Who gains access when this Terraform plan is applied?

Description and use

reachdiff analyzes Terraform plans for Databricks Unity Catalog to determine who gains or loses access, detect conflicts, and flag sensitive data.

Problem

A Terraform plan that changes Unity Catalog grants does not reveal who will gain or lose access after apply.

Outcome

reachdiff identifies new access, sensitive data exposure, grant conflicts, and incomplete visibility, enabling teams to review and block risky changes in CI.

Workflow

• 1. Run terraform show -json to generate plan.json
• 2. Execute reachdiff plan --tfplan plan.json --profile PROFILE
• 3. Reachdiff parses grants, group memberships, and owners
• 4. It calculates effective-access diff and outputs findings
• 5. CI pipeline uses exit code to enforce policies

Evidence

I wanted the review question answered directly: who gains or loses access to what when this plan is applied? So I built reachdiff, a small open‑source CLI.

Source

reachdiff now treats more than one resource setting grants on one securable as grant_resource_conflict, BLOCK by default when the plan changes access.

Source

Without READ METADATA on the catalog (or the metastore), the permissions API returns only the caller's own grants.

Source