Served fresh on every infrastructure PR
Infrastructure changes carry more risk than application code — a bad merge can take down production, inflate your cloud bill, or open a security hole that takes weeks to find. PRKitchen runs twelve analyzers across every Terraform plan before your PR reaches a reviewer.
🏗️ Try the Interactive Demo →Every analyzer included. Every infrastructure PR.
Every resource change laid bare — creates, updates, deletes, replaces. PRKitchen reads the full plan and surfaces the overall risk level before a single reviewer opens the PR. Risky changes are flagged by name, not buried in a wall of JSON.
How many resources does this change touch — really? Blast radius scoring maps the full blast zone: networking, compute, storage, IAM. A score out of 100 tells you how much is at stake before the apply button gets anywhere near production.
Three vectors, one pass: IAM exposure, network posture, and secrets hygiene. Every finding is labelled critical, high, medium, or low with a specific recommendation attached. Open ports, overpermissioned roles, and hardcoded secrets don't make it to the table.
Your organisation has rules. PRKitchen enforces them automatically — mandatory tags, approved regions, required encryption, naming conventions. Every violation surfaces with its policy ID and a suggested fix, not just a red flag.
Deletions and replacements that would cause data loss or downtime are intercepted before the PR opens. Production-tier resources (anything named prod, prd, live, or main) are automatically escalated to critical severity. Replace operations are explained by the exact attribute forcing the change — not just "this will be replaced." Destroy-before-create replacements are flagged separately from create_before_destroy ones. Backup posture is checked before any deletion: RDS retention period, DynamoDB point-in-time recovery, and S3 versioning are verified so you know whether a rollback is even possible.
Tag compliance score, monthly cost before, monthly cost after, delta per resource. No more infra PRs that silently double your AWS bill. Missing required tags are called out by resource address so nothing slips through untagged.
Resources that have drifted from their declared state are surfaced before you apply more changes on top of them. Stale and legacy resources that should have been removed long ago are flagged with a remediation strategy.
HCL quality analysis: count-to-for_each migrations, module extraction opportunities, variable hygiene, and dependency simplification. Each suggestion comes with the proposed code and step-by-step migration instructions — not just a comment.
Maps the full dependency tree between resources so reviewers understand blast propagation paths. Resources that many others depend on are flagged as high-impact nodes — a change to them can cascade across the entire plan.
Validates that outputs are correctly typed, not accidentally exposing sensitive values, and consistent with what downstream modules expect. Outputs that reference destroyed resources are flagged as broken before the apply runs.
Detects random_* resources and nondeterministic function calls — timestamp(), uuid(), bcrypt() — that cause perpetual plan noise unless protected by lifecycle ignore_changes. Each finding includes the remediation pattern.
Verifies that all module sources pin an explicit version constraint. Floating references (no version, or using "latest") are flagged as unpinned — a future registry change could silently alter behaviour on the next plan.
Twelve analyzers. One PR comment. Full audit trail. PRKitchen makes infrastructure review as rigorous as application review.
Start free with 1 repo. No credit card required.