JSON Output Format Overview

{
  // "values" is a values representation object derived from the values in the
  // state. Because the state is always fully known, this is always complete.
  "values": <values-representation>

  "terraform_version": "version.string"
}

{
  "format_version": "1.0",

  // "prior_state" is a representation of the state that the configuration is
  // being applied to, using the state representation described above.
  "prior_state":  <state-representation>,

  // "applyable" indicates that it would make sense for a wrapping automation
  // to try to apply this plan, possibly after asking a human operator for
  // approval.
  //
  // Other attributes may give additional context about why the plan is not
  // applyable, but wrapping automations should use this flag as their
  // primary condition to accommodate potential changes to the exact definition
  // of "applyable" in future Terraform versions.
  "applyable": true,

  // "complete" indicates that Terraform expects that after applying this
  // plan the actual state will match the desired state.
  //
  // An incomplete plan is expected to require at least one additional
  // plan/apply round to achieve convergence, and so wrapping automations
  // should ideally either automatically start a new plan/apply round after
  // this plan is applied, or prompt the operator that they should do so.
  //
  // Other attributes may give additional context about why the plan is not
  // complete, but wrapping automations should use this flag as their
  // primary condition to accommodate potential changes to the exact definition
  // of "complete" in future Terraform versions.
  "complete": true,

  // "errored" indicates whether planning failed. An errored plan cannot be applied,
  // but the actions planned before failure may help to understand the error.
  "errored": false,

  // "configuration" is a representation of the configuration being applied to the
  // prior state, using the configuration representation described above.
  "configuration": <configuration-representation>,

  // "planned_values" is a description of what is known so far of the outcome in
  // the standard value representation, with any as-yet-unknown values omitted.
  "planned_values": <values-representation>,

  // "proposed_unknown" is a representation of the attributes, including any
  // potentially-unknown attributes. Each value is replaced with "true" or
  // "false" depending on whether it is known in the proposed plan.
  "proposed_unknown": <values-representation>,

  // "variables" is a representation of all the variables provided for the given
  // plan. This is structured as a map similar to the output map so we can add
  // additional fields in later.
  "variables": {
    "varname": {
      "value": "varvalue"
    },
  },

  // "resource_changes" is a description of the individual change actions that
  // Terraform plans to use to move from the prior state to a new state
  // matching the configuration.
  "resource_changes": [
    // Each element of this array describes the action to take
    // for one instance object. All resources in the
    // configuration are included in this list.
    {
      // "address" is the full absolute address of the resource instance this
      // change applies to, in the same format as addresses in a value
      // representation.
      "address": "module.child.aws_instance.foo[0]",

      // "previous_address" is the full absolute address of this resource
      // instance as it was known after the previous Terraform run.
      // Included only if the address has changed, e.g. by handling
      // a "moved" block in the configuration.
      "previous_address": "module.instances.aws_instance.foo[0]",

      // "module_address", if set, is the module portion of the above address.
      // Omitted if the instance is in the root module.
      "module_address": "module.child",

      // "mode", "type", "name", and "index" have the same meaning as in a
      // value representation.
      "mode": "managed",
      "type": "aws_instance",
      "name": "foo",
      "index": 0,

      // "deposed", if set, indicates that this action applies to a "deposed"
      // object of the given instance rather than to its "current" object.
      // Omitted for changes to the current object. "address" and "deposed"
      // together form a unique key across all change objects in a particular
      // plan. The value is an opaque key representing the specific deposed
      // object.
      "deposed": "deadbeef",

      // "change" describes the change that will be made to the indicated
      // object. The <change-representation> is detailed in a section below.
      "change": <change-representation>,

