What does terraform plan do and why is it important before apply?
Understand what terraform plan does, how it previews create, update, and destroy actions, and why reviewing the plan before apply prevents costly mistakes.
Expected Interview Answer
terraform plan creates an execution plan — a preview that compares your configuration against the current state and real infrastructure and shows exactly which resources will be created, changed, or destroyed, without making any changes itself.
Plan refreshes its view of real resources, diffs them against your declared configuration and the recorded state, and prints a symbolized summary: plus for create, tilde for update in place, minus for destroy, and minus/plus for replacement. It is important before apply because it turns an opaque change into a reviewable diff, letting you catch accidental deletions, unintended replacements, or drift before anything is touched. Saving the plan with -out lets apply execute exactly what you reviewed, eliminating any gap between preview and action.
- Previews changes without altering infrastructure
- Catches destructive or unexpected actions early
- Reveals configuration drift from real resources
- Enables code-review of infrastructure changes
- A saved plan guarantees apply does exactly what was shown
AI Mentor Explanation
Terraform plan is the third umpire's review before a decision stands. Play pauses, the replay lays out exactly what happened frame by frame, and everyone sees whether the batter is out, not out, or the delivery must be re-bowled — all before the scoreboard changes. Only once the review confirms the call does the on-field umpire signal and the score update. Skipping that review risks a wrong outcome baked permanently into the match.
Step-by-Step Explanation
Step 1
Refresh real state
Terraform queries the provider to learn the current state of the resources it manages.
Step 2
Diff against configuration
It compares that real state and the stored state against your desired configuration.
Step 3
Compute actions
For each resource it decides whether to create, update in place, replace, or destroy.
Step 4
Print the plan
It prints a symbolized diff (+ create, ~ update, - destroy, -/+ replace) with a summary count.
Step 5
Optionally save it
Use -out=tfplan so apply executes exactly the reviewed plan with no drift in between.
What Interviewer Expects
- Understanding that plan is a non-mutating preview
- Knowledge of the create/update/replace/destroy symbols
- Awareness that plan detects drift from real infrastructure
- Why saving a plan with -out matters for apply
- The value of reviewing plans in code review or CI
Common Mistakes
- Believing terraform plan changes infrastructure
- Ignoring resource replacements shown as -/+ in the diff
- Not saving the plan and assuming apply will do the same thing
- Skipping plan review and applying blindly
- Confusing drift detection with an actual apply
Best Answer (HR Friendly)
“terraform plan is a preview: it shows exactly what changes will happen before anything actually changes. It matters because you get to review and approve those changes first, which prevents mistakes like accidentally deleting something important.”
Code Example
# Preview changes and write them to a file
terraform plan -out=tfplan
# Example output:
# + aws_instance.web (create)
# ~ aws_s3_bucket.logs (update in place)
# -/+ aws_db_instance.main (replace)
# Plan: 1 to add, 1 to change, 1 to destroy.
# Apply exactly the reviewed plan
terraform apply tfplanFollow-up Questions
- What do the +, ~, and -/+ symbols mean in a plan?
- How does terraform plan detect configuration drift?
- Why should you use terraform plan -out before apply?
- Can terraform plan modify any infrastructure?
- How would you use plan output in a pull-request review?
MCQ Practice
1. What does terraform plan do to real infrastructure?
Plan is read-only against real infrastructure; it computes and displays intended changes without making any.
2. What does a -/+ symbol in a plan indicate?
-/+ means Terraform must replace the resource: destroy the existing one and create a new one.
3. Why save a plan with -out before apply?
A saved plan lets apply run precisely the reviewed set of changes, removing any gap between preview and execution.
Flash Cards
Does terraform plan change infrastructure? — No — it only previews the create, update, and destroy actions it would take.
What does -/+ mean in a plan? — The resource will be replaced: destroyed and then recreated.
Why use plan -out=tfplan? — So apply executes exactly the reviewed plan with no drift in between.
What does plan detect against real resources? — Drift — differences between the real infrastructure and the desired configuration.