Three declarative blocks replaced three imperative CLI commands. Same state surgery — but reviewable in a PR, previewable in a plan, replayable anywhere.
| Block (since) | Replaces | Does |
|---|---|---|
moved (1.1) | terraform state mv | Rename/move an address without destroy+create |
import (1.5) | terraform import | Adopt an existing real resource into state |
removed (1.7) | terraform state rm | Forget a resource — stop managing, keep it alive |
import { to = aws_s3_bucket.legacy id = "acme-legacy-data" } # then: terraform plan -generate-config-out=generated.tf ← drafts the resource block for you removed { from = aws_db_instance.old lifecycle { destroy = false } # forget, don't destroy (omit destroy=false at your peril) }
Sources: import + config generation · removed block · 1.7 announcement
# local / pre-commit terraform fmt -check # canonical formatting terraform validate # syntax + internal consistency, no cloud calls terraform test # unit layer: plan-mode + mocks # CI on PR terraform plan -out=tfplan # the plan IS the artifact… # …human reviews the plan output, approves… # CI on merge/approval terraform apply tfplan # apply EXACTLY what was reviewed — not a fresh plan
apply tfplan executes the reviewed
change set exactly — if reality drifted since, the apply errors instead of improvising.
That's the same three-pictures logic from lesson 0001, weaponized for CI.
Source: Running Terraform in automation
terraform plan -detailed-exitcode # 0 = clean · 1 = error · 2 = changes pending # cron/nightly: exit 2 → page the channel; review with plan -refresh-only to see pure drift
plan -refresh-only separates drift (world changed) from pending work (config changed) — different responses.required_version for Terraform, required_providers with ~> constraints, module versions (lesson 0004). The .terraform.lock.hcl file commits provider exact versions — do commit it (one exception to our state-adjacent gitignore instincts).tofu plan); divergence grows over time — know it exists, evaluate per-feature.moved 1.1 · import block 1.5 · terraform test 1.6 · removed + mocking 1.7 · use_lockfile 1.10 (DynamoDB deprecated 1.11).