Run a Terraform (or OpenTofu) plan and view it as an expandable, searchable report — right inside VS Code. Nothing leaves your machine: the plan is parsed and rendered locally, in a webview, the same engine used by the terraform-vision CLI/GitHub Action/web viewer.
Commands
Terraform Vision: Run Plan and Show Report — runs terraform plan + terraform show -json in the active folder and opens the result in a report panel.
Terraform Vision: Open Plan JSON File... — opens an existing plan JSON file (e.g. one downloaded from a CI run) without running Terraform. Also available via right-click in the Explorer on any .json file.
What the report shows
Summary counts: add / change / destroy / replace.
Resources grouped by module, each a collapsible card.
Per-attribute diffs, with sensitive values masked.
A badge on the specific attribute that forced a replacement, when Terraform reports it.
A search box filtering by address, type, or action.
Matches your active VS Code color theme.
Settings
Setting
Default
Description
terraformVision.binary
terraform
Executable to run. Set to tofu for OpenTofu.
terraformVision.planArgs
[]
Extra arguments appended to the plan command, e.g. ["-var-file=dev.tfvars"].
terraformVision.workingDirectory
(empty)
Directory to run terraform in. Defaults to the active .tf file's directory, or the first workspace folder.
Requirements
Terraform (or OpenTofu) must be installed and on your PATH — this extension runs the real CLI, it doesn't reimplement it.
Privacy & security
No network access. The plan is parsed and rendered entirely inside VS Code. No plan data is ever sent anywhere, and the report webview runs under a strict CSP (default-src 'none') with no external resources — it cannot make requests even if it wanted to.
Workspace Trust required. This extension runs the real terraform binary against the open folder, so it stays disabled in Restricted Mode until you explicitly trust the workspace.
A cloned repository cannot influence what gets executed.binary, planArgs and workingDirectory are all machine-scoped: only your own user settings can change which executable runs, with which arguments, in which directory — never a .vscode/settings.json committed inside a repo you cloned. The folder you pick with the sidebar's "Change…" button is stored in the extension's private workspace storage, which is also outside a repository's reach.
No shell. Terraform is invoked with execFile and an argument array — there is no shell interpolation of paths or arguments. Arguments that would redirect where terraform writes (-out, -state-out, -generate-config-out, -chdir) are rejected outright.
Sensitive values are masked before the plan data ever reaches the webview, and the temporary plan file is deleted after each run.
