terraform plan blast radius derived

{
  "input": {
    "body": {
      "plan": "{\n \"format_version\": \"1.2\",\n \"terraform_version\": \"1.9.5\",\n \"resource_changes\": [\n  {\n   \"address\": \"aws_db_instance.primary\",\n   \"type\": \"aws_db_instance\",\n   \"change\": {\n    \"actions\": [\n     \"delete\",\n     \"create\"\n    ],\n    \"replace_paths\": [\n     [\n      \"engine_version\"\n     ]\n    ],\n    \"before\": {\n     \"engine_version\": \"14.7\",\n     \"tags\": {\n      \"owner\": \"platform\"\n     }\n    },\n    \"after\": {\n     \"engine_version\": \"15.4\",\n     \"tags\": {\n      \"owner\": \"platform\"\n     }\n    }\n   }\n  },\n  {\n   \"address\": \"aws_s3_bucket.exports\",\n   \"type\": \"aws_s3_bucket\",\n   \"change\": {\n    \"actions\": [\n     \"delete\"\n    ],\n    \"before\": {\n     \"bucket\": \"exports\",\n     \"tags\": {\n      \"owner\": \"data\"\n     }\n    },\n    \"after\": null\n   }\n  },\n  {\n   \"address\": \"aws_lambda_function.worker\",\n   \"type\": \"aws_lambda_function\",\n   \"change\": {\n    \"actions\": [\n     \"update\"\n    ],\n    \"before\": {\n     \"timeout\": 30\n    },\n    \"after\": {\n     \"timeout\": 60,\n     \"runtime\": \"nodejs20.x\"\n    },\n    \"after_unknown\": {\n     \"version\": true\n    }\n   }\n  },\n  {\n   \"address\": \"aws_instance.bastion\",\n   \"type\": \"aws_instance\",\n   \"change\": {\n    \"actions\": [\n     \"create\"\n    ],\n    \"before\": null,\n    \"after\": {\n     \"instance_type\": \"m5.24xlarge\"\n    }\n   }\n  },\n  {\n   \"address\": \"aws_cloudwatch_log_group.app\",\n   \"type\": \"aws_cloudwatch_log_group\",\n   \"change\": {\n    \"actions\": [\n     \"no-op\"\n    ],\n    \"before\": {},\n    \"after\": {}\n   }\n  }\n ],\n \"resource_drift\": [\n  {\n   \"address\": \"aws_security_group.web\",\n   \"type\": \"aws_security_group\",\n   \"change\": {\n    \"actions\": [\n     \"update\"\n    ],\n    \"before\": {\n     \"description\": \"web\",\n     \"ingress_count\": 2\n    },\n    \"after\": {\n     \"description\": \"web (edited in console)\",\n     \"ingress_count\": 5\n    }\n   }\n  }\n ]\n}"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxEnvBytes": 131072,
        "maxFindings": 500,
        "maxPlanBytes": 4194304,
        "maxResources": 5000,
        "maxStatements": 500,
        "maxPolicyBytes": 262144
      },
      "passed": false,
      "complete": false,
      "findings": [
        {
          "code": "STATEFUL_RESOURCE_REPLACED",
          "type": "aws_db_instance",
          "action": "replace",
          "detail": "aws_db_instance.primary will be destroyed and recreated. The plan says the replacement is forced by engine_version. aws_db_instance holds data, so a replacement is a data loss rather than a restart",
          "address": "aws_db_instance.primary"
        },
        {
          "code": "STATEFUL_RESOURCE_DESTROYED",
          "type": "aws_s3_bucket",
          "action": "destroy",
          "detail": "aws_s3_bucket.exports will be destroyed. aws_s3_bucket holds data that this plan does not recreate, so the destruction is not reversible by re-applying.",
          "address": "aws_s3_bucket.exports"
        }
      ],
      "resources": [
        {
          "type": "aws_db_instance",
          "action": "replace",
          "address": "aws_db_instance.primary",
          "stateful": true,
          "forced_by": [
            "engine_version"
          ]
        },
        {
          "type": "aws_s3_bucket",
          "action": "destroy",
          "address": "aws_s3_bucket.exports",
          "stateful": true,
          "forced_by": []
        },
        {
          "type": "aws_lambda_function",
          "action": "update",
          "address": "aws_lambda_function.worker",
          "stateful": false,
          "forced_by": []
        }
      ],
      "request_id": "example-request",
      "reversible": false,
      "service_id": "terraform_plan_blast_radius",
      "assumptions": [
        "The input is a plan already rendered to JSON by terraform show -json. Nothing is fetched, no state is read and no credential is accepted, so the document supplied is the whole input.",
        "A replacement is reported with the attribute the plan says forced it, because that attribute is what a caller changes to avoid the replacement, and the plan records it separately from the action.",
        "The resource type patterns treated as holding data are published in the response rather than left as an unstated judgement, and the caller can add to them."
      ],
      "limitations": [
        "The plan document supplied. Whether the change is intended, and whether a destroyed resource is backed up elsewhere, are outside this.",
        "reversible is true only when every change was examined and none of them destroys or replaces anything. It is not a judgement that the plan is correct."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "VALUES_KNOWN_ONLY_AFTER_APPLY: aws_lambda_function.worker has attributes whose values are not known until apply, so what this update produces is not fully determined by the plan."
      ],
      "finding_count": 2,
      "examined_count": 5,
      "format_version": "1.2",
      "service_version": "1.0.0",
      "counts_by_action": {
        "read": 0,
        "no-op": 1,
        "create": 1,
        "update": 1,
        "destroy": 1,
        "replace": 1,
        "unknown": 0
      },
      "findings_by_code": {
        "STATEFUL_RESOURCE_REPLACED": 1,
        "STATEFUL_RESOURCE_DESTROYED": 1
      },
      "destructive_count": 2,
      "terraform_version": "1.9.5",
      "resource_change_count": 5,
      "stateful_type_patterns": [
        "db_instance",
        "db_cluster",
        "rds_cluster"
      ],
      "stateful_destructive_count": 2
    }
  }
}