The Resource Lifecycle in a Plan
Every resource has a life: born on the first apply, checked on every plan, changed as the configuration evolves, and removed at the end. The plan is where you see the next step in that life before it happens, written in a small set of symbols.
The rule
Plus is born, tilde bends, minus-plus is reborn, minus dies.
The stages of a resource's life, and how the plan marks each:
| Symbol | Meaning |
|---|---|
+ |
create |
~ |
update in place |
-/+ |
replace: destroy the old, then create the new |
+/- |
replace: create the new, then destroy the old |
- |
destroy |
<= |
read (a data source) |
On every plan and apply, Terraform first refreshes: it asks the provider for the current real settings of each resource in state, so it compares your configuration with reality, not with an old memory.
A plan for Crumb's web server with a new image might show:
# aws_instance.web must be replaced
-/+ resource "aws_instance" "web" {
~ ami = "ami-0123456789abcdef0" -> "ami-0fedcba9876543210" # forces replacement
~ id = "i-0a1b2c3d4e5f67890" -> (known after apply)
instance_type = "t3.micro"
}
Plan: 1 to add, 0 to change, 1 to destroy.Note the summary: one replacement counts as one add and one destroy. (known after apply) means the value will only exist once the new object is created.
By default a replacement destroys first. For a live web server that means a gap with no server. The lifecycle setting create_before_destroy flips the order, shown as +/-; you will meet it with the meta-arguments.
The shortcut
Read the symbol first, then hunt for the reason. For ~, the changed lines are the story. For -/+, find the line tagged # forces replacement: that one argument is why the object dies.
Scan the symbols
One
+(a logs bucket), one~(tags on the assets bucket), one-/+(the web server).
The trap: reading "1 to destroy" as "something is being deleted for good". Check whether it is really a -/+ replacement before you panic, and whether it is a real deletion before you relax.
Drills
Answer fast — trust the rule.
What does ~ mean next to a resource in a plan?
A plan shows only one resource, marked -/+. What does the summary line say?
What does (known after apply) mean?
Which symbol means the new object is created before the old one is destroyed?
What does Terraform do first during a plan, before comparing?
Remember
+create,~update,-/+replace destroy-first,+/-replace create-first,-destroy.- Shortcut: read the symbol, then find the reason, especially
# forces replacement. - Trap: one replacement counts as both an add and a destroy.