      // "action_reason" is some optional extra context about why the
      // actions given inside "change" were selected. This is the JSON
      // equivalent of annotations shown in the normal plan output like
      // "is tainted, so must be replaced" as opposed to just "must be
      // replaced".
      //
      // These reason codes are display hints only and the set of possible
      // hints may change over time. Users of this must be prepared to
      // encounter unrecognized reasons and treat them as unspecified reasons.
      //
      // The current set of possible values is:
      // - "replace_because_tainted": the object in question is marked as
      //   "tainted" in the prior state, so Terraform planned to replace it.
      // - "replace_because_cannot_update": the provider indicated that one
      //   of the requested changes isn't possible without replacing the
      //   existing object with a new object.
      // - "replace_by_request": the user explicitly called for this object
      //   to be replaced as an option when creating the plan, which therefore
      //   overrode what would have been a "no-op" or "update" action otherwise.
      // - "delete_because_no_resource_config": Terraform found no resource
      //   configuration corresponding to this instance.
      // - "delete_because_no_module": The resource instance belongs to a
      //   module instance that's no longer declared, perhaps due to changing
      //   the "count" or "for_each" argument on one of the containing modules.
      // - "delete_because_wrong_repetition": The instance key portion of the
      //   resource address isn't of a suitable type for the corresponding
      //   resource's configured repetition mode (count, for_each, or neither).
      // - "delete_because_count_index": The corresponding resource uses count,
      //   but the instance key is out of range for the currently-configured
      //   count value.
      // - "delete_because_each_key": The corresponding resource uses for_each,
      //   but the instance key doesn't match any of the keys in the
      //   currently-configured for_each value.
      // - "read_because_config_unknown": For a data resource, Terraform cannot
      //   read the data during the plan phase because of values in the
      //   configuration that won't be known until the apply phase.
      // - "read_because_dependency_pending": For a data resource, Terraform
      //   cannot read the data during the plan phase because the data
      //   resource depends on at least one managed resource that also has
      //   a pending change in the same plan.
      //
      // If there is no special reason to note, Terraform will omit this
      // property altogether.
      "action_reason": "replace_because_tainted"
    }
  ],

  // "resource_drift" is a description of the changes Terraform detected
  // when it compared the most recent state to the prior saved state.
  "resource_drift": [
    {
        // "resource_drift" uses the same object structure as
        // "resource_changes".
    }
  ],

  // "relevant_attributes" lists the sources of all values contributing to
  // changes in the plan. You can use "relevant_attributes" to filter
  // "resource_drift" and determine which external changes may have affected the
  // plan result.
  "relevant_attributes": [
    {
      "resource": "aws_instance.foo",
      "attribute": "attr",
    }
  ]

  // "output_changes" describes the planned changes to the output values of the
  // root module.
  "output_changes": {
    // Keys are the defined output value names.
    "foo": {

      // "change" describes the change that will be made to the indicated output
      // value, using the same representation as for resource changes except
      // that the only valid actions values are:
      //   ["create"]
      //   ["update"]
      //   ["delete"]
      // In the Terraform CLI 0.12.0 release, Terraform is not yet fully able to
      // track changes to output values, so the actions indicated may not be
      // fully accurate, but the "after" value will always be correct.
      "change": <change-representation>,
    }
  },

  // "checks" describes the partial results for any checkable objects, such as
  // resources with postconditions, with as much information as Terraform can
  // recognize at plan time. Some objects will have status "unknown" to
  // indicate that their status will only be determined after applying the plan.
  "checks" <checks-representation>
}

{
  // "outputs" describes the outputs from the root module. Outputs from
  // descendant modules are not available because they are not retained in all
  // of the underlying structures we will build this values representation from.
  "outputs": {
    "private_ip": {
      "value": "192.168.3.2",
      "type": "string",
      "sensitive": false
    }
  },

  // "root_module" describes the resources and child modules in the root module.
  "root_module": {
    "resources": [
      {
        // "address" is the absolute resource address, which callers must consider
        // opaque but may do full string comparisons with other address strings or
        // pass this verbatim to other Terraform commands that are documented to
        // accept absolute resource addresses. The module-local portions of this
        // address are extracted in other properties below.
        "address": "aws_instance.example[1]",

        // "mode" can be "managed", for resources, or "data", for data resources
        "mode": "managed",
        "type": "aws_instance",
        "name": "example",

        // If the count or for_each meta-arguments are set for this resource, the
        // additional key "index" is present to give the instance index key. This
        // is omitted for the single instance of a resource that isn't using count
        // or for_each.
        "index": 1,

