[{"data":1,"prerenderedAt":99},["Reactive",2],{"work-terraform-guard-rails":3,"work-next-terraform-guard-rails":96},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":7,"kicker":9,"summary":10,"cover":11,"coverSmall":12,"coverAlt":13,"role":14,"where":15,"stack":16,"stats":19,"next":26,"order":27,"body":28,"_type":90,"_id":91,"_source":92,"_file":93,"_stem":94,"_extension":95},"/work/terraform-guard-rails","work",false,"","Terraform with guard rails","Company template · Storm Reply","The starting point for new AWS projects: agent skills for Terraform work, a plan review that flags IAM widening, replacements and cost changes, and tested hooks that block destructive changes.","/3d/cover-terraform-template.webp","/3d/cover-terraform-template-640.webp","Clay model of a dark disc on a plinth, fenced off behind a teal gate","Wrote it","Storm Reply UK",[17,18],"Terraform","GitHub Actions",[20,23],{"value":21,"label":22},"22","Claude Code and Codex skills",{"value":24,"label":25},"Every PR","plans all environments, gated apply","software-toolkit",4,{"type":29,"children":30,"toc":87},"root",[31],{"type":32,"tag":33,"props":34,"children":36},"element","case-section",{"label":35},"Overview",[37,43,57,62,82],{"type":32,"tag":38,"props":39,"children":40},"p",{},[41],{"type":42,"value":10},"text",{"type":32,"tag":38,"props":44,"children":45},{},[46,48,55],{"type":42,"value":47},"The plan review is a script and a skill working together. ",{"type":32,"tag":49,"props":50,"children":52},"code",{"className":51},[],[53],{"type":42,"value":54},"check_plan.py",{"type":42,"value":56}," reads the JSON plan and classifies its impact. Red for a destroy or a replace, for IAM widening, meaning a star action on a star resource, a star principal or a condition removed, and for ingress opened to the world. Amber for updates, security-relevant types, cost-bearing creates and anything targeting prod. A hook then fires on the fresh plan and tells the agent to run the review-plan skill, which works a fixed checklist of intent match, replacements, IAM and network widening and cost delta, and returns one of three verdicts: pass, pass with concerns, or do not apply.",{"type":32,"tag":38,"props":58,"children":59},{},[60],{"type":42,"value":61},"What that catches is not cleverness. It is the things a human reviewer stops seeing. A replace buried two hundred lines into a diff nobody scrolls to the end of. A wildcard that widens a policy by one character. A condition block removed rather than added. Deletes are handled separately and bluntly: any delete or replace fails the plan outright unless a flag is set, and the rule is that the flag is never set without showing a person the literal list of what goes.",{"type":32,"tag":38,"props":63,"children":64},{},[65,67,73,75,80],{"type":42,"value":66},"Every classification rule has a fixture plan next to it, so changing a rule without changing a test fails ",{"type":32,"tag":49,"props":68,"children":70},{"className":69},[],[71],{"type":42,"value":72},"make check",{"type":42,"value":74},". The hooks work the same way. There are six, each with a test beside it, and ",{"type":32,"tag":49,"props":76,"children":78},{"className":77},[],[79],{"type":42,"value":72},{"type":42,"value":81}," runs all of them. The two that earn their keep refuse to let the agent edit the files that constrain it, the bootstrap stack, the state, the hooks directory and the harness settings, and block a recursive force delete aimed at the repo root.",{"type":32,"tag":38,"props":83,"children":84},{},[85],{"type":42,"value":86},"The template only moves in one direction. A bug found in a hook, a script or a workflow on a live project is filed on the template's own board and fixed there, never patched in place, so the fix reaches every project started from it afterwards.",{"title":7,"searchDepth":88,"depth":88,"links":89},2,[],"markdown","content:work:terraform-guard-rails.md","content","work/terraform-guard-rails.md","work/terraform-guard-rails","md",{"_path":97,"title":98},"/work/software-toolkit","Software Toolkit",1789325965391]