PlanReach

Terraform network change control

Know exactly what network access a Terraform plan changes.

PlanReach turns AWS security-group changes into canonical added, removed, and unchanged flows. It rejects facts it cannot prove instead of guessing from incomplete JSON.

Start a 14-day trial See the output 
$ terraform show -json tfplan | planreach --license planreach.lic --format github -

## PlanReach

**2 added** · **1 removed** · 18 unchanged

| Change | Direction | Security group | Peer | Protocol | Service |
| + added | ingress | api | 0.0.0.0/0 | tcp (6) | 443-443 |
| - removed | ingress | db | app | tcp (6) | 5432-5432 |

A dependable CI gate

It compares access, not blocks of JSON.

01

Read the plan

Strictly validates Terraform’s envelope and the AWS security-group facts needed for a conclusion.

02

Normalize access

Reduces CIDRs, protocols, ports, directions, and security-group aliases to exact canonical flows.

03

Gate the change

Emits stable output and a policy exit code for added, removed, any changed, or report-only modes.

No quiet approximations

A missing fact is not permission to invent one.

If a relevant value is unknown, malformed, unsupported, or too large to prove within declared limits, PlanReach returns a specific cannot_prove result. Your pipeline gets an actionable failure, not a plausible-looking partial diff.

Simple seat pricing

Every tier gets the same exact analysis engine.

Plans differ by team size and support—not by correctness, limits, or hidden “advanced” proofs.

Team includes 14 days free, then $99/month. A payment method is required. Cancel before the trial ends to avoid being charged.

14-day trial included

Team

$99/month

$990/year — two months free

  • 5 seats
  • CLI for CI and local review
  • Human, JSON, and GitHub reports
  • Email support
Start free trial Choose annual billing

Already purchased?

Download a signed offline lease.

Enter the license key Dodo Payments emailed you. The resulting planreach.lic works offline for 14 days; renew it from this page at any time while your subscription is active.

Install

One binary. No agent. No plan upload.

terraform show -json tfplan |
  planreach --license ./planreach.lic --fail-on added -