plan, apply and destroy
Preview changes with plan, commit them with apply, and remove everything with destroy.
terraform plan
terraform apply
terraform destroyThese three commands drive every change to your infrastructure.
terraform plan
Shows a preview: resources marked + will be created, ~ changed, and - destroyed. Nothing actually happens yet.
terraform apply
Re-runs the plan and, after you type yes, executes it. Pass -auto-approve in automation to skip the prompt.
terraform destroy
Destroys everything managed by the current configuration. Handy for tearing down temporary environments.
Example
# Save a plan to a file, then apply exactly that plan
terraform plan -out=tfplan
terraform apply tfplan
# Non-interactive apply for CI pipelines
terraform apply -auto-approve
# Destroy only a single resource
terraform destroy -target=aws_instance.webWhen to use it
- A team lead runs terraform plan -out=review.plan and shares the saved output with the security team before any apply is executed in production.
- An automation script runs terraform apply -auto-approve only after a successful plan exit code of 0 in a gated CI pipeline.
- A cost-saving cron job runs terraform destroy -auto-approve every night to tear down non-production environments and recreates them each morning.
More examples
Plan showing resource creation
Shows the plan output indicating two new resources will be created, with no existing resources modified or deleted.
terraform plan
# Plan: 2 to add, 0 to change, 0 to destroy.
#
# + resource "aws_instance" "web" {
# ami = "ami-0c55b159cbfafe1f0"
# instance_type = "t3.micro"
# }Apply with interactive approval
Runs apply interactively, requiring the user to type 'yes' to confirm before any infrastructure is modified.
terraform apply
# Plan: 1 to add, 0 to change, 0 to destroy.
#
# Do you want to perform these actions?
# Only 'yes' will be accepted to approve.
#
# Enter a value: yes
# Apply complete! Resources: 1 added, 0 changed, 0 destroyed.Targeted destroy for one resource
Destroys a single named resource using -target, leaving all other managed resources untouched.
# Destroy only the S3 bucket, not everything else
terraform destroy -target=aws_s3_bucket.logs -auto-approve
# Confirm the resource is gone
terraform state list | grep aws_s3_bucket
Discussion