Plan, Apply, and Destroy

Scenario: A plan shows one update but a fresh apply prompt shows three changes because infrastructure drifted after approval.

plan refreshes observations, evaluates expressions, and proposes actions. Symbols communicate create (+), update (~), destroy (-), and replacement (-/+ or +/-). Saving with -out creates an opaque plan artifact that apply can execute without recalculating. destroy is a specialized plan that removes managed objects; removing a resource block also proposes destruction unless a state/configuration refactor says otherwise.

Analogy: A plan is an itemized construction quote at a point in time. Applying a newly calculated plan after approval is accepting a different quote.

A worked configuration

terraform plan -out=release.tfplan
terraform show release.tfplan
terraform apply release.tfplan
# later, deliberately:
terraform plan -destroy

Review replacements especially carefully: immutable attributes may turn a one-line change into downtime or data loss. Saved plans contain full configuration and values and may include secrets, so protect them as sensitive artifacts and expire them quickly.

Warning: destroy does not mean disposable. Providers may delete databases, keys, or certificates irreversibly; lifecycle safeguards and external backups still matter.

Goal: Reinforce this lesson in the tf-saved-plan-replacement Terraform lab. Open /labs/terraform and choose slug tf-saved-plan-replacement; the lab runs real Terraform against the offline FakeCloud provider.