What Do terraform plan and terraform apply Do?
Understand what terraform plan and terraform apply do differently, how the state file drives the diff, and why saved plans matter for CI/CD.
Expected Interview Answer
"terraform plan" computes and displays a dry-run diff between your declared configuration and the real infrastructure recorded in the state file, while “terraform apply” executes that diff against the actual cloud provider to create, update, or destroy resources.
Terraform first refreshes its understanding of reality by reading the current state file and, where needed, querying the provider API, then compares that against the desired configuration written in HCL to build a dependency graph of additions, changes, and deletions. "terraform plan" renders this graph as a human-readable diff (prefixed with +, -, or ~) without touching any real resource, letting a reviewer catch an unintended destroy-and-recreate before it happens. "terraform apply" walks the same graph, calling the provider API in the correct dependency order, and after each successful change it writes the new resource attributes back into the state file so the next plan is accurate. Running apply with a saved plan file (terraform apply tfplan) guarantees the exact reviewed plan executes with no drift between review and execution, which is the safe pattern for CI/CD pipelines.
- Prevents surprise infrastructure changes via a reviewable diff
- Keeps a single source of truth between code and real resources
- Enables safe peer review of infrastructure changes before execution
- Supports repeatable, auditable infrastructure changes in CI/CD
AI Mentor Explanation
terraform plan is like a team analyst comparing today's selected XI against the actual XI that walked out last match, circling exactly which players are being swapped in, swapped out, or kept, before anyone signs off. Nothing changes on the field yet — it is purely a comparison read out to the captain. terraform apply is the captain actually walking that exact list to the middle and making the substitutions happen, one by one, in the order the team sheet requires. Because the analyst's list was locked before the changes were made, there is no chance of a different, unreviewed substitution slipping onto the field.
Step-by-Step Explanation
Step 1
Write configuration
Declare desired infrastructure in .tf files using HCL resource blocks.
Step 2
Run terraform plan
Terraform refreshes state, diffs it against configuration, and prints a dry-run change summary.
Step 3
Review the diff
A human or CI gate inspects additions (+), changes (~), and destroys (-) before approving.
Step 4
Run terraform apply
Terraform executes the approved plan against the provider API and updates the state file.
What Interviewer Expects
- Understanding that plan is read-only and apply is the only step that mutates infrastructure
- Knowledge that the state file is what plan diffs configuration against
- Awareness of saving a plan file for exact, drift-free apply in CI/CD
- Ability to explain the dependency graph ordering resources are created/destroyed in
Common Mistakes
- Believing terraform plan changes real infrastructure
- Running apply without ever reviewing the plan output first
- Forgetting the state file must be kept consistent and remote for team use
- Not saving the plan artifact, letting drift occur between review and apply in a pipeline
Best Answer (HR Friendly)
“terraform plan shows us exactly what would change in our infrastructure — new resources, updates, or deletions — without touching anything real, so we can review it like a proposed diff. terraform apply then actually makes those exact reviewed changes happen. Splitting it into two steps means nobody is ever surprised by an infrastructure change, because it was visible and approved before it happened.”
Code Example
# Preview changes without touching real infrastructure
terraform plan -out=tfplan
# Inspect the plan (adds/changes/destroys)
terraform show tfplan
# Apply exactly the reviewed plan, no re-computation
terraform apply tfplanFollow-up Questions
- What happens if the state file drifts from real infrastructure?
- Why should terraform plan output be saved and applied from a file in CI/CD?
- How does Terraform decide the order to create or destroy resources?
- What is the difference between terraform apply and terraform apply -auto-approve?
MCQ Practice
1. What does terraform plan do to real infrastructure?
terraform plan is read-only; it compares state and configuration and prints the diff without mutating anything.
2. Why is it a best practice to apply a saved plan file (terraform apply tfplan) in CI/CD?
Applying a saved plan file locks in exactly what was reviewed, preventing infrastructure from drifting between plan and apply.
3. What does terraform apply update after successfully creating a resource?
After each successful change, Terraform writes the new resource attributes back into the state file.
Flash Cards
What does terraform plan do? — Computes and displays a dry-run diff between configuration and real infrastructure, without changing anything.
What does terraform apply do? — Executes the plan against the provider API and updates the state file.
Why save a plan file before applying? — It guarantees the exact reviewed plan is what executes, with no drift.
What does Terraform diff configuration against? — The state file, refreshed against real provider data.