Plan output reading in Terraform - Deep Dive

Overview - Plan output reading

What is it?

Plan output reading is the process of understanding the results Terraform shows after running a plan command. Terraform plan previews the changes it will make to your cloud infrastructure without applying them. Reading this output helps you see what resources will be created, changed, or destroyed before making any real changes.

Why it matters

Without reading the plan output, you risk making unexpected changes to your infrastructure, which can cause downtime, data loss, or security issues. It acts like a safety check, letting you confirm your intentions before Terraform changes anything. This prevents costly mistakes and builds confidence in managing cloud resources.

Where it fits

Before learning plan output reading, you should understand basic Terraform concepts like resources, providers, and the plan/apply workflow. After mastering plan output reading, you can move on to advanced topics like state management, modules, and automation pipelines.

Mental Model

Core Idea

Terraform plan output is a detailed preview showing exactly what infrastructure changes will happen, helping you catch mistakes before they occur.

Think of it like...

Reading Terraform plan output is like checking a blueprint before building a house—you see every wall, door, and window planned, so you can fix errors before construction starts.

┌─────────────────────────────┐
│ Terraform Plan Output        │
├───────────────┬─────────────┤
│ Action        │ Resource    │
├───────────────┼─────────────┤
│ + create      │ aws_instance│
│ ~ update      │ aws_s3_bucket│
│ - destroy     │ aws_security_group│
└───────────────┴─────────────┘

Build-Up - 7 Steps

1

Foundation

What is Terraform Plan Output

Concept: Introduce the basic idea of Terraform plan output as a preview of changes.

When you run 'terraform plan', Terraform compares your current infrastructure state with your configuration files. It then shows a list of actions it will take: create new resources, update existing ones, or destroy old ones. This output is a safe way to see changes before applying them.

Result

You get a clear list of planned changes without affecting your real infrastructure.

Understanding that plan output is a preview helps you avoid surprises and control infrastructure changes.

2

Foundation

Basic Symbols in Plan Output

Concept: Learn the meaning of symbols like +, ~, and - in the plan output.

In the plan output, '+' means a resource will be created, '~' means it will be updated, and '-' means it will be destroyed. These symbols appear before resource names to quickly show the action type.

Result

You can quickly identify what Terraform plans to add, change, or remove.

Knowing these symbols lets you scan the plan output efficiently and understand the impact.

3

Intermediate

Reading Resource Change Details

🤔Before reading on: do you think Terraform shows all attribute changes or only some? Commit to your answer.

Concept: Understand how Terraform shows detailed attribute changes for resources being updated.

For resources marked with '~', Terraform lists which attributes will change. It shows the old value with a '-' and the new value with a '+'. Attributes not changing are not shown. This helps you see exactly what will be modified.

Result

You get a detailed view of what properties of a resource will change.

Seeing attribute-level changes prevents accidental modifications and helps verify intended updates.

4

Intermediate

Interpreting Resource Dependencies

🤔Before reading on: do you think Terraform plan output shows resource dependencies explicitly? Commit to your answer.

Concept: Learn how Terraform indicates dependencies between resources in the plan output.

Terraform plan output may show resource dependencies implicitly by the order of actions or explicitly in some cases. Understanding dependencies helps you know which resources must be created or updated before others.

Result

You understand the sequence Terraform will follow to apply changes safely.

Recognizing dependencies helps you predict the order of operations and avoid conflicts.

5

Intermediate

Detecting No-Change Resources

Concept: Learn how Terraform indicates resources that will not change.

Resources that Terraform will leave untouched are shown without any action symbol. They appear in the plan output to confirm their presence but show no planned changes.

Result

You can distinguish between changed and unchanged resources clearly.

Knowing which resources remain unchanged helps focus your attention on actual changes.

6

Advanced

Handling Sensitive and Computed Values

🤔Before reading on: do you think Terraform plan output shows all sensitive values in plain text? Commit to your answer.

Concept: Understand how Terraform handles sensitive and computed values in the plan output.

Terraform hides sensitive values in the plan output to protect secrets, showing placeholders instead. Computed values that are not yet known may appear as ''. This prevents accidental exposure and indicates values determined only at apply time.

Result

You learn to interpret placeholders and understand when values are not yet available.

Recognizing hidden and computed values prevents confusion and protects sensitive data.

7

Expert

Reading Plan Output in Automation and CI/CD

🤔Before reading on: do you think plan output is only for humans or can automation use it? Commit to your answer.

Concept: Explore how plan output can be parsed and used in automated workflows and continuous integration pipelines.

Terraform plan can output in JSON format, which automation tools can parse to make decisions. For example, a CI/CD pipeline can approve or reject changes based on plan content. Understanding this enables safer, automated infrastructure management.

Result

You can integrate plan output reading into automated checks and approvals.

