Lion Cipher Lab
Read one Terraform plan JSON and prove what it will change before you approve
- Cloud Security
- Intermediate
- ~50 min
- Free · no account required
Why it matters
On most teams, cloud changes reach production through a pull request that someone approves after glancing at a Terraform plan. The plan is often hundreds of lines long, the approver is busy, and the only line everybody actually reads is the summary at the bottom. That summary counts changes; it does not tell you which change opens SSH to the internet, gives a deploy role every permission in the account, switches off the audit trail or deletes the production database without a final snapshot. The plan JSON does tell you, if you ask it the right questions. This lab hands you one plan for a…
What you'll learn
- reading the Terraform plan JSON format: resource_changes, actions, before, after, after_unknown
- counting create, update, delete and replace correctly with jq (and why the naive counts are wrong)
- writing jq rules that pull security-relevant changes out of a large plan, with evidence
- parsing a JSON string inside JSON (an IAM policy) with fromjson
- keeping an 'unflagged, read by hand' list so rules never become the whole review
- writing down what a plan cannot prove: unknown values, apply-time reads, drift, secrets, authorisation
- deciding block versus approve-with-a-note on a real change set
Steps in this lab
- The words first: Terraform, plan, apply, plan JSON, and jq
- Open a terminal, install jq, and make a folder for the evidence
- The artifact: one plan for a small notes app
- First look: what is in the file, before you count anything
- Count what the plan will do, and see why the naive counts are wrong
- Ask six security questions of every change, and print the evidence
- Measure it: what the skim told you versus what the plan proves
- Close the gap you just found, and re-measure
- The honest list: what this plan cannot prove
- The second plan: re-review after the author's fix
- Optional: produce a real plan JSON on your own machine
- Judgment: block or approve with a note, why the plan beats the source, and how a pro does it