Ravi Sir's Cards › AWS
Always read plan
This revision card explains Always read plan. It starts from the need that blind apply can destroy a database when a name or force_new flag changes. It describes terraform plan is a dry run — + add, ~ change, - destroy. Review destroy lines before apply. The how-to section covers how to run plan in CI; require a human check when plan contains destroy on prod modules. An example on the card is a renamed RDS identifier shows -/+: stop and use lifecycle or rename strategy instead of apply.
Read card text
What this card says
Why do we need it?
Blind apply can destroy a database when a name or force_new flag changes.
What is it?
terraform plan is a dry run: + add, ~ change, - destroy. Review destroy lines before apply.
terraform plan
How to do it
Run plan in CI; require a human check when plan contains destroy on prod modules.
Example
A renamed RDS identifier shows -/+: stop and use lifecycle or rename strategy instead of apply.