tfviz
GitHub Get started
Features

Everything you need to review a change

AWS-first, built for Terraform and OpenTofu, and entirely local. Here's what tfviz does today.

Plan reviews

Changes in context

A plan becomes an architecture diagram: account, region, VPC, subnets and regional services. Every resource is marked as added, modified, replaced, destroyed or read during apply, with a symbol and a word as well as a colour.

Replacements are counted once, and the inspector shows the order Terraform will use, so a destroy-first replacement stands out.

An architecture diagram of an AWS VPC with public and private subnets and change badges on resources.
Relationships

Trace what a change touches

Select a resource to highlight its recorded relationships: subnets, security groups, secrets, keys and log destinations. The inspector lists each change field by field, with the evidence behind every relationship.

Lines show recorded associations, not live traffic. Anything tfviz can't resolve is listed as unresolved rather than guessed.

A Kafka cluster selected, with lines traced to its subnets, security group, secret and log group, and an inspector listing its changes.
State

State from a file or straight from S3

Read exported state JSON, a version-4 .tfstate file, or the exact object in S3 using your usual AWS profile or SSO session. tfviz makes one read-only GetObject request and never takes a state lock.

A recorded state report listing every resource, with a Kafka cluster selected and its details shown.
Explorer

Modules, and a private explorer

Switch to the module view to see resources grouped the way your code is organised. Large groups start collapsed with a count of what's changing, and search opens the path to what you're looking for.

tfviz explore serves the same interface on your machine only, behind a one-time link. Press Refresh after you apply.

The module view, with root module resources in a grid and a streaming module grouped separately.
Safe-share

Share without exposing details

--safe-share replaces names, Terraform addresses, IDs, ARNs, account numbers, DNS names, IP addresses and CIDR ranges with consistent stand-ins. Service types, topology and change categories stay.

The mapping is never written to the report. The architecture itself may still be sensitive, so the report says so.

A safe-share report where resources are named MSK cluster 1, Secret 1 and Subnet 4 instead of their real names.
Icons

Official AWS icons, from your own download

Download the AWS Architecture Icons pack and pass its folder with --icons. tfviz maps 38 resource types to the official icons and embeds the ones each report needs.

AWS allows its icons in architecture diagrams but not bundled in software, so tfviz never ships them.

A dark-themed diagram of a platform stack with ECS, EKS, Lambda, Aurora, Kafka, ElastiCache, SQS and SNS shown with official AWS icons.
Scale

Large stacks stay readable

Reports with hundreds of resources open with big groups collapsed, and dense relationships are drawn only for the resource you select. A 500-resource plan builds in about 15 ms and opens in under a second.

A 500-resource plan in dark mode, with a grid of resource cards and a note that dense relationships appear when a resource is selected.
Coverage

What tfviz understands

Producers

Tested with Terraform 1.16 and OpenTofu 1.13: plan and state from show -json, and version-4 .tfstate files. Other versions with the same JSON format usually work but aren't promised.

AWS

42 resource types across networking, compute, containers, databases, streaming, messaging, secrets and observability. See the full list.

Everything else

Unsupported types still appear as limited cards, so nothing is silently dropped. --strict turns any gap into a failure.