Who gains access when this Terraform plan is applied?

说明与用途

reachdiff 分析 Databricks Unity Catalog 的 Terraform 计划，确定谁获得或失去访问权限，检测冲突并标记敏感数据。

问题

A Terraform plan that changes Unity Catalog grants does not reveal who will gain or lose access after apply.

结果

reachdiff identifies new access, sensitive data exposure, grant conflicts, and incomplete visibility, enabling teams to review and block risky changes in CI.

工作流

• 1. Run terraform show -json to generate plan.json
• 2. Execute reachdiff plan --tfplan plan.json --profile PROFILE
• 3. Reachdiff parses grants, group memberships, and owners
• 4. It calculates effective-access diff and outputs findings
• 5. CI pipeline uses exit code to enforce policies

证据

I wanted the review question answered directly: who gains or loses access to what when this plan is applied? So I built reachdiff, a small open‑source CLI.

来源

reachdiff now treats more than one resource setting grants on one securable as grant_resource_conflict, BLOCK by default when the plan changes access.

来源

Without READ METADATA on the catalog (or the metastore), the permissions API returns only the caller's own grants.

来源