{"uid":"cap_PjbceP_Vax5YUAb4JG_xX","slug":"lineagelint-terraform-plan-risk-analyzer-87080699","name":"LineageLint Terraform Plan Risk Analyzer","description":"An autonomous paid API accepting USDC on Base mainnet.","url":"https://47-85-47-24.sslip.io/v1/terraform-plan-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"scenario":{"enum":["risky-production-replacement"],"type":"string","description":"Built-in paid Terraform plan-review scenario"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["analysis_id","analyzer_version","label","profile","verdict","risk_score","summary","stats","resource_changes","findings","approval_gates","coverage"],"properties":{"label":{"type":"string"},"stats":{"type":"object"},"profile":{"enum":["production","development"],"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["BLOCK","WARN","PASS"],"type":"string"},"coverage":{"type":"object"},"findings":{"type":"array","items":{"type":"object"}},"risk_score":{"type":"integer","maximum":100,"minimum":0},"analysis_id":{"type":"string"},"approval_gates":{"type":"array","items":{"type":"string"}},"analyzer_version":{"type":"string"},"resource_changes":{"type":"array","items":{"type":"object"}}}}}}}},"responseSchema":{"type":"json","example":{"label":"paid-demo:risky-production-replacement","stats":{"low":0,"high":6,"read":0,"no-op":0,"create":2,"delete":0,"medium":1,"update":0,"replace":1,"critical":1,"findings":8,"failed_checks":1,"format_version":"1.2","resource_drift":1,"resource_changes":3,"terraform_version":"1.9.8","destructive_changes":1,"destroy_exemptions_used":0,"sensitive_paths_respected":1},"profile":"production","summary":"BLOCK: 8 finding(s) across 3 resource change(s); 1 critical, 6 high, 1 medium.","verdict":"BLOCK","coverage":{"input":"terraform show -json plan output","rules":["resource deletion, replacement, taint, and blast radius","world-open networks and public resource exposure","wildcard IAM and administrator access","explicitly disabled encryption and deletion safeguards","privileged workload and host namespace settings","unmasked secret-like values and outputs","resource drift and failed Terraform checks"],"limitations":"Static plan inspection cannot prove runtime reachability, provider defaults, organizational policy, or successful rollback. Plan JSON can contain plaintext sensitive values; submit only to a trusted processor and retain the report, not the raw plan.","terraform_executed":false,"cloud_apis_contacted":false,"supported_format_major":1,"planned_values_returned":false,"sensitive_masks_respected":true},"findings":[{"code":"broad_iam_permissions","address":"aws_iam_policy.admin","summary":"A planned IAM policy grants wildcard or administrator-level access.","category":"identity-and-access","evidence":"broad statements: policy[0].Statement[0].","severity":"critical","remediation":"Replace wildcard permissions with reviewed actions and resource scopes; add policy tests.","risk_weight":32,"resource_type":"aws_iam_policy"},{"code":"terraform_checks_failed","address":"$plan.checks","summary":"One or more Terraform checks report fail or error.","category":"policy-and-checks","evidence":"Affected check addresses/paths: aws_db_instance.production.","severity":"high","remediation":"Resolve failed preconditions, postconditions, or checks before apply.","risk_weight":15,"resource_type":"multiple"},{"code":"encryption_explicitly_disabled","address":"aws_db_instance.production","summary":"Encryption is explicitly disabled in the planned values.","category":"data-protection","evidence":"Disabled encryption paths: $.resource_changes/0/change/after/storage_encrypted.","severity":"high","remediation":"Enable provider-supported encryption and verify key ownership and rotation policy.","risk_weight":18,"resource_type":"aws_db_instance"},{"code":"public_access_enabled","address":"aws_db_instance.production","summary":"The planned resource enables public access.","category":"network-exposure","evidence":"Boolean public-access paths: $.resource_changes/0/change/after/publicly_accessible.","severity":"high","remediation":"Require a documented exposure need and restrict access at network and identity layers.","risk_weight":18,"resource_type":"aws_db_instance"},{"code":"stateful_deletion_safeguard_disabled","address":"aws_db_instance.production","summary":"A stateful resource weakens deletion or recovery safeguards.","category":"resilience","evidence":"Risk-setting paths: $.resource_changes/0/change/after/deletion_protection, $.resource_changes/0/change/after/skip_final_snapshot.","severity":"high","remediation":"Enable deletion protection, final snapshots, backups, and non-destructive teardown defaults.","risk_weight":17,"resource_type":"aws_db_instance"},{"code":"stateful_resource_replace","address":"aws_db_instance.production","summary":"A managed resource will be destroyed and recreated.","category":"destructive-change","evidence":"Replacement paths: storage_type.","severity":"high","remediation":"Review downtime and