Twelve analyzers. Blast radius, security, cost, drift, policy, and more — running on every infrastructure PR before it merges.
Runs via the same prkitchen CLI — pipe a plan in CI or locally:
terraform show -json tfplan | prkitchen analyze.
Every check runs in parallel on every infrastructure PR — no plugins, no extra config, no CI pipelines to maintain.
Creates, updates, deletes, replaces — laid bare. Overall risk level surfaced before a reviewer opens the PR.
Scores 0–100 how much is actually at stake. Maps the full blast zone: networking, compute, storage, IAM.
Blocks RDS replacements, VPC deletions, and data-loss operations. Checks backup posture before any deletion.
IAM wildcards, open ports, unencrypted buckets, hardcoded secrets — caught at PR time, not after an incident.
Mandatory tags, approved regions, encryption requirements. Every violation surfaces with its policy ID and a fix.
Monthly cost before, after, and delta per resource. Tag compliance score. No more PRs that silently double your bill.
Resources that drifted from declared state are surfaced before you apply more changes on top of them.
count→for_each migrations, module extraction, variable hygiene — with suggested code attached.
Maps the full dependency tree. High-impact nodes — resources many others depend on — are flagged for extra review.
Flags broken output references and sensitive value exposure before downstream terraform_remote_state consumers break.
Catches timestamp(), uuid(), and other patterns that cause perpetual plan noise on every apply.
Verifies all module sources pin an explicit version. Floating references are flagged before a registry update breaks your plan.