Always plan before apply, no exceptions

Every infrastructure drift incident traces back to a manual console change made under deadline pressure, not a limitation of Terraform itself. The tool already tells you when something is wrong.

When a production service is dropping requests due to a misconfigured security group or an exhausted connection limit, the pressure to restore service is immense. An engineer logs into the cloud provider console and manually modifies the resource. The fix takes thirty seconds, the alert clears, and the team intends to update the code later. That follow up commit almost never happens.

The State Mismatch At this exact moment, the infrastructure as code is fundamentally broken. The remote state file no longer reflects the physical reality of the cloud environment. The manual change was a successful temporary patch, but it created a latent time bomb for the next deployment cycle.

Two weeks later, a different team member pushes a routine update to an unrelated resource tag. If the continuous deployment pipeline is configured to automatically apply changes, or if an engineer blindly approves the execution without reading the console output, Terraform will do exactly what it is designed to do. It will compare the codebase against the cloud reality and aggressively revert the manual console change to enforce the codified baseline. The original outage immediately returns, taking the engineering team completely by surprise.

The Diagnostic Contract The solution to this pattern is not replacing your infrastructure tooling. The solution is rigid operational discipline. You must treat terraform plan as a strict, mandatory diagnostic step.

The plan output is the exact, deterministic contract of what will happen to your infrastructure. If a plan indicates that a critical security group rule is going to be deleted or a database parameter group is going to be overwritten, the pipeline must halt. A plan that destroys unexpected resources is the definitive signal that someone bypassed the deployment process.

Enforcing the Boundary In a mature platform architecture, write access to the production cloud console should be entirely revoked for human operators. All changes must flow through version control.

But even if console access remains open for emergency break glass scenarios, reviewing the plan output before an apply remains non negotiable. Terraform rarely breaks your infrastructure by accident. It almost always tells you exactly how it plans to break your infrastructure, right before you explicitly give it permission to proceed.