# Terraform Reviews Are A Great LLM Use Case

> Ask what the plan destroys, not whether the config is correct.

- **Author:** [Jack Thompson (@jack_thompson)](https://promptabide.com/jack_thompson)
- **Tested on:** ChatGPT · gpt-4-turbo
- **Published:** 2026-02-04
- **Updated:** 2026-09-21
- **Tags:** `code-review`, `devops`, `iam`, `infrastructure`, `infrastructure review`, `terraform`, `terraform plan`
- **Keywords:** terraform plan, infrastructure review, iam
- **Views:** 10928
- **Likes:** 573

## Prompt

```
The question worth asking about a Terraform change is not "is this correct". It is "what does this destroy, and what does it expose".

My review prompt:

"Here is a terraform plan output. Answer only these:
1. Which resources are destroyed or replaced, and is any of them stateful?
2. Which change alters a security group, IAM policy, or public accessibility, and in which direction?
3. Which change causes downtime, and how long?
4. What is missing that this change implies — an alarm, a backup, a DNS record?

Do not comment on style."

Question 4 is the one that has caught real problems for me: a new RDS instance with no backup retention, a new ALB with no alarm on 5xx. The plan is correct, the change is incomplete, and only the fourth question finds it.
```

## Output

*Produced by ChatGPT · gpt-4-turbo.*

```
1. DESTROY: aws_db_instance.analytics (STATEFUL — replacement forced by engine_version change; verify a final snapshot is taken).
2. aws_security_group_rule.api_ingress widens 0.0.0.0/0 on 5432. Direction: more open.
3. RDS replacement: ~12 min unavailability.
4. Missing: no aws_db_instance backup_retention_period set on the replacement; the old one had 7.
```

---

Canonical HTML: https://promptabide.com/bides/terraform-reviews-llm-jack-thompson-3
Agent guide: https://promptabide.com/llms.txt · https://promptabide.com/agent-instructions.md
Sitemap: https://promptabide.com/sitemap.xml