Review infrastructure changes before deployment
How to inspect Ansible plans, Terraform/OpenTofu state and diffs, secrets, blast radius and drift before approving an infrastructure change.
Kareem Schultz
Technology enthusiast & systems builder · Guyana
Jump to a section
Infrastructure code is an operational change
A small configuration diff can restart a service, revoke network access or replace a resource. Review the intended behavior as carefully as the code. Name the target environment, affected resources, dependencies and recovery procedure. Keep reviewer evidence tied to the exact source revision.
Ansible: know the limits of check mode
Ansible check mode can help preview supported task behavior, while diff mode can show selected file changes. Neither is universally accurate: modules may not support simulation and some tasks may have unexpected side effects. Always inspect module documentation and run against a test inventory first.
OpenTofu and Terraform: inspect the actual plan
Plan output describes proposed changes, not guaranteed future outcomes. State must be protected and ideally locked for writes; backend locking varies. Never disable locking casually or force-unlock another process. Review additions, deletions, replacements and destructive dependencies.
A review matrix
Separate policy questions from syntax questions: a valid configuration can still be an unauthorized or unsafe change. Require stronger reviews for auth, firewall, routing, data, production and irreversible steps.
| Change | Review focus | Evidence |
|---|---|---|
| Firewall or VPN | Lockout and path changes | Console access and tested alternate path |
| State backend | Locking, credentials, encrypted backup | Backend policy and access check |
| OS configuration | Idempotency, handler/restarts | Check-mode plus staging validation |
| Credentials | Rotation, blast radius, no log leaks | Named approver and audit event |
After approval: verification and cleanup
Capture plan/commit identifiers, deployed environment and observed status. A green application of a plan is not proof the service works for its users. Test affected routes and roll-forward/rollback criteria. Keep drift monitoring distinct from an automatic write-back that could overwrite an intentional manual emergency fix.
FAQ: are Terraform and OpenTofu identical?
They share a common history and workflow but releases and providers are not guaranteed interchangeable. Read version-specific compatibility notes. A good plugin should choose the correct tool for the repo and never apply Terraform or OpenTofu plans merely because the plan command succeeded.
Frequently asked questions
Sources & further reading
These links provide the technical basis for the article. Check upstream advisories and documentation for revisions.