How Terraform previews changes with plans, performs approved changes with apply, and removes managed resources with destroy.
Terraform’s core lifecycle commands operate on an initialized working directory and its selected workspace. terraform plan proposes changes, terraform apply performs approved changes, and terraform destroy proposes and then removes resources Terraform manages. HashiCorp’s workflow reference is the authoritative overview.
| Command | Result |
|---|---|
terraform plan |
Reads managed remote objects, compares them with configuration and state, and displays proposed actions without changing infrastructure. |
terraform apply |
Creates a plan, asks for approval by default, then calls provider APIs to carry out the actions. |
terraform destroy |
Produces a plan whose desired result is no managed resources, then removes those resources after approval. |
Plan output labels the action Terraform intends for each resource: + creates, ~ updates in place, - destroys, and -/+ replaces by destroying and recreating. Replacement deserves particular attention because it can cause downtime or remove data if a resource’s lifecycle and backup strategy do not account for it.
An ordinary terraform plan is speculative: it tells you what Terraform would currently do, but it is not an executable commitment. A saved plan created with terraform plan -out=FILE can be supplied to terraform apply FILE to carry out that exact planned change. This is useful for controlled automation; protect saved plan files because they can include sensitive data.
1terraform plan -out=change.tfplan
2terraform show change.tfplan
3terraform apply change.tfplan
Review the resource addresses, action symbols, replacements, and any unknown values before applying. A plan can become stale when remote infrastructure or inputs change after it is created, so production automation should have an intentional approval and re-planning policy.
terraform destroy targets resources tracked in the current state for the selected workspace. It does not automatically delete unrelated resources in the same cloud account, and it cannot safely clean up an object Terraform does not know it manages. Before destroying, confirm the workspace and backend, review the destroy plan, and preserve data or use provider-specific retention controls where appropriate.
Avoid using -auto-approve in interactive or unfamiliar environments. It bypasses the approval prompt; it does not make a destructive operation safer.