AutoGineer
Generated banner for Terraform Azurerm Set Diff Analyzer
Generated logo for Terraform Azurerm Set Diff Analyzer

Terraform Azurerm Set Diff Analyzer

GitHubOfficialFirst committed by torumakabeDistributed by GitHub

  • Skill
  • Review and audit
  • Software development
  • MIT
  • Low risk
  • Has scripts
Download ZIP

From the author

Analyze Terraform plan JSON output for AzureRM Provider to distinguish between false-positive diffs (order-only changes in Set-type attributes) and actual resource changes. Use when reviewing terraform plan output for Azure resources like Application Gateway, Load Balancer, Firewall, Front Door, NSG, and other resources with Set-type attributes that cause spurious diffs due to internal ordering changes.
— the description by torumakabe

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The Terraform AzureRM Set Diff Analyzer helps developers distinguish between actual infrastructure changes and spurious diffs in Terraform plans. Because Terraform's Set type does not guarantee order, adding or removing elements can cause the provider to report that all elements in a set have changed. This tool parses the JSON output of a Terraform plan and uses a configurable definition file to identify these false-positive diffs, making it easier to review infrastructure changes for complex Azure resources like Application Gateways, Load Balancers, and Network Security Groups.

What it does

  • Analyzes Terraform plan JSON output to identify false-positive diffs.
  • Distinguishes between actual resource changes and ordering-only changes in Set-type attributes.
  • Supports nested Set-type attribute structures for complex Azure resources.
  • Uses a JSON-based definition file to map resource attributes to their unique identifiers.
  • Provides a command-line interface for integration into CI/CD pipelines.

When to use it

  • When a Terraform plan shows excessive changes despite minor modifications.
  • When reviewing plans for resources like Application Gateway, Load Balancer, or NSG.
  • When you need to clean up plan output for easier human review.
  • When automating infrastructure validation in CI/CD to ignore non-functional diffs.

Advantages

  • Reduces noise in Terraform plan reviews.
  • Prevents confusion caused by AzureRM Provider's Set-type attribute behavior.
  • Highly configurable via external JSON definitions for new or updated resources.
  • Lightweight implementation using only Python standard libraries.

Usage examples

“How do I analyze my Terraform plan for false positives?”
Generate the plan JSON using 'terraform show -json plan.tfplan > plan.json' and run 'python scripts/analyze_plan.py plan.json' to see the filtered results.
“How can I add a new Azure resource to the analyzer?”
Update the azurerm_set_attributes.json file by adding the resource type and identifying the key attribute (e.g., 'name') that uniquely identifies elements within the Set.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/github/terraform-azurerm-set-diff-analyzer/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip terraform-azurerm-set-diff-analyzer.zip -d .agents/skills

Documentation by torumakabe

Terraform AzureRM Set Diff Analyzer

A skill to identify "false-positive diffs" in Terraform plans caused by AzureRM Provider's Set-type attributes and distinguish them from actual changes.

When to Use

  • terraform plan shows many changes, but you only added/removed a single element

  • Application Gateway, Load Balancer, NSG, etc. show "all elements changed"

  • You want to automatically filter false-positive diffs in CI/CD

Background

Terraform's Set type compares by position rather than by key, so when adding or removing elements, all elements appear as "changed". This is a general Terraform issue, but it's particularly noticeable with AzureRM resources that heavily use Set-type attributes like Application Gateway, Load Balancer, and NSG.

These "false-positive diffs" don't actually affect the resources, but they make reviewing terraform plan output difficult.

Prerequisites

  • Python 3.8+

If Python is unavailable, install via your package manager (e.g., apt install python3, brew install python3) or from python.org.

Basic Usage

# 1. Generate plan JSON output
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json

# 2. Analyze
python scripts/analyze_plan.py plan.json

Troubleshooting

  • python: command not found: Use python3 instead, or install Python

  • ModuleNotFoundError: Script uses only standard library; ensure Python 3.8+

Detailed Documentation

Files

scripts/README.md

Terraform AzureRM Set Diff Analyzer Script

A Python script that analyzes Terraform plan JSON and identifies "false-positive diffs" in AzureRM Set-type attributes.

Overview

AzureRM Provider's Set-type attributes (such as backend_address_pool, security_rule, etc.) don't guarantee order, so when adding or removing elements, all elements appear as "changed". This script distinguishes such "false-positive diffs" from actual changes.

