzureRM Provider's Set-type attributes and distinguish them from actual changes.

When to Use

terraform plan shows many changes, but you only added/removed a single element
Application Gateway, Load Balancer, NSG, etc. show "all elements changed"
You want to automatically filter false-positive diffs in CI/CD

Background

Terraform's Set type compares by position rather than by key, so when adding or removing elements, all elements appear as "changed". This is a general Terraform issue, but it's particularly noticeable with AzureRM resources that heavily use Set-type attributes like Application Gateway, Load Balancer, and NSG.

These "false-positive diffs" don't actually affect the resources, but they make reviewing terraform plan output difficult.

Prerequisites

Python 3.8+

If Python is unavailable, install via your package manager (e.g., apt install python3, brew install python3) or from python.org.

Basic Usage

# 1. Generate plan JSON output
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json

# 2. Analyze
python scripts/analyze_plan.py plan.json

Troubleshooting

python: command not found: Use python3 instead, or install Python
ModuleNotFoundError: Script uses only standard library; ensure Python 3.8+

Detailed Documentation

scripts/README.md - All options, output formats, exit codes, CI/CD examples
references/azurerm_set_attributes.md - Supported resources and attributes

Files6

6 files · 46.1 KB

Select a file to preview

Overall Score

88/100

Grade

A

Excellent

Safety

88

Quality

88

Clarity

88

Completeness

86

Summary

A Python-based analyzer for Terraform plan JSON that identifies "false-positive diffs" caused by AzureRM Set-type attributes reordering. The skill guides users through generating plan output and running an analysis script to distinguish spurious changes from actual resource modifications, with support for multiple output formats and CI/CD integration.

Static Analysis Findings

1 finding

Patterns detected by deterministic static analysis before AI scoring. Hover over any finding code for detailed information and remediation guidance.

Credential Exposure

SEC-020Direct .env File Access

Direct .env file access

scripts/.gitignore.env

85% confidenceCWE-538: Sensitive Info in Externally-Accessible File

Detected Capabilities

file read (terraform plan JSON)file write (analysis reports in markdown/json)stdout outputcli argument parsingjson parsing and processing

Trigger Keywords

Phrases that MCP clients use to match this skill to user intent.

terraform plan analysisfalse-positive diffsazurerm set attributesreview terraform changesfilter spurious diffs

Risk Signals

INFO

Direct .env file access documented in .gitignore

scripts/.gitignore

Referenced Domains

External domains referenced in skill content, detected by static analysis.

github.comregistry.terraform.iowww.python.org

Use Cases

Review Terraform plans for Azure resources with Set-type attributes to filter out order-only changes
Automate detection of false-positive diffs in CI/CD pipelines for Terraform deployments
Analyze Application Gateway, Load Balancer, NSG, and Firewall plans where all elements appear changed but only some were added/removed
Generate structured JSON or Markdown reports of meaningful Terraform changes for PR reviews
Gate Terraform deployments on actual resource changes versus spurious Set reordering

Quality Notes

Comprehensive documentation with real-world Azure resource examples
Well-structured nested Set analysis with recursive attribute definitions
Multiple output formats (markdown, json, summary) for different use cases
Clear CI/CD integration examples (GitHub Actions, Azure Pipelines)
Extensive error handling for missing files, invalid JSON, and duplicate keys
Edge cases addressed: primitive sets, nested sets, case-insensitive comparison, sensitive attributes
Exit codes designed for automation and gating workflows
Python standard library only—no external dependencies
Attribute reference file (JSON) is well-documented and maintainable
Supporting documentation (README.md) covers prerequisites, options, and troubleshooting

Model: claude-haiku-4-5-20251001Analyzed: Jun 26, 2026

Reviews

Add this skill to your library to leave a review.

No reviews yet

Be the first to share your experience.

terraform-azurerm-set-diff-analyzer