Automating `plan` and `apply`

Manually running terraform plan and terraform apply can be slow and error-prone, especially in team environments.

Automating these steps within a Continuous Integration/Continuous Deployment (CI/CD) pipeline brings significant benefits:

• Speed: Faster infrastructure changes.
• Consistency: Eliminates human error.
• Reliability: Ensures predictable deployments.
• Collaboration: Facilitates team review and approval.

The terraform plan command is your safety net. It shows exactly what changes Terraform will make to your infrastructure without actually executing them.

In a CI/CD pipeline, plan should run automatically on every code change (e.g., a pull request). This provides an immediate preview for review.

Integrating terraform plan into your CI pipeline typically involves a few steps:

1. Initialize: Run terraform init to prepare your working directory.
2. Plan: Execute terraform plan to generate the proposed changes.
3. Output: Capture the plan output for review.

Here's a simplified example of how this might look in a CI script:

# ci_plan_stage.sh
terraform init
terraform plan -out=tfplan

After terraform plan runs, its output is crucial. It details every resource that will be created (+), updated (~), or destroyed (-).

Reviewing this output (often in a pull request comment) helps catch unintended changes, ensuring infrastructure integrity. It acts as a critical checkpoint.

A key aspect of safe automation is gating the terraform apply step. You typically don't want apply to run immediately after every plan.

Instead, the plan output should be reviewed and explicitly approved by a team member. This approval (e.g., merging a pull request) then triggers the actual deployment.

Once the terraform plan has been reviewed and approved, terraform apply takes over. This command executes the changes defined in your configuration files.

In a CI/CD pipeline, apply is often triggered after a successful merge to a designated deployment branch (like main or production), or via a manual trigger after approval.

When automating terraform apply, you'll often use the -auto-approve flag in CI/CD environments. Be aware that this skips the interactive confirmation prompt.

Always ensure this step is protected by strong access controls and only runs after explicit human or automated approval based on a successful plan.

# cd_apply_stage.sh
terraform init
terraform apply -auto-approve tfplan

Terraform is designed to be idempotent. This means if you run terraform apply multiple times with the same configuration, it will only make changes if the real-world infrastructure doesn't match the desired state.

If your infrastructure already matches the configuration, apply will do nothing, ensuring consistent and reliable deployments without unintended side effects.

When automating plan and apply:

• Least Privilege: Ensure your CI/CD agent has only the necessary permissions.
• Remote State: Use remote state backends with locking for team collaboration.
• Version Control: Keep all Terraform configurations under version control.
• Monitoring: Implement monitoring and alerts for deployment status.

Let's check your knowledge of automating Terraform in CI/CD!

In this lesson, we learned how to automate terraform plan and terraform apply within a CI/CD pipeline.

• terraform plan provides a safe preview of changes, ideal for automated checks and human review.
• Gating apply with approval ensures critical changes are vetted.
• terraform apply automates the deployment, often with -auto-approve in controlled environments.
• Terraform's idempotency makes automated deployments reliable and predictable.

This automation is key for efficient, consistent, and collaborative infrastructure management!