Who gains access when this Terraform plan is applied?

Описание и применение

reachdiff анализирует планы Terraform для Unity Catalog в Databricks, определяя, кто получит или потеряет доступ, выявляя конфликты и уязвимости.

Задача

A Terraform plan that changes Unity Catalog grants does not reveal who will gain or lose access after apply.

Результат

reachdiff identifies new access, sensitive data exposure, grant conflicts, and incomplete visibility, enabling teams to review and block risky changes in CI.

Рабочий процесс

• 1. Run terraform show -json to generate plan.json
• 2. Execute reachdiff plan --tfplan plan.json --profile PROFILE
• 3. Reachdiff parses grants, group memberships, and owners
• 4. It calculates effective-access diff and outputs findings
• 5. CI pipeline uses exit code to enforce policies

Доказательства

I wanted the review question answered directly: who gains or loses access to what when this plan is applied? So I built reachdiff, a small open‑source CLI.

Источник

reachdiff now treats more than one resource setting grants on one securable as grant_resource_conflict, BLOCK by default when the plan changes access.

Источник

Without READ METADATA on the catalog (or the metastore), the permissions API returns only the caller's own grants.

Источник