Terraform Vision

Run a Terraform (or OpenTofu) plan and view it as an expandable, searchable report — right inside VS Code. Nothing leaves your machine: the plan is parsed and rendered locally, in a webview, the same engine used by the terraform-vision CLI/GitHub Action/web viewer.

Commands

• Terraform Vision: Run Plan and Show Report — runs terraform plan + terraform show -json in the active folder and opens the result in a report panel.
• Terraform Vision: Open Plan JSON File... — opens an existing plan JSON file (e.g. one downloaded from a CI run) without running Terraform. Also available via right-click in the Explorer on any .json file.
• Terraform Vision: View Logs — opens the Output Channel with the full transcript of every terraform command this extension has run (command line + output), success or failure. Also reachable via the sidebar's "View logs" link.
• Terraform Vision: Copy Plan JSON / Save Plan JSON... — copies the loaded plan's JSON to the clipboard or saves it as a .json file, with every sensitive value redacted. Also available as icons in the report panel's title bar and as "Copy" / "Save…" links in the sidebar after a successful run. The saved file can be reopened with "Open Plan JSON File...".
• Terraform Vision: Validate — runs terraform validate. Fast, no cloud credentials needed, good for a quick sanity check while editing .tf files. Also available as the sidebar's "Validate" button.

Sidebar

The Activity Bar icon opens a sidebar with:

• Working directory — defaults to the first workspace folder; "Change…" to pick another.
• Var file — browse to a .tfvars/.tfvars.json file instead of typing -var-file=... by hand.
• AWS profile — detects profiles from ~/.aws/config and sets AWS_PROFILE for the terraform process. See Cloud credentials.
• Workspace (shown only if the project has more than the default workspace) — picks from terraform workspace list and runs terraform workspace select <name>. Local and reversible, so this runs immediately, same as the pickers above.
• Backend config (shown only if a backend/ folder next to the working directory has more than one .hcl file) — picks one and runs terraform init -reconfigure -backend-config=.... Unlike everything else in the sidebar, this one asks for explicit confirmation first — it's the one control here that genuinely reinitializes the backend, can be slow, and can make Terraform itself prompt about migrating state if the new backend doesn't match the old one.
• Command — the exact command about to run, including anything the pickers above resolved to, so there's no guessing before you click "Run Plan".
• Last action — the most recently executed workspace-select or backend-reinit command, so you can see what happened without opening a terminal.
• Validate — runs terraform validate separately from Run Plan: fast, no cloud credentials needed, good for checking your edits without waiting for (or authenticating) a full plan.
• Run terraform init — appears automatically inside an error whenever terraform's own message suggests running terraform init (missing providers/modules, uninitialized backend). Clicking it runs terraform init and automatically retries whatever failed — Run Plan, Validate, Select Workspace, or Select Backend Config — instead of leaving you to click it again yourself.

What the report shows

• Summary counts: add / change / destroy / replace.
• Resources grouped by module, each a collapsible card.
• Per-attribute diffs, with sensitive values masked.
• A badge on the specific attribute that forced a replacement, when Terraform reports it.
• A search box filtering by address, type, or action.
• Matches your active VS Code color theme.

Settings

Requirements

Terraform (or OpenTofu) must be installed and on your PATH — this extension runs the real CLI, it doesn't reimplement it.

Cloud credentials

This extension runs terraform as a child process of VS Code, so it only sees whatever environment VS Code itself inherited when it started — not a terminal you open afterwards. If your provider needs a profile or SSO session (e.g. AWS SSO) and VS Code wasn't launched from an already-authenticated terminal, terraform plan may fail to find your credentials. In order of preference:

1. Best: have your Terraform code specify the profile explicitly, e.g. provider "aws" { profile = "my-profile" } (or via a variable). This resolves the named profile from ~/.aws/config regardless of which environment invoked terraform, and works the same way for every teammate and every editor.
2. Set that profile as your default in ~/.aws/config, so no environment variable is needed at all.
3. Use the sidebar's AWS profile picker — detects profiles from ~/.aws/config and sets AWS_PROFILE for you, remembered per workspace. Same underlying mechanism as tools like aws-vault/granted: read profiles from config, inject as an env var into the spawned process.
4. Set terraformVision.env to { "AWS_PROFILE": "my-profile" } in your user settings (not workspace settings — see below) if you'd rather configure it once, globally.

Privacy & security

• No network access. The plan is parsed and rendered entirely inside VS Code. No plan data is ever sent anywhere, and the report webview runs under a strict CSP (default-src 'none') with no external resources — it cannot make requests even if it wanted to.
• Workspace Trust required. This extension runs the real terraform binary against the open folder, so it stays disabled in Restricted Mode until you explicitly trust the workspace.
• A cloned repository cannot influence what gets executed. binary, planArgs, workingDirectory, and env are all machine-scoped: only your own user settings can change which executable runs, with which arguments, in which directory, with which environment variables — never a .vscode/settings.json committed inside a repo you cloned. The folder and var-file you pick with the sidebar's buttons are stored in the extension's private workspace storage, which is also outside a repository's reach.
• No shell. Terraform is invoked with execFile and an argument array — there is no shell interpolation of paths or arguments. Arguments that would redirect where terraform writes (-out, -state-out, -generate-config-out, -chdir) are rejected outright.
• Sensitive values are masked before the plan data ever reaches the webview, and the temporary plan file is deleted after each run. The same goes for exported JSON: "Copy Plan JSON" / "Save Plan JSON..." replace every value Terraform marks sensitive (plus any other string identical to one) with "(sensitive)", even though raw terraform show -json output carries them in plain text.
• Backend reinitialization always asks first. Every other sidebar picker (working directory, var file, AWS profile, workspace) runs immediately on selection, because each is local, reversible, and doesn't touch the backend or the network. Selecting a backend config is the one exception: it's shown a confirmation dialog with the exact command before anything runs, since it genuinely reinitializes the backend and can prompt Terraform's own state-migration question.