StackGuardian / StackGuardian/tirith
feat(terraform_plan): read `change.before` — `attribute_source: before|after|delta` and a `Transitioned` condition
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 165
- Forks
- 42
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 11
Description
The attribute operation reads only change.after, so no policy can see what a value was, and
for a pure delete after is null — no attribute of a destroyed resource is readable at all. Add
attribute_source: before | after | delta (delta yields {"before": …, "after": …}) and a
Transitioned {from, to} condition. Unlocks the transition incidents: deletion_protection
true→false, encryption disabled on a live volume, a CIDR widened to 0.0.0.0/0, backup retention
cut, and "this plan deletes your production database with skip_final_snapshot = true" —
inexpressible today.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the existing Terraform plan attribute operation and how change.before and change.after are represented. Define the attribute_source modes and Transitioned {from, to} semantics, then verify that policies can detect the listed transitions and pure deletions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, terraform
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100