Plan reader

What does this one-line change really do?

Pick infrastructure changes and read the resulting plan. See how replacement cascades through a dependency graph, and when prevent_destroy stops a plan that would delete the database.

Change the configurationAdd a cost-centre tag to the VPCChange node instance typeUpgrade the Kubernetes versionResize the database instanceRotate to a new KMS keyChange the VPC CIDR block

prevent_destroy on the database

Apply order

1aws_vpc.main

Resources in one step have no dependency between them, so they apply in parallel.

kms_key

vpc~ update

subnet

security_group

iam_role

eks_cluster

db_instance

eks_node_group

helm_release

Plan output, styled after terraform plan

  ~ aws_vpc.main
      # tags changed

Plan: 0 to add, 1 to change, 0 to destroy.

How the model works

Each dependency declares whether replacing its target forces a replacement or an update. Actions propagate through the graph, and apply levels show what can run in parallel.

What it leaves out

The graph is hand-written and small. Terraform derives its own from your configuration and provider schemas.
Output is styled after terraform plan, but no Terraform runs here.

Covers

Terraform
Dependency graphs
Lifecycle rules
Change safety

Next labShould this incident wake someone up?