tfviz
GitHub Get started
Open source · Now in alpha

See your Terraform plan before you apply it

tfviz turns Terraform and OpenTofu plans and state into a calm, interactive architecture diagram. You get one offline HTML file, with secrets left out by design.

Get started Open the live demo

A tfviz plan review. The resource list shows changes grouped as replaced, destroyed, added and modified. The diagram shows an AWS account, region, VPC and subnets with a Kafka cluster selected and its relationships traced. The side panel shows the broker type changing.

Works with your tools

  • Terraform
  • OpenTofu
  • AWS
  • GitHub Actions
  • GitLab CI
  • Jenkins
  • Buildkite
Why tfviz

Review infrastructure, not attribute diffs

A plan is hundreds of lines of changed attributes. tfviz shows what's actually changing, where it lives and what it touches.

Changes where they live

Every resource sits in its account, region, VPC and subnet, marked as added, modified, replaced or destroyed. Follow a change to everything it touches.

Private by construction

Only approved fields reach the report. Passwords, user data, tags and policies never do. A changed secret shows as “Sensitive value changed”, never the value.

One file, anywhere

The report is a single HTML file that opens from disk. There's no server, no account and no telemetry. Attach it to a pull request or keep it as a CI artefact.

Quick start

Your first report in three commands

OpenTofu works the same way: replace terraform with tofu.

  1. 1

    Plan as usual

    Nothing changes in how you work.

    terraform plan -out=tfplan
  2. 2

    Pipe the plan to tfviz

    The exported JSON never touches your disk.

    terraform show -json tfplan \
  | tfviz plan --input - \
      --output review.html
  3. 3

    Open the report

    Any modern browser, fully offline.

    open review.html
Privacy first

Secrets stay out of the picture

tfviz reads your plan, keeps only the fields each resource type is approved to show, and turns sensitive values into markers with no payload. Tests search every report for planted secrets on every change.

  • Passwords, user data, environment variables and policies are withheld
  • No telemetry, no accounts and no network requests from reports
  • --safe-share replaces names, IDs, ARNs and addresses for wider audiences
How tfviz handles your data
A database selected in a dark-themed tfviz report. Its instance class change is shown. Its master password is listed only as Sensitive value changed, and its tags as Not included in reports.
Features

Built for the review, not the dashboard

Everything a reviewer needs before approving a change, and nothing that needs a server.

Plan reviews

Architecture and module views, with Changes, Before and After.

Relationship tracing

Select a resource to see what it touches, with the evidence for each link.

State from file or S3

Read state locally or straight from S3 with your usual AWS credentials.

Private local explorer

The same interface served only to you, with Refresh after you apply.

Safe sharing

Consistent stand-ins for identifying details, so reports can leave the team.

Official AWS icons

Use the icon pack you download from AWS, embedded in each report.
Help shape the alpha

Try tfviz on a real stack

Run it on your own infrastructure and tell us what's missing or wrong. Every report stays on your machine.

Install tfviz Share feedback