Specialty · Cloud and SRELesson 2 of 5Free to read

Plans and state · Cloud and Reliability

How do you change live infrastructure without breaking it?

Why you need it

The scariest line in any Terraform plan is must be replaced: the server, database or bucket is destroyed and a new one created, often losing data or causing downtime. A one-word change in a file can do that. Reading a plan before applying it, and knowing which edits cause it, prevents most cloud accidents.

The intuition

Terraform remembers what it created in a state file. A plan compares three things: your files, the state, and (in real life) the cloud itself. For each address:

In files	In state	Plan
yes	no	`+` create
no	yes	`-` destroy
yes, attributes differ	yes	`~` update in place, or `-/+` replace

Whether a difference is an update or a replace depends on the attribute. Some can change on a running resource (an instance's instance_type, tags); others can't (an instance's ami, a bucket's name), so Terraform must destroy and recreate.

Two traps:

Renaming a resource block (web → frontend) changes its address. Terraform sees one resource gone and a new one wanted: destroy plus create. (Real Terraform has a moved block for planned renames.)
Deleting a block destroys the real resource.

Read every - and -/+ line before you type yes.

Definition

State

Terraform's record of the resources it manages and their last known attributes.

Replace

Destroy and recreate a resource, because an attribute that can't change in place was changed.

Drift

When the real infrastructure no longer matches the files, usually after a manual change.

Examples

Update, replace and destroy

Run it in the lesson

The state holds a web server and two buckets. Run it to read the plan.

resource "aws_instance" "web" {
  ami           = "ami-0abc123"
  instance_type = "t3.large"
  tags = {
    Name = "web"
  }
}

resource "aws_s3_bucket" "assets" {
  bucket = "shop-assets-v2"
}

Step by step

L3instance_type changes in place: ~ update. The server keeps running (after a restart).
L10A bucket's name can't change: -/+ replace. The old bucket and its files go away.
L9aws_s3_bucket.tmp is in the state but not in the files: - destroy.

Common mistakes

Renaming a resource

A new name is a new address: Terraform destroys the old resource and creates a new one. Plan renames with a moved block.

Changing a force-new attribute

Changing a database's engine or a server's image replaces it. Check the plan for -/+ before applying.

Losing the state file

Without state, Terraform thinks nothing exists and tries to create everything again. Keep state in a shared, locked remote backend.

Quick quiz

1. You delete a resource block from the file and run plan. What happens?

AThe plan destroys the real resource
BTerraform forgets it but leaves it running
CNothing

Show the answer

Answer: A

The files are the desired end state; something missing from them should not exist.

2. Which plan line deserves the most attention?

A-/+ aws_db_instance.main must be replaced
B+ aws_s3_bucket.logs will be created
C~ aws_instance.web will be updated in-place

Show the answer

Answer: A

Replacing a database means destroying it, and its data with it, unless you've planned for that.

Practice

3 exercises in three steps: predict what a program prints, change a program to meet a new requirement, then write one from scratch. Your code runs in the browser and is checked the moment you submit.

PredictRead the plan
The state matches the lesson's example (a web server with ami-0abc123, buckets assets and tmp). What will this plan do?
ModifyResize without replacing
The goal was only to make the web server bigger (t3.medium). But someone also renamed the block and changed the image, so the plan now destroys the server. Fix the file so the plan only updates aws_instance.web in place.
WriteScale out safely
Two web servers and a bucket already exist (see the starter). Write the file so the plan creates two more servers (web[2] and web[3], same image and type, tags web-2, web-3) and changes nothing else. Use a variable web_count set to 4.

Practise this lesson

Open the interactive lesson to edit and run these examples and solve the exercises with instant feedback. Free to start, no sign-up.

Open the interactive lesson Course map

Interactive lessons open in order. If you have not done the earlier ones yet, you start at the course map.

Terms in this lesson

Term	Chinese	Definition
Terraform state	Terraform 状态	Terraform's record of what it manages.
Replacement	替换（重建）	Destroy and recreate, for attributes that can't change in place.
Drift	配置漂移	Real infrastructure no longer matching the files.