Getting Started

Install

Download a release. Each release carries two binaries:

Asset	Platform
tf-snag	Linux x64
tf-snag.exe	Windows x64

gh release download --repo wes-key/tf-snag --pattern tf-snag
chmod +x tf-snag

Or build from source (Go 1.27+):

go install github.com/wes-key/tf-snag@latest

A source build reports its module version and git revision from tf-snag -version; a release reports its tag.

First run

tf-snag reads the JSON form of a saved plan:

terraform plan -out tfplan
terraform show -json tfplan | tf-snag

tf-snag: 1 resource(s) changed outside Terraform

  ~ azurerm_storage_account.data
      allow_nested_items_to_be_public: false => true
      min_tls_version: "TLS1_2" => "TLS1_0"
      tags.temp: null => "true"

pending changes from configuration: 1 to add, 0 to change, 1 to destroy
  + azurerm_resource_group.new
  - azurerm_subnet.legacy  (module.network)

It exits 2 when it finds drift, so CI can gate on it. No Terraform checkout? Try the bundled fixture:

go run . -plan testdata/plan-drift.json

Add deprecations

Deprecation warnings are not in the plan file. They are in the log terraform plan -json writes, so capture both:

terraform plan -out tfplan -json > plan.jsonl
terraform show -json tfplan > plan.json
tf-snag -check all -plan plan.json -plan-log plan.jsonl

In a pipeline

In Azure DevOps, the extension's two tasks do the rest: install, run every check, attach the report to the run tab and keep a baseline for next time.

- script: |
    terraform -chdir=terraform plan -out tfplan -json > plan.jsonl
    terraform -chdir=terraform show -json tfplan > plan.json
  displayName: Terraform plan

- task: tf-snag-install@0

- task: tf-snag@0
  inputs:
    planLogDir: terraform   # the plan ran with -chdir=terraform

See Azure DevOps Pipelines for the full scheduled pipeline, or for running the CLI without the extension.

Next

• Track findings across runs with a baseline
• Accept known drift with ignore rules
• Raise work items or post to Teams