Gnu Group Learning AcademyGnu Group ↗
Terraform Fundamentals · Module 09 of 12

Planning, drift, saved plans and safe apply

Interpret plan actions, use detailed exit codes and saved plans in automation, and distinguish configuration changes from drift and refresh-only reconciliation.

Learning objectives

By the end of this module, you should be able to:

  • Read plan symbols and summary counts.
  • Use -detailed-exitcode and saved plan files in automation.
  • Explain drift, refresh-only planning and why routine targeting is discouraged.

A plan is a proposed transaction

Terraform plans compare desired configuration, prior state and provider observations. Review replacements and destroys carefully because they can have availability or data consequences.

Saved plans bind review to execution

terraform plan -out=FILE creates a plan artifact that terraform apply FILE can execute. This prevents an apply from silently recalculating a different plan after review. Plan files can contain sensitive data and should be protected.

Drift is change outside Terraform

If infrastructure changes outside Terraform, refresh during planning may detect drift. -refresh-only can reconcile state/output values without changing remote objects. -target is mainly for exceptional recovery/diagnosis, not routine dependency management.

Worked examples

See the idea in practice.

Automation-friendly plan result

terraform plan -detailed-exitcode -out=tfplan
# exit 0: no changes; 2: changes; 1: error
terraform apply tfplan
  • CI systems can distinguish no-change, change and error outcomes.
Hands-on lab

Lab — Review and apply an exact saved plan

Goal: Create a plan artifact, apply it, then detect a configuration change with detailed exit codes.

Before you start

  • Terraform CLI only.
STEP 1

Create baseline configuration

mkdir -p ~/gnu-terraform-labs/module09 && cd ~/gnu-terraform-labs/module09
cat > main.tf <<'EOF'
resource "terraform_data" "release" {
  input = "v1"
}
EOF
terraform init
STEP 2

Save and inspect plan

terraform plan -out=tfplan
terraform show tfplan
STEP 3

Apply exact plan

terraform apply -auto-approve tfplan
STEP 4

Change desired state and detect it

sed -i 's/"v1"/"v2"/' main.tf
set +e
terraform plan -detailed-exitcode >/tmp/tf-plan.out
rc=$?
set -e
echo "exit=$rc"
test "$rc" -eq 2

Verify

  • The saved plan applies successfully.
  • After changing input to v2, detailed exit code is 2.

Expected outcome

  • You can distinguish plan change/no-change/error outcomes and understand why saved plans are protected artifacts.

If it fails

  • Do not publish tfplan files; they can contain sensitive values.
  • With -detailed-exitcode, exit code 2 means valid changes are present, not an error.
Real-world connection

A mature delivery pipeline often separates plan generation/review from apply while preserving the exact approved plan artifact.

Avoid these traps

Common mistakes

  • Treating exit code 2 from detailed-exitcode as failure.
  • Using -target for ordinary deployments.
  • Assuming a saved plan contains no sensitive data.
Knowledge check

Can you explain it without looking back?

Open each answer only after you have tried to answer the question yourself.

1What does -detailed-exitcode return for a plan with changes?

2.

2Why use a saved plan?

To apply the exact set of reviewed changes rather than recalculate at apply time.

3What is drift?

A difference caused by changes to managed infrastructure outside the desired Terraform configuration/workflow.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Attempt the core lab and knowledge checks before marking the module complete.