        // "provider_name" is the name of the provider that is responsible for
        // this resource. This is only the provider name, not a provider
        // configuration address, and so no module path nor alias will be
        // indicated here. This is included to allow the property "type" to be
        // interpreted unambiguously in the unusual situation where a provider
        // offers a resource type whose name does not start with its own name,
        // such as the "googlebeta" provider offering "google_compute_instance".
        "provider_name": "aws",

        // "schema_version" indicates which version of the resource type schema
        // the "values" property conforms to.
        "schema_version": 2,

        // "values" is the JSON representation of the attribute values of the
        // resource, whose structure depends on the resource type schema. Any
        // unknown values are omitted or set to null, making them
        // indistinguishable from absent values; callers which need to distinguish
        // unknown from unset must use the plan-specific or configuration-specific
        // structures described in later sections.
        "values": {
          "id": "i-abc123",
          "instance_type": "t2.micro",
          // etc, etc
        },

        // "sensitive_values" is the JSON representation of the sensitivity of
        // the resource's attribute values. Only attributes which are sensitive
        // are included in this structure.
        "sensitive_values": {
          "id": true,
        }
      }
    ]

    "child_modules": [
      // Each entry in "child_modules" has the same structure as the root_module
      // object, with the additional "address" property shown below.
      {
        // "address" is the absolute module address, which callers must treat as
        // opaque but may do full string comparisons with other module address
        // strings and may pass verbatim to other Terraform commands that are
        // documented as accepting absolute module addresses.
        "address": "module.child",

        // "resources" is the same as in "root_module" above
        "resources": [
            {
              "address": "module.child.aws_instance.foo",
              // etc, etc
            }
        ],

        // Each module object can optionally have its own
        // nested "child_modules", recursively describing the
        // full module tree.
        "child_modules": [ ... ],
      }
    ]
  }
}

{
  // "provider_configs" describes all of the provider configurations throughout
  // the configuration tree, flattened into a single map for convenience since
  // provider configurations are the one concept in Terraform that can span
  // across module boundaries.
  "provider_config": {

    // Keys in the provider_configs map are to be considered opaque by callers,
    // and used just for lookups using the "provider_config_key" property in each
    // resource object.
    "opaque_provider_ref_aws": {

      // "name" is the name of the provider without any alias
      "name": "aws",

      // "full_name" is the fully-qualified provider name
      "full_name": "registry.terraform.io/hashicorp/aws",

      // "alias" is the alias set for a non-default configuration, or unset for
      // a default configuration.
      "alias": "foo",

      // "module_address" is included only for provider configurations that are
      // declared in a descendant module, and gives the opaque address for the
      // module that contains the provider configuration.
      "module_address": "module.child",

      // "expressions" describes the provider-specific content of the
      // configuration block, as a block expressions representation (see section
      // below).
      "expressions": <block-expressions-representation>
    }
  },

  // "root_module" describes the root module in the configuration, and serves
  // as the root of a tree of similar objects describing descendant modules.
  "root_module": {

    // "outputs" describes the output value configurations in the module.
    "outputs": {

      // Property names here are the output value names
      "example": {
        "expression": <expression-representation>,
        "sensitive": false
      }
    },

    // "resources" describes the "resource" and "data" blocks in the module
    // configuration.
    "resources": [
      {
        // "address" is the opaque absolute address for the resource itself.
        "address": "aws_instance.example",

        // "mode", "type", and "name" have the same meaning as for the resource
        // portion of a value representation.
        "mode": "managed",
        "type": "aws_instance",
        "name": "example",

        // "provider_config_key" is the key into "provider_configs" (shown
        // above) for the provider configuration that this resource is
        // associated with. If the provider configuration was passed into
        // this module from the parent module, the key will point to the
        // original provider config block.
        "provider_config_key": "opaque_provider_ref_aws",

        // "provisioners" is an optional field which describes any provisioners.
        // Connection info will not be included here.
        "provisioners": [
          {
            "type": "local-exec",

            // "expressions" describes the provisioner configuration
            "expressions": <block-expressions-representation>
          },
        ],

        // "expressions" describes the resource-type-specific content of the
        // configuration block.
        "expressions": <block-expressions-representation>,

        // "schema_version" is the schema version number indicated by the
        // provider for the type-specific arguments described in "expressions".
        "schema_version": 2,

