Lesson 0001 · Understand Terraform

What terraform plan actually does

One idea · ~10 min. Turns plan from magic into something you can predict.
Why this first? Your mission is to stop pattern-matching and actually reason about any config. This is the keystone: once you can predict a plan in your head, state, drift, modules, and testing all become obvious. Everything later hangs off this one mental model.

Here's the whole secret: Terraform is always trying to make three pictures of the world agree.

📝

Desired State

What you want.
Your .tf config.

🗃️

State File

What Terraform thinks exists.
terraform.tfstate.

☁️

Real World

What actually exists.
Live AWS resources.

plan = ① refresh: update the State File from the Real World  →  ② diff: compare Desired State against (refreshed) State  →  ③ report the actions to make reality match.
apply = do those actions, then write the result back into the State File.

That's it. plan changes nothing — it's a read-only dry run. The reason the same config sometimes says "create" and sometimes "no changes" isn't randomness: it's whether the State File already records that resource. The state file is Terraform's memory, and the diff is always Desired vs. State.

Now you predict it

Below are real scenarios. For each, you see all three pictures. Decide what terraform plan will report. Instant feedback after each — aim to reason it out, not guess.

✅ Prove it on your own machine (optional, 3 min)

  1. In an empty dir, write a tiny config — e.g. an aws_s3_bucket (or a provider-free terraform_data / null_resource if you don't want AWS creds).
  2. terraform init, then terraform plan. Note the + create. No state file exists yet.
  3. terraform apply. Now open terraform.tfstate — that's the State File picture.
  4. terraform plan again → "No changes." Same config, opposite result — because state now records it.
  5. Change one attribute and plan again → watch for ~ update vs -/+ replace ("forces replacement").
💬 Stuck or curious? I'm your teacher — ask me anything. Good follow-ups for this lesson: "Why does it need a separate state file at all?" · "What's the difference between ~ update and -/+ replace?" · "What happens if someone changes the bucket in the AWS console?" (that's drift — our next lesson).