2  Reviewing Terraform

This part of the guide covers everything you need to review Terraform infrastructure as code (IaC) effectively. It is written for people who are comfortable reading code but may not yet have experience with infrastructure review specifically.

2.1 Why infrastructure review is different

When you review Python code, you are mostly reasoning about logic: what the code does when it runs, whether it handles edge cases, whether it is readable and maintainable. If the code is wrong, you can usually fix it quickly and redeploy.

Reviewing Terraform is different in two important ways.

Infrastructure changes have side effects that persist. Terraform manages real resources — virtual machines, storage buckets, network rules, IAM bindings. A change that looks minor in code can delete a database, open a firewall port, or grant someone access they should not have. Those effects do not disappear when you close the pull request.

Terraform tracks state. Terraform keeps a record (the state file) of what it believes exists in your cloud environment. If the code and the state diverge, or if someone makes changes outside Terraform, the next apply may produce unexpected results. A reviewer needs to think not just about what the code says, but about what Terraform will actually do when it runs against the current state.

These differences do not make infrastructure review harder than application code review — but they do mean you need to think about different things.

2.2 What this part covers

The chapters in this part walk you through:

• Review principles — The core principles that should guide every IaC review, regardless of what the code does.
• Skills, expectations, and escalation — What reviewers are expected to know, how to calibrate your confidence, and when to escalate.
• What to review — A detailed guide to what to look for in Terraform code, with a comparison to Python code review.
• Review tools — The automated tools available to support your review: terraform fmt, terraform validate, checkov, and tflint.
• Documentation expectations — What documentation to expect and how to assess it.
• Environment-specific review — How review expectations change depending on which environment the code targets.
• Pull request review checklist — A structured checklist you can work through when reviewing any Terraform pull request.
• Writing review comments — How to write clear, useful review comments, with worked examples.
• Reading a Terraform plan — How to read and interpret a terraform plan output.