Review Every Infrastructure Change Before It Ships: Pre-Deploy Diff Workflows with DeployDiff

The Infrastructure Review Problem

Every infrastructure team has the same workflow:

1. Someone runs terraform plan
2. The output is 200+ lines of undifferentiated text
3. The reviewer scans for words like "destroy" or "replace"
4. They miss one
5. It ships

The problem isn't that terraform plan doesn't show you the changes — it does. The problem is that the output is not structured for human review. Creates, updates, and deletes are interleaved. Destructive changes aren't grouped. Before/after values require careful reading. And there's no way to fail the pipeline if the plan contains dangerous changes.

DeployDiff's preview command fixes this:

deploydiff preview --tf plan.json

It parses your Terraform, CloudFormation, or Pulumi plan, groups changes by action type, renders them with color-coded symbols, and optionally exits with code 1 if destructive changes are detected — making it a CI gate, not just a pretty printer.

Quick Start: Preview Your First Plan

Step 1: Install DeployDiff

# pip
pip install deploydiff

# Homebrew (macOS / Linux)
brew tap Coding-Dev-Tools/tap
brew install deploydiff

# Scoop (Windows)
scoop bucket add Coding-Dev-Tools https://github.com/Coding-Dev-Tools/scoop-bucket
scoop install deploydiff

Step 2: Generate a Terraform Plan JSON

# Generate the plan
terraform plan -out=tfplan

# Export as JSON for DeployDiff
terraform show -json tfplan > plan.json

Step 3: Preview with DeployDiff

deploydiff preview --tf plan.json

Output:

Step 4: Verbose Mode for Full Details

deploydiff preview --tf plan.json --verbose

Verbose mode shows the complete before/after state for every change — not just the diff, but the full resource configuration:

Eight Action Types, Color-Coded

DeployDiff categorizes every infrastructure change into one of eight action types, each with a distinct symbol and color:

CI/CD Integration: Block Destructive Changes in Pipeline

Pattern 1: Gate PRs on Destructive Changes

The most common workflow: block a pull request if the Terraform plan contains any destructive change.

# .github/workflows/infra-review.yml
name: Infrastructure Review

on:
  pull_request:
    paths: ['terraform/**']

jobs:
  preview:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install DeployDiff
        run: pip install deploydiff

      - name: Terraform Init & Plan
        working-directory: terraform
        run: |
          terraform init -input=false
          terraform plan -out=tfplan
          terraform show -json tfplan > plan.json

      - name: Preview changes
        working-directory: terraform
        run: deploydiff preview --tf plan.json --verbose

      - name: Block on destructive changes
        working-directory: terraform
        run: deploydiff preview --tf plan.json --exit-on-destroy

Pattern 2: Destructive-Change Review with Auto-Label

Instead of blocking destructive changes outright, label the PR and require manual approval:

# .github/workflows/infra-label.yml
name: Infrastructure Change Label

on:
  pull_request:
    paths: ['terraform/**']

jobs:
  label:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install DeployDiff
        run: pip install deploydiff

      - name: Terraform Plan
        working-directory: terraform
        run: |
          terraform init -input=false
          terraform plan -out=tfplan
          terraform show -json tfplan > plan.json

      - name: Check for destructive changes
        id: check
        working-directory: terraform
        run: |
          if deploydiff preview --tf plan.json --exit-on-destroy 2>/dev/null; then
            echo "destructive=false" >> "$GITHUB_OUTPUT"
          else
            echo "destructive=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Label PR
        if: steps.check.outputs.destructive == 'true'
        run: |
          gh pr edit ${{ github.event.pull_request.number }} \
            --add-label "destructive-change"

      - name: Comment preview on PR
        working-directory: terraform
        run: |
          deploydiff preview --tf plan.json --verbose | \
          gh pr comment ${{ github.event.pull_request.number }} \
            --body-file -

Pattern 3: Scheduled Drift Detection

Run a nightly check to detect configuration drift — resources that have changed outside of Terraform:

# .github/workflows/infra-drift.yml
name: Infrastructure Drift Detection

on:
  schedule:
    - cron: '0 6 * * *'  # 6 AM daily

jobs:
  drift-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install DeployDiff
        run: pip install deploydiff

      - name: Terraform Plan (refresh-only)
        working-directory: terraform
        run: |
          terraform init -input=false
          terraform plan -refresh-only -out=tfplan
          terraform show -json tfplan > plan.json

      - name: Check for drift
        working-directory: terraform
        run: |
          CHANGES=$(deploydiff preview --tf plan.json 2>&1 | tee /tmp/drift.log)
          if echo "$CHANGES" | grep -q "Will be updated\|Will be destroyed\|Will be replaced"; then
            echo "::warning::Infrastructure drift detected!"
            cat /tmp/drift.log
            # Optionally: post to Slack, create a ticket, etc.
          else
            echo "No drift detected."
          fi

Multi-Provider: Same CLI, Different Syntax

DeployDiff's preview command works with three infrastructure-as-code platforms using the same interface:

Terraform

# Generate plan
terraform plan -out=tfplan
terraform show -json tfplan > plan.json

# Preview
deploydiff preview --tf plan.json

CloudFormation

# Generate change set
aws cloudformation create-change-set \
  --stack-name my-stack \
  --change-set-name my-changeset \
  --template-body file://template.yaml

# Wait for completion, then export
aws cloudformation describe-change-set \
  --stack-name my-stack \
  --change-set-name my-changeset > changeset.json

# Preview
deploydiff preview --cfn changeset.json

Pulumi

# Generate preview
pulumi preview --json > preview.json

# Preview
deploydiff preview --pulumi preview.json

Three Real Review Scenarios

DeployDiff Preview vs. Raw Terraform Plan Output

Combining Preview with Cost and Rollback

DeployDiff has three commands that work together for complete pre-deploy safety:

# 1. Review the changes
deploydiff preview --tf plan.json --verbose

# 2. Check the cost impact (Pro)
deploydiff cost --tf plan.json --threshold 500

# 3. Generate rollback commands
deploydiff rollback --tf plan.json

Install DeployDiff

# pip
pip install deploydiff

# Homebrew (macOS / Linux)
brew tap Coding-Dev-Tools/tap
brew install deploydiff

# Scoop (Windows)
scoop bucket add Coding-Dev-Tools https://github.com/Coding-Dev-Tools/scoop-bucket
scoop install deploydiff

Related Reading

• Infrastructure Rollback Commands That Actually Work — DeployDiff rollback tutorial
• Preview Infrastructure Cost Before You Deploy — DeployDiff cost estimation
• Before You Deploy: Config Drift + Cost Combo Guide — ConfigDrift + DeployDiff
• Block Deployments on Config Drift — ConfigDrift CI gating