Reading a plan before you approve it

Why the plan, and not a summary

A model’s description of what it intends and the plan Terraform produces are different things, and only the plan is what runs. Everything on the approval screen is read from the plan itself.

The groups

Changes are sorted by what they are for. Networking covers VPCs, subnets, routes and security groups. Compute covers clusters and node groups. Data covers databases, volumes and buckets. Access covers roles and policies.

Each group shows how many resources are created, changed and removed. Anything that removes a resource holding data is listed separately and needs its own acknowledgement.

Policy results

Policy has already run by the time you see the plan. A finding names the rule, the resource and the reason. A plan with a refusing finding cannot be approved until the declaration is changed.

Cost

The estimate shows the monthly difference this plan makes, split by group. Usage-based services appear as a range with the assumption stated beside them.

The confirmation

Approving binds your confirmation to the plan’s digest. If anything changes before apply, including a re-plan that produces a different result, the approval no longer matches and a new one is required.