data-migration impact; require approval before apply.","risk_weight":28,"resource_type":"aws_db_instance"},{"code":"world_open_network_rule","address":"aws_security_group.public_web","summary":"A planned network rule accepts traffic from the entire IPv4 or IPv6 internet.","category":"network-exposure","evidence":"Broad CIDR found at: $.resource_changes/1/change/after/ingress/0/cidr_blocks.","severity":"high","remediation":"Restrict ingress to required source ranges and ports, then validate the effective policy.","risk_weight":20,"resource_type":"aws_security_group"},{"code":"resource_drift_detected","address":"$plan.resource_drift","summary":"Terraform detected resource drift outside the intended configuration change.","category":"change-integrity","evidence":"1 drift record(s); drift values are intentionally omitted.","severity":"medium","remediation":"Reconcile who or what changed the resources before approving the plan.","risk_weight":6,"resource_type":"multiple"}],"risk_score":100,"analysis_id":"planguard-d22acdb8356a3eae","approval_gates":["Replace wildcard permissions with reviewed actions and resource scopes; add policy tests.","Resolve failed preconditions, postconditions, or checks before apply.","Enable provider-supported encryption and verify key ownership and rotation policy.","Require a documented exposure need and restrict access at network and identity layers.","Enable deletion protection, final snapshots, backups, and non-destructive teardown defaults.","Review downtime and data-migration impact; require approval before apply.","Restrict ingress to required source ranges and ports, then validate the effective policy.","Reconcile who or what changed the resources before approving the plan."],"analyzer_version":"planguard-terraform-plan-json/1.0","resource_changes":[{"mode":"managed","action":"replace","address":"aws_db_instance.production","action_reason":null,"replace_paths":["storage_type"],"resource_type":"aws_db_instance","destroy_exempt":false},{"mode":"managed","action":"create","address":"aws_security_group.public_web","action_reason":null,"replace_paths":[],"resource_type":"aws_security_group","destroy_exempt":false},{"mode":"managed","action":"create","address":"aws_iam_policy.admin","action_reason":null,"replace_paths":[],"resource_type":"aws_iam_policy","destroy_exempt":false}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_TvGqHBRX7vi75l953__B9","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes a Terraform plan for security risks, destructive changes, and policy violations, returning a risk score and BLOCK/WARN/PASS verdict","exampleAgentPrompt":"Run the risky-production-replacement scenario through LineageLint's Terraform plan risk analyzer and tell me if it would be blocked, what the risk score is, and what critical or high findings it flagged.","exampleUseCases":[{"title":"Pre-merge CI/CD security gate","prompt":"Check our pull request's Terraform plan against LineageLint before we merge to main — I need to know if there are any blocking issues or destructive changes that could take down production."},{"title":"Compliance audit of infrastructure changes","prompt":"Run our staging environment Terraform plan through LineageLint and give me a breakdown of any policy violations, especially around IAM permissions and encryption settings that might fail our security audit."},{"title":"Risk assessment before deploying to production","prompt":"Before we apply this infrastructure update to our production AWS account, analyze the Terraform plan with LineageLint and tell me if it's safe to proceed or if there are any critical resource deletions or permission issues we need to fix first."}],"resultDescription":"Returns a JSON object with a verdict (BLOCK, WARN, or PASS), integer risk score (0-100), a human-readable summary, list of findings with severity and remediation advice, resource change stats (creates, deletes, replacements), approval gates required, and coverage metadata about what rules were applied and what limitations exist.","failureModes":["Missing required 'input' object in query params returns 400 validation error","Invalid method enum value (e.g. POST) returns schema validation error","Invalid or unsupported scenario enum value returns 400","Payment not received (x402 flow) returns 402 Payment Required before analysis runs","Service unavailable returns 503 with no analysis result"],"whenToPreferThis":"Use this endpoint when you need a fast, automated static analysis of a Terraform plan for production safety gates — especially when you want a structured risk score, per-finding severity breakdown, and explicit BLOCK/WARN/PASS verdict without needing to execute the plan or call cloud APIs. Prefer this over manual review or general-purpose code review tools when you need consistent, rule-based checks covering IAM wildcards, destructive replacements, public exposure, and encryption disablement.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:49:34.656Z","isFirstParty":false}