Knowing how to use plan output programmatically elevates infrastructure management to professional, automated levels.

Under the Hood

Terraform compares the desired state defined in configuration files with the current state stored in the state file. It calculates a diff of resources and attributes, then generates a plan showing actions needed to reconcile differences. Sensitive data is masked, and computed values are marked as unknown until apply time.

Why designed this way?

This design prevents accidental changes by requiring explicit approval before applying. Masking sensitive data protects secrets from exposure. Showing computed values as unknown reflects that some information depends on runtime conditions, preserving accuracy and security.

┌───────────────┐      ┌───────────────┐      ┌───────────────┐
│ Configuration │─────▶│   Terraform   │─────▶│   Plan Output │
│   Files      │      │   Engine      │      │ (Preview)     │
└───────────────┘      └───────────────┘      └───────────────┘
         ▲                    │                     │
         │                    ▼                     ▼
   ┌───────────────┐    ┌───────────────┐    ┌───────────────┐
   │ State File    │    │ Diff Engine   │    │ Mask Sensitive│
   │ (Current)     │    │ (Compare)    │    │ & Mark Unknown│
   └───────────────┘    └───────────────┘    └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does a resource marked with '-' in plan output get deleted immediately? Commit to yes or no.

Common Belief: If a resource shows '-' in the plan output, it is already deleted.

Reality: The '-' symbol means the resource will be destroyed only after you run 'terraform apply', not immediately after 'terraform plan'.

Why it matters: Assuming immediate deletion can cause confusion and fear, leading to hesitation or errors in managing infrastructure.

Quick: Does Terraform plan output always show every detail of every resource? Commit to yes or no.

Common Belief: Terraform plan output shows all resource details, including unchanged attributes.

Reality: Terraform plan output only shows attributes that will change or are relevant; unchanged attributes are omitted to reduce noise.

Why it matters: Expecting full details can cause misunderstanding or missing important changes hidden in the output.

Quick: Can you trust Terraform plan output to always be 100% accurate? Commit to yes or no.

Common Belief: Terraform plan output is always perfectly accurate and final.

Reality: Plan output is a best-effort preview; some changes may differ at apply time due to external factors or computed values.

Why it matters: Blind trust can lead to unexpected results; understanding limitations encourages cautious review and testing.

Quick: Does Terraform plan output reveal sensitive values in plain text? Commit to yes or no.

Common Belief: Terraform plan output shows all values, including secrets, in plain text.

Reality: Terraform masks sensitive values in the plan output to protect secrets from exposure.

Why it matters: Expecting to see secrets can cause confusion; knowing they are hidden helps maintain security best practices.

Expert Zone

1

Terraform plan output order reflects resource dependencies, which can help diagnose complex dependency issues.

2

The JSON plan output format allows fine-grained automation but requires careful parsing to avoid misinterpretation.

3

Computed values marked as '' can cause confusion; understanding when and why they appear is key to debugging.

When NOT to use

Plan output reading is less useful if you do not have access to the state file or configuration, such as when managing infrastructure created outside Terraform. In such cases, manual inspection or other tools like cloud provider consoles should be used.

Production Patterns

In production, teams use 'terraform plan' with automated approval gates in CI/CD pipelines. They parse JSON plan outputs to enforce policies, prevent destructive changes, and generate change logs for auditing.

Connections

Version Control Systems

Both show planned changes before applying them.

Understanding how version control diffs work helps grasp Terraform plan output as a diff of infrastructure state.

Database Migration Tools

Both preview schema changes before applying them to production.

Knowing database migration previews clarifies why Terraform shows planned changes to avoid breaking live systems.

Project Management Change Requests

Plan output acts like a change request document for infrastructure.

Seeing plan output as a formal proposal helps appreciate its role in communication and approval workflows.

Common Pitfalls

#1 Ignoring plan output and running apply directly.

Wrong approach:

terraform apply

Correct approach:

terraform plan
# Review output carefully
terraform apply

Root cause:

Underestimating the importance of previewing changes leads to unexpected infrastructure modifications.

#2 Misreading '~' as only minor changes when it can include destructive updates.

Wrong approach:

~ aws_instance.example (will be updated in-place)

Correct approach:

Carefully read attribute changes under '~' to check for any destructive or critical updates.

Root cause:

Assuming update means safe change without checking details causes overlooked risks.

#3 Expecting sensitive values to appear in plan output for verification.

Wrong approach:

terraform plan
# Looking for secret passwords in output

Correct approach:

Trust that sensitive values are masked; verify secrets through secure means outside plan output.

Root cause:

Misunderstanding Terraform's security design leads to confusion and insecure practices.

Key Takeaways

Terraform plan output previews infrastructure changes before they happen, acting as a safety check.

Symbols like '+', '~', and '-' quickly show resource creation, update, or deletion actions.

