Using terraform plan and apply Safely

terraform plan shows exactly what Terraform will do before it does anything — it is the safety check that separates infrastructure as code from running aws cli commands against production. Reviewing the plan before apply is not optional; it is the entire point of the workflow.

Reading a plan output

• The plan shows three action symbols: + for create, - for destroy, ~ for modify in place; a ~/ means destroy and recreate — the most dangerous because it means downtime for the replaced resource
• Any ~ on a resource with production traffic is a reason to pause and understand why — a change to an RDS instance's identifier destroys and recreates the database; a change to multi_az modifies it in place; these look similar in HCL but have completely different operational impact
• Use terraform plan -out=tfplan to save the plan as a binary file; terraform apply tfplan applies exactly that plan without re-computing it — the infrastructure state cannot change between your plan review and the apply in CI

Targeted applies and drift

• terraform apply -target=aws_instance.app_server applies changes to one resource; use this only as a rescue operation for stuck resources — regular use of -target leaves the rest of the configuration unapplied and creates drift between the configuration and reality
• terraform plan -refresh-only updates state to reflect real infrastructure without making changes — the correct first step when you suspect manual changes have been made to infrastructure outside of Terraform; it shows what Terraform thinks differs from reality
• Drift (manual changes made outside Terraform) is the most common production incident pattern with Terraform: a manual security group rule gets overwritten on the next apply; run terraform plan in CI regularly to detect drift before an emergency forces an apply

CI/CD integration

• In CI, the plan runs on every PR and posts the output as a PR comment — reviewers see the infrastructure impact of code changes without running Terraform locally
• The apply runs only after merge to main, after a second plan confirms the state has not changed since the PR plan — the two-plan-one-apply pattern catches state changes that happen between PR approval and merge