Bearlow's Exam Prep

bearlow./TERRAFORM-ASSOCIATE-004/Summaries

1 - Infrastructure as Code (IaC) with Terraform

2 - Terraform Fundamentals

3 - Core Terraform Workflow

4 - Terraform Configuration

5 - Terraform Modules

6 - Terraform State Management

7 - Maintain Infrastructure with Terraform

8 - HCP Terraform

37 summaries

summary

3e - Apply changes to infrastructure with Terraform

Overview

The terraform apply command is the primary mechanism for making infrastructure changes in the core Terraform workflow. It executes the operations proposed in a Terraform plan, interacting with infrastructure provider APIs to create, update, or destroy real-world resources so they match the desired state described in your configuration. After apply completes, Terraform updates the state file to reflect the new actual state of all managed resources. There are two modes in which terraform apply can run. In automatic plan mode, running terraform apply without a saved plan file causes Terraform to automatically generate a fresh execution plan, display it to the user, and prompt for confirmation before proceeding. In saved plan mode, passing a plan file produced by terraform plan causes Terraform to execute that exact set of changes without prompting for confirmation, because passing the file is treated as implicit approval. The -auto-approve flag skips the interactive confirmation prompt in automatic plan mode, which is commonly used in CI/CD pipelines and automation contexts. HashiCorp warns that using -auto-approve increases the risk of unpredictable changes and configuration drift if infrastructure can be modified outside of the Terraform workflow. When a saved plan file is provided, -auto-approve has no effect since approval is already implied. Additional apply options allow practitioners to customize behavior: -replace targets a specific resource instance for forced replacement, -var and -var-file supply input variable values at runtime, -parallelism controls concurrent provider API calls (defaulting to 10), and -lock=false disables state locking (which is dangerous in shared environments). Planning modes like -destroy and -refresh-only are also available when running without a saved plan file.

Key Points

terraform apply executes the operations proposed in a Terraform plan by calling the relevant infrastructure provider APIs to create, update, or destroy resources.

After a successful apply, Terraform updates the state file to record the new actual state of all managed infrastructure resources.

In automatic plan mode (no plan file passed), Terraform generates a fresh plan and prompts the user for confirmation before making any changes.

In saved plan mode, passing a plan file produced by terraform plan causes apply to execute that exact set of changes without prompting, since passing the file is treated as approval.

The -auto-approve flag skips the interactive confirmation prompt in automatic plan mode and is ignored when a saved plan file is passed.

Planning modes and planning options such as -replace, -var, and -var-file are only available when running terraform apply without a saved plan file.

source →

Examples

Two-step saved plan workflow

# Step 1: Generate and save the plan to a file
terraform plan -out=tfplan

# Step 2: Inspect the saved plan before applying
terraform show tfplan

# Step 3: Apply the exact saved plan (no confirmation prompt)
terraform apply tfplan

Demonstrates saved plan mode, where passing the plan file to apply acts as implicit approval and executes that exact set of changes without re-planning or prompting.

Automatic plan mode with -auto-approve and runtime variables

# Apply with a variable file and skip the interactive confirmation prompt
terraform apply -var-file='my-vars.tfvars' -auto-approve

# Alternatively, pass a single variable value inline
terraform apply -var='env=prod' -auto-approve

Illustrates automatic plan mode with -auto-approve for CI/CD pipelines, combining runtime variable injection (-var, -var-file) with the flag that suppresses the confirmation prompt.

Force-replace a specific resource instance

# Mark a specific resource for destruction and re-creation
terraform apply -replace='aws_instance.web'

# Combine with a variable and reduced parallelism
terraform apply -replace='aws_instance.web' -var='env=prod' -parallelism=5

Shows the -replace flag in automatic plan mode, which forces Terraform to destroy and recreate the targeted resource instance even if no configuration change would otherwise trigger a replacement.

Common Pitfalls

Practitioners assume -auto-approve skips confirmation when a saved plan file is passed.

When a saved plan file is passed to terraform apply, the act of passing the file is itself treated as approval, so -auto-approve has no effect in that mode.

Practitioners assume planning options like -replace or -var can be combined with a saved plan file during apply.

Planning modes and planning options are only accepted by terraform apply when no saved plan file is provided; a saved plan file already contains the final decisions and cannot be modified at apply time.

Practitioners assume terraform apply always generates a new plan from the current configuration, even when a plan file is passed.

When a saved plan file is used, Terraform executes that exact pre-approved set of changes without running a new plan, regardless of any configuration or state changes that may have occurred since the plan was created.

0 / 37