The workflow: init, plan, apply, destroy

Change infrastructure safely.

The Terraform workflow is a short, safe cycle of four commands, and its defining feature is that it always shows you what it will do before it does it. init sets up the working directory (downloads providers, configures the backend); plan computes and displays the changes without making them; apply executes them after showing the plan again; destroy tears everything down. The plan-then-apply gate is what makes Terraform safe on real infrastructure — you never change what you have not first reviewed.

$ terraform init      # one-time: download providers, initialize the backend
$ terraform plan      # DRY RUN: show exactly what would change (nothing is applied)
Plan: 2 to add, 0 to change, 0 to destroy.
$ terraform apply     # execute — re-shows the plan and asks to confirm
  Enter a value: yes
aws_security_group.web_sg: Creation complete
aws_instance.web: Creation complete
$ terraform destroy   # tear it down (also shows a plan and confirms)

Reading a plan

The plan is the most important output to learn to read — it is your last chance to catch a mistake. Each resource carries a symbol: + create, ~ change in place, - destroy, and -/+ replace (destroy then recreate — the dangerous one, meaning downtime or data loss). The summary line is your headline check. If the plan proposes to destroy or replace something you did not intend, stop and fix the code before applying.

$ terraform plan
  ~ resource "aws_instance" "web" {
      ~ instance_type = "t3.micro" -> "t3.small"     # ~ = change in place (safe)
    }
-/+ resource "aws_db_instance" "main" {               # -/+ = DESTROY and recreate (data loss!)
      ~ engine_version = "14" -> "16"
    }
Plan: 1 to add, 1 to change, 1 to destroy.

Save the plan you apply

In automation you separate plan from apply so the thing you reviewed is exactly the thing that runs. terraform plan -out=tfplan writes the plan to a file; terraform apply tfplan applies precisely that, with no re-computation and no second prompt. This closes the gap where infrastructure changes between the plan you approved and the apply that executes — the basis of the CI/CD pattern later.