Analyzes Terraform plan JSON to ignore spurious diffs caused by AzureRM Set-type attributes.
Install
mkdir -p .claude/skills/terraform-azurerm-set-diff-analyzer && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/543" && unzip -o skill.zip -d .claude/skills/terraform-azurerm-set-diff-analyzer && rm skill.zipInstalls to .claude/skills/terraform-azurerm-set-diff-analyzer
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Analyze Terraform plan JSON output for AzureRM Provider to distinguish between false-positive diffs (order-only changes in Set-type attributes) and actual resource changes. Use when reviewing terraform plan output for Azure resources like Application Gateway, Load Balancer, Firewall, Front Door, NSG, and other resources with Set-type attributes that cause spurious diffs due to internal ordering changes.Key capabilities
- →Analyze Terraform plan JSON output for AzureRM Provider
- →Distinguish false-positive diffs from actual resource changes
- →Filter order-only changes in Set-type attributes
- →Review Terraform plan output for Azure resources
- →Identify spurious diffs due to internal ordering changes
- →Automate filtering of false-positive diffs in CI/CD
How it works
The skill processes Terraform plan JSON output to identify and filter out order-only changes in Set-type attributes, which are common in AzureRM Provider resources.
Inputs & outputs
When to use terraform-azurerm-set-diff-analyzer
- →Review Terraform plan output for Azure
- →Reduce noise in infrastructure CI/CD
- →Verify if a Terraform plan requires actual resource changes
About this skill
Terraform AzureRM Set Diff Analyzer
A skill to identify "false-positive diffs" in Terraform plans caused by AzureRM Provider's Set-type attributes and distinguish them from actual changes.
When to Use
terraform planshows many changes, but you only added/removed a single element- Application Gateway, Load Balancer, NSG, etc. show "all elements changed"
- You want to automatically filter false-positive diffs in CI/CD
Background
Terraform's Set type compares by position rather than by key, so when adding or removing elements, all elements appear as "changed". This is a general Terraform issue, but it's particularly noticeable with AzureRM resources that heavily use Set-type attributes like Application Gateway, Load Balancer, and NSG.
These "false-positive diffs" don't actually affect the resources, but they make reviewing terraform plan output difficult.
Prerequisites
- Python 3.8+
If Python is unavailable, install via your package manager (e.g., apt install python3, brew install python3) or from python.org.
Basic Usage
# 1. Generate plan JSON output
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json
# 2. Analyze
python scripts/analyze_plan.py plan.json
Troubleshooting
python: command not found: Usepython3instead, or install PythonModuleNotFoundError: Script uses only standard library; ensure Python 3.8+
Detailed Documentation
- scripts/README.md - All options, output formats, exit codes, CI/CD examples
- references/azurerm_set_attributes.md - Supported resources and attributes
When not to use it
- →When `terraform plan` shows few changes
- →When Application Gateway, Load Balancer, NSG, etc. do not show 'all elements changed'
Prerequisites
How it compares
This skill specifically targets and filters false-positive diffs in AzureRM Terraform plans, unlike a generic Terraform plan review that would show all changes.
Compared to similar skills
terraform-azurerm-set-diff-analyzer side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| terraform-azurerm-set-diff-analyzer (this skill) | 5 | 6mo | Review | Beginner |
| azure-deployment-preflight | 7 | 6mo | Review | Advanced |
| hybrid-cloud-networking | 3 | 5mo | Review | Advanced |
| iac-common | 0 | 2mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by github
View all by github →You might also like
azure-deployment-preflight
github
Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision.
hybrid-cloud-networking
wshobson
Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.
iac-common
jonathan-vella
**UTILITY SKILL** — Shared IaC deploy patterns for Bicep + Terraform agents: deployment strategies, circuit breaker, known deploy issues. WHEN: "phased deployment", "circuit breaker", "deploy strategy", "deploy issue", "shared IaC pattern". DO NOT USE FOR: preflight (azure-validate), code generation
landing-zone-deployment-design
hexmasternl
Turn the Azure landing zone specs into a Bicep-first deployment model, module graph, and GitHub Actions staging plan.
aws-solution-architect
alirezarezvani
Design AWS architectures for startups using serverless patterns and IaC templates. Use when asked to design serverless architecture, create CloudFormation templates, optimize AWS costs, set up CI/CD pipelines, or migrate to AWS. Covers Lambda, API Gateway, DynamoDB, ECS, Aurora, and cost optimization.
terraform-module-library
wshobson
Build reusable Terraform modules for AWS, Azure, and GCP infrastructure following infrastructure-as-code best practices. Use when creating infrastructure modules, standardizing cloud provisioning, or implementing reusable IaC components.