        // "count_expression" and "for_each_expression" describe the expressions
        // given for the corresponding meta-arguments in the resource
        // configuration block. These are omitted if the corresponding argument
        // isn't set.
        "count_expression": <expression-representation>,
        "for_each_expression": <expression-representation>
      },
    ],

    // "module_calls" describes the "module" blocks in the module. During
    // evaluation, a module call with count or for_each may expand to multiple
    // module instances, but in configuration only the block itself is
    // represented.
    "module_calls": {

      // Key is the module call name chosen in the configuration.
      "child": {

        // "resolved_source" is the resolved source address of the module, after
        // any normalization and expansion. This could be either a
        // go-getter-style source address or a local path starting with "./" or
        // "../". If the user gave a registry source address then this is the
        // final location of the module as returned by the registry, after
        // following any redirect indirection.
        "resolved_source": "./child"

        // "expressions" describes the expressions for the arguments within the
        // block that correspond to input variables in the child module.
        "expressions": <block-expressions-representation>,

        // "count_expression" and "for_each_expression" describe the expressions
        // given for the corresponding meta-arguments in the module
        // configuration block. These are omitted if the corresponding argument
        // isn't set.
        "count_expression": <expression-representation>,
        "for_each_expression": <expression-representation>,

        // "module" is a representation of the configuration of the child module
        // itself, using the same structure as the "root_module" object,
        // recursively describing the full module tree.
        "module": <module-configuration-representation>
      }
    }
  }
}

{
  // "constant_value" is set only if the expression contains no references to
  // other objects, in which case it gives the resulting constant value. This is
  // mapped as for the individual values in a value representation.
  "constant_value": "hello",

  // Alternatively, "references" will be set to a list of references in the
  // expression. Multi-step references will be unwrapped and duplicated for each
  // significant traversal step, allowing callers to more easily recognize the
  // objects they care about without attempting to parse the expressions.
  // Callers should only use string equality checks here, since the syntax may
  // be extended in future releases.
  "references": [
    "data.template_file.foo[1].vars[\"baz\"]",
    "data.template_file.foo[1].vars", // implied by previous
    "data.template_file.foo[1]", // implied by previous
    "data.template_file.foo", // implied by previous
    "module.foo.bar",
    "module.foo", // implied by the previous
    "var.example[0]",
    "var.example", // implied by the previous

    // Partial references like "data" and "module" are not included, because
    // Terraform considers "module.foo" to be an atomic reference, not an
    // attribute access.
  ]
}

{
  // Attribute arguments are mapped directly with the attribute name as key and
  // an <expression-representation> as value.
  "ami": <expression-representation>,
  "instance_type": <expression-representation>,

  // Nested block arguments are mapped as either a single nested
  // <block-expressions-representation> or an array object of these, depending on the
  // block nesting mode chosen in the schema.
  //  - "single" nesting is a direct <block-expressions-representation>
  //  - "list" and "set" produce arrays
  //  - "map" produces an object
  "root_block_device": <expression-representation>,
  "ebs_block_device": [
    <expression-representation>
  ]
}

{
  // "actions" are the actions that will be taken on the object selected by the
  // properties below.
  // Valid actions values are:
  //    ["no-op"]
  //    ["create"]
  //    ["read"]
  //    ["update"]
  //    ["delete", "create"]
  //    ["create", "delete"]
  //    ["delete"]
  // The two "replace" actions are represented in this way to allow callers to
  // e.g. just scan the list for "delete" to recognize all three situations
  // where the object will be deleted, allowing for any new deletion
  // combinations that might be added in future.
  "actions": ["update"],

  // "before" and "after" are representations of the object value both before
  // and after the action. For ["create"] and ["delete"] actions, either
  // "before" or "after" is unset (respectively). For ["no-op"], the before and
  // after values are identical. The "after" value will be incomplete if there
  // are values within it that won't be known until after apply.
  "before": <value-representation>,
  "after": <value-representation>,

  // "after_unknown" is an object value with similar structure to "after", but
  // with all unknown leaf values replaced with "true", and all known leaf
  // values omitted. This can be combined with "after" to reconstruct a full
  // value after the action, including values which will only be known after
  // apply.
  "after_unknown": {
    "id": true
  },

