We close the introductory chapter of Terraform with its fundamental workflow: the plan → apply → destroy cycle. These three commands are the heart of day-to-day work with Terraform. Understanding what each one does will give you the confidence to work safely, without fear of accidentally breaking anything.

Terraform's philosophy is "look before you leap". Before touching anything in your real cloud, Terraform shows you exactly what it will do and waits for your approval. This avoids surprises and disasters.

The cycle has three main commands (plus a preparation one that we’ll see in Chapter 11):

Let’s look at the three main players.

The terraform plan command compares what you’ve written in your code with what currently exists in the cloud, and shows you a summary of the changes it would make, without applying anything yet.

Analogy: plan is like the print preview of a document, or the order summary before paying in an online store. You see exactly what will happen before confirming. If something doesn’t add up, you cancel with no consequences.

Terraform classifies changes with very clear symbols:

Example of plan output:

Plan: 3 to add, 1 to change, 0 to destroy.
  + aws_instance.web        (create a server)
  + aws_security_group.web  (create a firewall)
  + aws_eip.web             (create a static IP)
  ~ aws_s3_bucket.datos     (modify a bucket)

This tells you very clearly: I’m going to create 3 things and modify 1. Nothing has been touched yet. You decide whether to proceed.

Why plan is so valuable:

• Safety: you see the changes before applying them. If you see a - aws_db_instance (destroy your database) you weren’t expecting, you can stop in time!
• Team review: the result of plan can be reviewed with teammates before applying (we’ll see this in Chapter 12 and in CI/CD in Chapter 22).
• Drift detection: plan also warns you if something was changed manually in the cloud and no longer matches your code.

The terraform apply command actually makes the changes. First, it shows you the plan again and asks for confirmation (you have to type yes). Only then does it create, modify, or destroy resources in your real cloud.

Analogy: apply is pressing the "Confirm order" button. Until you confirm, nothing is charged or shipped.

After apply, your real infrastructure matches what you declared in the code. Terraform also records what it did in a state file (the tfstate, which we’ll see in Chapter 11), so it knows what it manages.

Remember idempotence (subchapter 9.2): if you run apply again without changing the code, Terraform will say "no changes" and do nothing. It only acts when there are differences between your code and reality.

The terraform destroy command removes all the infrastructure that Terraform manages. Like apply, it shows you what it’s going to destroy and asks for confirmation.

Analogy: destroy is deleting the entire project and leaving the table clean. Everything Terraform created, it deletes.

What is destroy for?

• Clean up test environments: you set up an environment to experiment, test, and when you’re done, destroy deletes everything. You stop paying instantly (remember Chapter 1: pay as you go).
• Temporary environments: infrastructure you only need for a while.

Huge advantage for learning: While following this book and practicing, you can create infrastructure with apply, experiment, and then cleanly delete it with destroy so you don’t rack up costs. It’s one of the great advantages of IaC: what you create, you destroy without leaving a trace or forgotten resources costing you money.

⚠️ Be careful in production: destroy is irreversible and destroys everything managed by that configuration. Never run it lightly in a real environment. In production, critical resources are protected and restrictions are set on who can destroy. It’s a great tool for testing, dangerous in production.

This is what a typical day working with Terraform looks like:

You’ll repeat this plan → apply cycle constantly: every time you want to change your infrastructure, you modify the code, review with plan, and apply with apply. It’s safe, predictable, and keeps a record of everything.

• The fundamental Terraform workflow is plan → apply → destroy (preceded by init, which we’ll see in Chapter 11).
• plan: previews the changes without applying them (like the order summary before paying). Uses symbols: + create, ~ modify, - destroy.
• apply: executes the changes after asking for confirmation (yes). Leaves your cloud as you declared.
• destroy: removes all managed infrastructure. Great for cleaning up tests and stopping costs; dangerous in production.
• The philosophy is "see before you do": you review with plan before confirming with apply. This makes the work safe and predictable.

With this, you finish Chapter 9. You now understand why IaC exists and how Terraform works at a high level. In Chapter 10 we’ll roll up our sleeves and learn HCL, the language you’ll use to write your infrastructure.