Detailed attribute changes appear only for updated resources, helping you verify exact modifications.

Sensitive and computed values are masked or marked to protect secrets and indicate unknowns.

Reading plan output carefully prevents costly mistakes and enables safe, automated infrastructure management.

Practice

1. What does the terraform plan command primarily show before applying changes?

easy

A. The current cost of your cloud resources

B. The changes Terraform will make to your infrastructure

C. The list of all Terraform providers installed

D. The history of previous Terraform apply commands

Solution

1. Step 1: Understand the purpose of terraform plan

   This command previews the changes Terraform will perform on your infrastructure without applying them.

2. Step 2: Compare options with command purpose

   Only The changes Terraform will make to your infrastructure correctly describes this preview of changes. Other options describe unrelated information.

3. Final Answer:

   The changes Terraform will make to your infrastructure -> Option B

4. Quick Check:

   Plan shows changes = B [OK]

Hint: Plan shows what changes will happen before apply [OK]

Common Mistakes:

• Confusing plan with apply
• Thinking plan shows costs
• Assuming plan shows provider list

2. In Terraform plan output, what does the symbol ~ indicate?

easy

A. Resource will be updated

B. Resource will be created

C. Resource will be deleted

D. Resource will be ignored

Solution

1. Step 1: Recall Terraform plan symbols

   The symbol ~ means a resource will be updated (changed in place).

2. Step 2: Match symbol to meaning

   + means create, - means delete, so ~ must mean update.

3. Final Answer:

   Resource will be updated -> Option A

4. Quick Check:

   ~ means update = A [OK]

Hint: Remember + create, ~ update, - delete symbols [OK]

Common Mistakes:

• Mixing up ~ with + or -
• Thinking ~ means delete
• Assuming ~ means no change

3. Given this Terraform plan output snippet:

  # aws_instance.web will be updated in-place
  ~ resource "aws_instance" "web" {
      instance_type = "t2.micro" -> "t2.small"
    }

What does this output mean?

medium

A. The instance type will change from t2.micro to t2.small

B. No changes will be made to the instance

C. The instance will be deleted and recreated

D. The instance will be created new

Solution

1. Step 1: Analyze the plan output details

   The symbol ~ shows an in-place update. The instance_type changes from "t2.micro" to "t2.small".

2. Step 2: Interpret the meaning

   This means the existing instance will be updated to the new type without deletion.

3. Final Answer:

   The instance type will change from t2.micro to t2.small -> Option A

4. Quick Check:

   ~ means update, instance_type changed = C [OK]

Hint: Look for ~ and arrow showing old -> new value [OK]

Common Mistakes:

• Thinking resource will be deleted
• Ignoring the arrow showing value change
• Assuming no change because resource exists

4. You see this Terraform plan output:

  # aws_s3_bucket.example will be deleted
  - resource "aws_s3_bucket" "example" {
      bucket = "my-bucket"
    }

But you want to keep the bucket. What should you do?

medium

A. Ignore the plan and continue

B. Remove the resource from your Terraform config

C. Run terraform apply immediately

D. Add lifecycle rule with prevent_destroy to the resource

Solution

1. Step 1: Understand the delete plan

   The plan shows the bucket will be deleted, but you want to keep it.

2. Step 2: Use lifecycle prevent_destroy

   Adding a lifecycle block with prevent_destroy = true stops accidental deletion.

3. Final Answer:

   Add lifecycle rule with prevent_destroy to the resource -> Option D

4. Quick Check:

   Use prevent_destroy to block deletes = A [OK]

Hint: Use lifecycle prevent_destroy to stop unwanted deletes [OK]

Common Mistakes:

• Removing resource causes deletion
• Applying plan deletes bucket
• Ignoring plan risks data loss

5. You run terraform plan and see:

  # aws_security_group.sg will be replaced
  - resource "aws_security_group" "sg" {
      name = "old-sg"
    }
  + resource "aws_security_group" "sg" {
      name = "new-sg"
    }

What does this mean and why does Terraform replace the resource instead of updating it?

hard

A. Terraform will fail because name change is not allowed

B. Terraform updates the resource in place changing the name

C. Terraform deletes and recreates because the name attribute is immutable

D. Terraform ignores the change because names can be duplicated

Solution

1. Step 1: Analyze the plan output for replacement

   The plan shows the resource will be deleted (-) and a new one created (+) with a different name.

2. Step 2: Understand why replacement occurs

   Some attributes like security group name are immutable, so Terraform must replace the resource to change them.

3. Final Answer:

   Terraform deletes and recreates because the name attribute is immutable -> Option C

4. Quick Check:

   Immutable attribute change causes replacement = D [OK]

Hint: Immutable attribute changes cause resource replacement [OK]

Common Mistakes:

• Thinking Terraform updates name in place
• Assuming name can be duplicated
• Believing plan will fail on name change