Standard Terraform diffs show field changes, not their effective network meaning. PlanReach applies a domain-specific theorem prover to compute exact, finite network-flow changes locally on your machine before terraform apply runs.
These are not hypothetical scanner findings. Small configuration changes can alter effective access across a cloud environment without making the risk obvious in a field-level diff.
Pipe your plan JSON into PlanReach. No database, SaaS control plane, or agent is required.
Run terraform show -json tfplan or tofu show -json plan.tf directly in your CI pipeline or terminal.
PlanReach resolves security-group references, CIDR overlaps, protocols, and port ranges to compute the exact set difference in network reachability.
Set --fail-on added to block unintended public ingress automatically in GitHub Actions, GitLab CI, or Jenkins.
A field-level diff is not an effective-flow proof. PlanReach resolves network reachability across security-group chains with checked, deterministic semantics.
cannot_prove status when required plan parameters are indeterminate
Hope is not a security control. Guesswork has no place in infrastructure access.
Every rule-based scanner starts the same way. Week one: a few hundred findings. Most of them noise — a rule that's usually right, except this time it isn't. Someone adds a suppression comment. Then another. Six months in, a passing scan doesn't mean the environment is safe. It means enough exceptions have piled up that nobody can tell which alert would have mattered.
That ceiling isn't a rule-quality problem you fix with a bigger library. A rule can only recognize what it was written to recognize. It can't compute what your specific chain of security groups, peered VPCs, and overlapping CIDR ranges actually permits — so it pattern-matches against category and leaves you to verify the guess by hand. Which is the exact work the tool was supposed to remove.
Translating access policies into SMT formulas and proving properties with a solver — instead of pattern-matching against known-bad shapes — is how AWS's own Automated Reasoning Group verifies IAM and S3 policies internally, invoked tens of millions of times a day behind features like S3 Block Public Access and IAM Access Analyzer. They moved to exact computation for the same reason we did: past a certain point, "probably fine" stops being good enough, and a rule engine has no path to get more certain. PlanReach applies that same category of reasoning to the question your Terraform plan actually raises.
Read AWS's writeup on automated reasoning at scaleRules describe what's usually true. PlanReach computes what's actually true.
Most teams start with a small branch plan. Prove the workflow locally, then move to Unlimited when your plan boundary becomes real.
For developers who need a trustworthy answer before opening a PR. Pay what you can from $9; the $29 suggested contribution helps keep exact offline analysis accessible.
Pay what you want · $9 minimum
$9 minimum · $29 suggested.
Founder pricing is temporary and will increase in the future — support developers while it lasts.
One-time digital binary delivery via Dodo Payments.
Unlimited Edition binary for production CI/CD pipelines and larger plan workloads.
One-time founder price: $1,495 (50% below the standard $2,990 price).
Checkout, tax, invoicing, receipt, and digital delivery via Dodo Payments.
cannot_prove status code (Exit Code 3) when required values are unknown or the result cannot be guaranteed before apply.
Get the $1,495 founder price before it returns to $2,990.
Get PlanReach Unlimited Edition