VocalHyre
Sign up

Terraform · Infrastructure as code

How do you safely review and apply a Terraform plan?

MediumplanapplyreviewUpdated Oct 2026
Quiz this track

Short answer

terraform plan previews changes and can be saved to a plan file; terraform apply executes that exact plan. Review replacements and destroys, and apply the saved artifact in CI rather than planning twice.

Plan refreshes state, evaluates expressions and shows the actions Terraform intends to take. The symbols matter: plus means create, tilde means update in place, minus means destroy, and minus plus means replace. Replacements are the changes most likely to cause downtime or data loss.

sh
terraform plan -out=tfplan
terraform show tfplan
terraform apply tfplan
terraform plan -detailed-exitcode
A saved plan is bound to the state and configuration it was created from. Apply it without re-planning.

What to check before apply

  • Resources being destroyed or replaced, especially stateful ones
  • Unexpected changes to security groups, IAM or public access
  • The number of resources and the target account and region
  • Whether the plan came from the commit under review

In CI, save the plan as an artifact, require approval for production, then apply that artifact. Planning again at apply time can produce a different result if state or the provider changed. Use -detailed-exitcode in automation: 0 means no changes, 2 means changes, 1 means an error.

-target is an escape hatch for a stuck change. It leaves the rest of the configuration unapplied and can produce a partial graph, so do not use it as a normal workflow.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What is the difference between planning twice and applying a saved plan?
  2. 2Which plan symbols indicate replacement?
  3. 3When is -target justified?
  4. 4What do the detailed exit codes mean?

Say it in the interview

I plan with an output file, review the diff, then apply that exact artifact rather than planning again. I focus on destroy and replace actions, IAM and network changes, and whether the plan corresponds to the commit under review. In CI the plan is an artifact gated by approval for production. I avoid -target except as an emergency escape hatch.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumWhat is Terraform state and why is it needed?MediumHow do you destroy infrastructure safely?HardHow do you design a safe Terraform CI/CD pipeline?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.

Start a free Terraform interviewBrowse all questions