360 Secure SkillHub
360 安全技能中心

terraform-azurerm-set-diff-analyzer

该 Skill 通过 Python 脚本读取 terraform show -json 生成的 plan JSON，依据附带的 AzureRM Set 类型属性清单，识别 Application Gateway、Load Balancer、NSG 等资源中因集合顺序变化产生的伪差异，并与真实变更区分；支持文本、JSON、Markdown 等输出格式及 CI 退出码。

github
热度 0.00
最近更新 2026-10-18 22:12:35
分类：开发依赖：代码执行 / 读写文件应用场景：DevOps / 代码审查 / 数据处理 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add github/awesome-copilot/terraform-azurerm-set-diff-analyzer
Metadata
name
terraform-azurerm-set-diff-analyzer
description
Analyze Terraform plan JSON output for AzureRM Provider to distinguish between false-positive diffs (order-only changes in Set-type attributes) and actual resource changes. Use when reviewing terraform plan output for Azure resources like Application Gateway, Load Balancer, Firewall, Front Door, NSG, and other resources with Set-type attributes that cause spurious diffs due to internal ordering changes.
license
MIT

Terraform AzureRM Set Diff Analyzer

A skill to identify "false-positive diffs" in Terraform plans caused by AzureRM Provider's Set-type attributes and distinguish them from actual changes.

When to Use

  • terraform plan shows many changes, but you only added/removed a single element
  • Application Gateway, Load Balancer, NSG, etc. show "all elements changed"
  • You want to automatically filter false-positive diffs in CI/CD

Background

Terraform's Set type compares by position rather than by key, so when adding or removing elements, all elements appear as "changed". This is a general Terraform issue, but it's particularly noticeable with AzureRM resources that heavily use Set-type attributes like Application Gateway, Load Balancer, and NSG.

These "false-positive diffs" don't actually affect the resources, but they make reviewing terraform plan output difficult.

Prerequisites

  • Python 3.8+

If Python is unavailable, install via your package manager (e.g., apt install python3, brew install python3) or from python.org.

Basic Usage

# 1. Generate plan JSON output
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json

# 2. Analyze
python scripts/analyze_plan.py plan.json

Troubleshooting

  • python: command not found: Use python3 instead, or install Python
  • ModuleNotFoundError: Script uses only standard library; ensure Python 3.8+

Detailed Documentation