📘 Terraform Plan: Safely Previewing Infrastructure Changes

When managing infrastructure with Terraform, the last thing you want is to accidentally break production with unexpected changes. That’s where terraform plan comes in.

The Terraform Plan command is like a dry run or blueprint of what Terraform intends to do. Instead of applying changes directly, it analyzes your .tf configuration files and shows:

• Which resources will be created.
• Which resources will be updated.
• Which resources will be destroyed.

👉 Think of it as a flight simulator for infrastructure. You can test your changes safely before actually deploying them.

⚙️ What Does Terraform Plan Do?

When you run:

terraform plan

Terraform:

1. Loads Current State

   • Reads the state file (terraform.tfstate or remote backend).

2. Compares State vs Config

   • Compares your current infrastructure with .tf configuration files.

3. Generates Execution Plan

   • Outputs a list of actions (add, change, destroy).

4. Prepares Apply

   • Stores the plan so that it can be passed to terraform apply.

👉 Nothing is actually deployed or destroyed. It’s a read-only preview.

🛠 Terraform Plan Syntax & Options

Basic usage:

terraform plan

Useful options:

• -out=plan.out → Save plan for later execution.
• -input=false → Disable interactive input.
• -destroy → Show what will be destroyed.
• -refresh=false → Skip refreshing state.
• -var or -var-file → Pass variables into the plan.

🛠 3 Unique Real-World Examples of Terraform Plan

✅ Example 1: Previewing AWS S3 Bucket Creation

Step 1: main.tf

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "terraform-plan-example-bucket"
  acl    = "private"
}

Step 2: Run Terraform Plan

terraform init
terraform plan

Output Example:

+ aws_s3_bucket.example
      bucket: "terraform-plan-example-bucket"
      acl:    "private"

👉 + means Terraform will create this resource.

✅ Example 2: Detecting Updates in Resources

Step 1: Update ACL in main.tf

resource "aws_s3_bucket" "example" {
  bucket = "terraform-plan-example-bucket"
  acl    = "public-read"
}

Step 2: Run Plan

terraform plan

Output Example:

~ aws_s3_bucket.example
      acl: "private" → "public-read"

👉 ~ means Terraform will update the existing resource.

✅ Example 3: Planning Destruction of Resources

Step 1: Remove S3 Bucket Resource

# (Removed aws_s3_bucket block from main.tf)

Step 2: Run Plan

terraform plan

Output Example:

- aws_s3_bucket.example
      bucket: "terraform-plan-example-bucket"

👉 - means Terraform will destroy this resource.

🎯 Why is Terraform Plan Important?

1. Prevents Mistakes

   • Avoids accidentally deleting production resources.

2. Improves Collaboration

   • Teams can review plan outputs before applying.

3. Compliance & Approvals

   • Execution plans can be audited and approved.

4. Safer CI/CD Pipelines

   • Ensures infrastructure deployments are predictable.

5. Debugging Tool

   • Helps identify why Terraform thinks something should change.

🧠 How to Remember Terraform Plan (Exam & Interview)

Mnemonic: P.C.D.A

• P → Preview changes
• C → Compare current vs desired state
• D → Detect create/update/destroy actions
• A → Approve before apply

👉 Interview Answer: “Terraform plan generates an execution plan showing what resources will be created, modified, or destroyed without making actual changes. It’s a dry run that helps ensure safe deployments.”

📚 Best Practices for Terraform Plan

• Always run terraform plan before every apply.
• Use terraform plan -out=plan.out in CI/CD pipelines.
• Commit plan outputs for audit purposes.
• Review plan carefully when working with production resources.
• Use variables and workspaces to test multiple environments.

🔮 Future Enhancements of Terraform Plan

• AI-assisted plan review → Detect risky changes.
• Visual execution plans → Graphical previews of create/update/destroy.
• Policy-driven approvals → Auto-block unsafe plans.
• Drift detection → Highlight infrastructure drift more clearly.

📝 Summary

• terraform plan shows what Terraform will do without actually doing it.

• It compares the desired configuration with the current state.

• Symbols:

  • + → Create
  • ~ → Update
  • - → Destroy

• Essential for preventing mistakes in production.

• Best remembered with P.C.D.A → Preview, Compare, Detect, Approve.

✅ Final Takeaway

The Terraform Plan command is your safety net. Without it, applying changes would be like deploying blindfolded. By running terraform plan, you:

• See exactly what will change.
• Share plans with teammates.
• Avoid unexpected outages.

👉 Mastering terraform plan builds confidence in your Terraform workflow and makes you a more reliable DevOps engineer.