Use Cases

  • As an Agent Skill (recommended)

  • As a CLI tool for manual execution

  • For automated analysis in CI/CD pipelines

Prerequisites

  • Python 3.8 or higher

  • No additional packages required (uses only standard library)

Usage

Basic Usage
# Read from file
python analyze_plan.py plan.json

# Read from stdin
terraform show -json plan.tfplan | python analyze_plan.py
Options
OptionShortDescriptionDefault
--format-fOutput format (markdown/json/summary)markdown
--exit-code-eReturn exit code based on changesfalse
--quiet-qSuppress warningsfalse
--verbose-vShow detailed warningsfalse
--ignore-case-Compare values case-insensitivelyfalse
--attributes-Path to custom attribute definition file(built-in)
--include-Filter resources to analyze (can specify multiple)(all)
--exclude-Filter resources to exclude (can specify multiple)(none)
Exit Codes (with --exit-code)
CodeMeaning
0No changes, or order-only changes
1Actual Set attribute changes
2Resource replacement (delete + create)
3Error

Output Formats

Markdown (default)

Human-readable format for PR comments and reports.

python analyze_plan.py plan.json --format markdown
JSON

Structured data for programmatic processing.

python analyze_plan.py plan.json --format json

Example output:

{
  "summary": {
    "order_only_count": 3,
    "actual_set_changes_count": 1,
    "replace_count": 0
  },
  "has_real_changes": true,
  "resources": [...],
  "warnings": []
}
Summary

One-line summary for CI/CD logs.

python analyze_plan.py plan.json --format summary

Example output:

🟢 3 order-only | 🟡 1 set changes

CI/CD Pipeline Usage

GitHub Actions
name: Terraform Plan Analysis

on:
  pull_request:
    paths:
      - '**.tf'

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        
      - name: Terraform Init & Plan
        run: |
          terraform init
          terraform plan -out=plan.tfplan
          terraform show -json plan.tfplan > plan.json
          
      - name: Analyze Set Diff
        run: |
          python path/to/analyze_plan.py plan.json --format markdown > analysis.md
          
      - name: Comment PR
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          path: analysis.md
GitHub Actions (Gate with Exit Code)
      - name: Analyze and Gate
        run: |
          python path/to/analyze_plan.py plan.json --exit-code --format summary
        # Fail on exit code 2 (resource replacement)
        continue-on-error: false
Azure Pipelines
- task: TerraformCLI@0
  inputs:
    command: 'plan'
    commandOptions: '-out=plan.tfplan'

- script: |
    terraform show -json plan.tfplan > plan.json
    python scripts/analyze_plan.py plan.json --format markdown > $(Build.ArtifactStagingDirectory)/analysis.md
  displayName: 'Analyze Plan'

- task: PublishBuildArtifacts@1
  inputs:
    pathToPublish: '$(Build.ArtifactStagingDirectory)/analysis.md'
    artifactName: 'plan-analysis'
Filtering Examples

Analyze only specific resources:

python analyze_plan.py plan.json --include application_gateway --include load_balancer

Exclude specific resources:

python analyze_plan.py plan.json --exclude virtual_network

Interpreting Results

CategoryMeaningRecommended Action
🟢 Order-onlyFalse-positive diff, no actual changeSafe to ignore
🟡 Actual changeSet element added/removed/modifiedReview the content, usually in-place update
🔴 Resource replacementdelete + createCheck for downtime impact

Custom Attribute Definitions

By default, uses references/azurerm_set_attributes.json, but you can specify a custom definition file:

python analyze_plan.py plan.json --attributes /path/to/custom_attributes.json

See references/azurerm_set_attributes.md for the definition file format.

Limitations

  • Only AzureRM resources (azurerm_*) are supported

  • Some resources/attributes may not be supported

  • Comparisons may be incomplete for attributes containing after_unknown (values determined after apply)

  • Comparisons may be incomplete for sensitive attributes (they are masked)

Related Documentation

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs a command-line tool, Needs Python

Security

What our scanner noticed· Low risk

  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by
GitHub avatar of torumakabetorumakabe
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · skills/terraform-azurerm-set-diff-analyzer · commit 797337f
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
torumakabe

AutoGineer is not affiliated with or endorsed by torumakabe or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download terraform-azurerm-set-diff-analyzer.zip