Frequently asked questions

No. tfviz runs on your machine or in your pipeline and writes one HTML file. It has no telemetry, accounts or hosted service, and the report makes no network requests. The only network call tfviz ever makes is the S3 read you ask for with an s3:// input, and --offline refuses even that.

tfviz is designed so it can't. Only approved fields reach the report. Sensitive values become markers with no payload, and tests search every report for planted secrets. Names you choose yourself, such as a resource named after a password, can't be detected, so treat reports like other infrastructure artefacts.

AWS today, with 42 resource types. Resources from other providers still appear, with limited detail and no placement. Azure and Google Cloud are planned after the alpha.

Yes. It's tested with OpenTofu 1.13 and Terraform 1.16, and both produce identical reports for the same stack. For encrypted OpenTofu state, export it with tofu show -json using your encryption configuration.

tfviz doesn't ship them. AWS allows its icons in architecture diagrams but not bundled in software. Download the pack from AWS and pass its folder with --icons, and tfviz embeds the icons each report needs.

No. State is Terraform's recorded snapshot, and a plan is a proposal. tfviz never queries your live infrastructure, so a report can't prove AWS matches it.

Use --safe-share. It replaces names, IDs, ARNs, account numbers and network addresses with consistent stand-ins, and keeps service types and topology. The architecture itself may still be sensitive.

Jenkins serves archived files under a policy that blocks scripts. Download the report and open it locally rather than weakening the controller's security.

Yes. tfviz is open source under the Apache 2.0 licence.

Open an issue on GitHub. If you need to show a problem, use --safe-share. Never attach a real plan, state file or unredacted report.