# Review Terraform before you merge

A merge is a bad time to discover that a security group allows the internet. Read reachability in the diff before you read the IAM.

Published 2026-10-06.

## Read the diff for reachability, then for identity

Start with who can connect. Look for cidr_blocks, an ingress block, publicly_accessible, or a bucket ACL. If the diff adds 0.0.0.0/0, name the port. The public-network-access check reads that text. It looks for 0.0.0.0/0 or ::/0 used as a source outside an explicit egress rule. A public range that appears only in a comment is not an ingress rule. The check does not connect to a cloud account.

Then read the IAM. actions = ["*"] is the pattern the wildcard-IAM check is written for. A Resource of "*" in the same statement is still worth a comment in review. The network line gets the comments. The policy line is the one that ships.

## Paste the file, not a summary of the file

An assistant will invent a resource name if you only describe the change. Paste the .tf file, or the plan snippet that shows the address. Ask it to quote the line.

The public exposure checklist and the wildcard IAM checklist are written for that paste.

## Related

- [Public exposure review](https://skaleagents.com/resources/public-exposure-review)
- [Wildcard IAM review](https://skaleagents.com/resources/wildcard-iam-review)
- [Prompt library](https://skaleagents.com/prompts)