Terraform operations ยท 10 min read
How to review a Terraform plan safely
terraform plan is the best opportunity to understand a proposed infrastructure change before it reaches the cloud. A clean plan is not automatically a safe plan; it still needs a person to confirm that each action matches the intended architecture.
A reviewable Terraform change workflow
The saved plan is reviewed before apply so the work performed is the work that was inspected.
terraform fmt -check
terraform validate
terraform plan -out=tfplan
# Review creates, updates, replacements, and deletes
terraform apply tfplanRead the action types
A plan distinguishes creation, in-place updates, replacements, and destruction. Replacements deserve extra attention because changing an immutable setting may remove and recreate a real resource.
Start with destructive actions, public exposure, identity permissions, networking, data storage, and capacity. Confirm that each change was caused by an intentional edit.
Context before content
A reasonable plan in the wrong cloud account or subscription is still an incident. Verify provider context, workspace, backend, and region before evaluating individual resource changes.
In a team, include enough context that another reviewer can connect the plan with the intended environment and architecture decision.
Plan review supports testing
A plan predicts Terraform actions; it does not prove that an application will work after deployment. Use functional testing, monitoring, backup plans, and rollback procedures for the full operational picture.
If a plan surprises you, stop. The safest change is one you can explain before it runs.
Put it into practice
Predict a small plan before running it. Change one setting and compare the result with your prediction, looking specifically for replacement actions.
- Format and validate first.
- Confirm the intended account, subscription, region, and workspace.
- Review every create, update, replacement, and delete.
- Apply the reviewed plan where the workflow supports it.