  // "before_sensitive" and "after_sensitive" are object values with similar
  // structure to "before" and "after", but with all sensitive leaf values
  // replaced with true, and all non-sensitive leaf values omitted. These
  // objects should be combined with "before" and "after" to prevent accidental
  // display of sensitive values in user interfaces.
  "before_sensitive": {},
  "after_sensitive": {
    "triggers": {
      "boop": true
    }
  },

  // "replace_paths" is an array of arrays representing a set of paths into the
  // object value which resulted in the action being "replace". This will be
  // omitted if the action is not replace, or if no paths caused the
  // replacement (for example, if the resource was tainted). Each path
  // consists of one or more steps, each of which will be a number or a
  // string.
  "replace_paths": [["triggers"]],

  // "importing" is present only when the object is being imported as part
  // of this change.
  "importing": {
    // "id" is the import ID of the object being imported.
    "id": "foo"
  }
}

[
  {
    // "address" describes the address of the checkable object whose status
    // this object is describing.
    "address": {
      // "kind" specifies what kind of checkable object this is. Different
      // kinds of object will have different additional properties inside the
      // address object, but all kinds include both "kind" and "to_display".
      // The two valid kinds are "resource" and "output_value".
      "kind": "resource",

      // "to_display" contains an opaque string representation of the address
      // of the object that is suitable for display in a UI. For consumers that
      // have special handling depending on the value of "kind", this property
      // is a good fallback to use when the application doesn't recognize the
      // "kind" value.
      "to_display": "aws_instance.example",

      // "mode" is included for kind "resource" only, and specifies the resource
      // mode which can either be "managed" (for "resource" blocks) or "data"
      // (for "data" blocks).
      "mode": "managed",

      // "type" is included for kind "resource" only, and specifies the resource
      // type.
      "type": "aws_instance",

      // "name" is the local name of the object. For a resource this is the
      // second label in the resource block header, and for an output value
      // this is the single label in the output block header.
      "name": "example",

      // "module" is included if the object belongs to a module other than
      // the root module, and provides an opaque string representation of the
      // module this object belongs to. This example is of a root module
      // resource and so "module" is not included.
    }

    // "status" is the aggregate status of all of the instances of the object
    // being described by this object.
    // The possible values are "pass", "fail", "error", and "unknown".
    "status": "fail",

    // "instances" describes the current status of each of the instances of
    // the object being described. An object can have multiple instances if
    // it is either a resource which has "count" or "for_each" set, or if
    // it's contained within a module that has "count" or "for_each" set.
    //
    // If "instances" is empty or omitted, that can either mean that the object
    // has no instances at all (e.g. count = 0) or that an error blocked
    // evaluation of the repetition argument. You can distinguish these cases
    // using the "status" property, which will be "pass" or "error" for a
    // zero-instance object and "unknown" for situations where an error blocked
    // evalation.
    "instances": [
      {
        // "address" is an object similar to the property of the same name in
        // the containing object. Merge the instance-level address into the
        // object-level address, overwriting any conflicting property names,
        // to create a full description of the instance's address.
        "address": {
          // "to_display" overrides the property of the same name in the main
          // object's address, to include any module instance or resource
          // instance keys that uniquely identify this instance.
          "to_display": "aws_instance.example[0]",

          // "instance_key" is included for resources only and specifies the
          // resource-level instance key, which can either be a number or a
          // string. Omitted for single-instance resources.
          "instance_key": 0,

          // "module" is included if the object belongs to a module other than
          // the root module, and provides an opaque string representation of the
          // module instance this object belongs to.
        },

        // "status" describes the result of running the configured checks
        // against this particular instance of the object, with the same
        // possible values as the "status" in the parent object.
        //
        // "fail" means that the condition evaluated successfully but returned
        // false, while "error" means that the condition expression itself
        // was invalid.
        "status": "fail",

        // "problems" might be included for statuses "fail" or "error", in
        // which case it describes the individual conditions that failed for
        // this instance, if any.
        // When a condition expression is invalid, Terraform returns that as
        // a normal error message rather than as a problem in this list.
        "problems": [
          {
            // "message" is the string that resulted from evaluating the
            // error_message argument of the failing condition.
            "message": "Server does not have a public IPv6 address."
          }
        ]
      },
    ]
  }
]