Repository navigation
fix(terraform): store saved plans beside the state in S3, not as artifacts - #375
Merged
Merged
Conversation
…facts A saved plan holds the full prior state and every variable value, and Actions artifacts are downloadable by anyone with read on the repo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ycle rule can expire them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gh05tdog
approved these changes
Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
terraform-stack.ymluploadedtfplanas an Actions artifact. A saved plan is a zip of the full prior state plus every variable value,sensitiveor not (terraform show -json tfplanprints them), and anyone with read access to the repository can download artifacts.Now:
s3://<bucket>/tfplans/<state key>/<pr head sha>.tfplan, bucket and key taken from the initialised backend. Readable by exactly who can read the state already.tfplans/prefix so a single lifecycle rule per bucket can expire unapplied plans and the old versions the post-apply delete leaves behind (lifecycle filters only match a literal prefix). Roles scoped to their own state prefix needtfplans/<prefix>/*added: the two ClickPipes roles, done in terraform-core.s3backends fail withUnsupported backend.plan-retention-daysinput (no caller passes it), the slug step,actions: writefrom the documented caller permissions.Rollout:
monta-app/terraformcan writetfplans/before it bumps.terraformandterraform-core. A PR planned under the old pin finds no S3 plan after the bump: re-run its plan orrecover.tfplan-*artifacts in both repos.tfplans/to each state bucket (expire after 7 days, noncurrent after 1 day).Tested:
actionlintclean; plan-store resolution against ans3and alocalbackend file. Not yet run end to end.🤖 Generated with Claude Code