The Lifecycle Loop: Init, Plan, Apply & Destroy

The Big Idea

The day-to-day workflow of Infrastructure as Code revolves around four essential commands: init, plan, apply, and destroy. Knowing exactly what happens under the hood during each step is what separates junior script runners from senior infrastructure architects.

When you run terraform init, Terraform parses your configuration, discovers required provider plugins, fetches the compiled binaries from the registry, and verifies their SHA-256 cryptographic hashes against the lock file .terraform.lock.hcl.

When you run terraform plan, Terraform performs a 100% read-only audit. It contacts cloud APIs to refresh its mental model of existing infrastructure, reads your local code, and presents an exact diff showing additions (+), in-place updates (~), and destructive replacements (-/+). Nothing in your cloud account is mutated until you review this plan and authorize terraform apply.

Understanding Plan Output Diff Symbols

# Terraform will perform the following actions:

  # aws_vpc.core will be updated in-place (Non-destructive)
  ~ resource "aws_vpc" "core" {
        id                   = "vpc-0a81b2c3d4e5f6g7"
      ~ enable_dns_hostnames = false -> true
        tags                 = {
            "Environment" = "production"
            "Name"        = "core-enterprise-vpc"
        }
        # (3 unchanged attributes hidden)
    }

  # aws_security_group_rule.allow_tls will be created
  + resource "aws_security_group_rule" "allow_tls" {
      + cidr_blocks       = [
          + "0.0.0.0/0",
        ]
      + from_port         = 443
      + id                = (known after apply)
      + protocol          = "tcp"
      + security_group_id = "sg-0123456789abcdef0"
      + to_port           = 443
      + type              = "ingress"
    }

Plan: 1 to add, 1 to change, 0 to destroy.