Overview of a plan: counts of create/update/delete/replace/read/forget/no-op by resource type and module, whether it is an empty or destroy plan, moved/imported resources, drift, output changes, failing checks, terraform version and warnings (errored, incomplete, deferred changes). Call this first.

path: plan JSON from terraform show -json tfplan (relative to the server's --dir). Files over the size limit (256 MB default, --max-mb) are refused with a clear error.

Ranked list of risky changes with reasons. Flags: destroy/replace of stateful resources (databases, buckets, disks, KMS keys, DNS zones, secrets; aws/azurerm/google/kubernetes plus generic name heuristics), which attribute forces a replacement, IAM wildcards and admin policies, security groups / firewalls opening 0.0.0.0/0 or ::/0 (admin and database ports rated highest), public access enabled, encryption disabled or key changed, deletion protection off, backup retention reduced. Tags-only updates are listed as low.

min_severity: info | low | medium | high | critical. Only the findings are listed; resources not mentioned had nothing notable. Values of attributes are never printed here.

Attribute-level diff (before -> after) for one resource, with nested paths such as ingress[0].cidr_blocks[0]. Unknown values show as (known after apply). Sensitive values are ALWAYS shown as (sensitive): by Terraform's sensitivity masks and, as a second layer, by attribute names that look like credentials (password, secret, token, key...).

address: exact address as in the plan, e.g. aws_instance.web["a b"] or module.net.aws_vpc.main[0]. Use list_changes to find addresses; unknown addresses return close matches.

List resource changes, filtered and capped.

action: create | update | delete | replace | read | forget | no-op | import | move | other (default: everything except plain no-ops). type: glob such as aws_s3_*. module: 'root' or a module address prefix such as module.network (includes nested modules). address: glob where only * and ? are wild (brackets in addresses are literal).

Explain why a resource is being replaced: the action_reason, the forcing attribute(s) from replace_paths with their before -> after values, the order (destroy-then-create vs create_before_destroy), what that means (downtime, name collisions), the lifecycle hint from the plan's configuration when present, and the dependents that reference it.

Compare two plans of the same configuration (for example before and after a code change, or two environments): resource changes new in B, gone in B, with a different action, or the same action but different planned values (shown as masked attribute diffs).

Output changes and resource_drift: what changed OUTSIDE Terraform (console edits, other tools) since the last apply, with masked attribute diffs. Sensitive outputs are masked.