Terraform 6: Reading a plan diff (+ / ~ / -)
easy⏱ 5 mincourseterraform
The four action symbols
In a plan, each resource is prefixed: + create, ~ update in place, - destroy, and -/+ destroy-then-create (replacement). The bottom summary line — Plan: X to add, Y to change, Z to destroy — is what you scan first in a review.
# azurerm_storage_account.orders will be created
+ resource "azurerm_storage_account" "orders" {
+ name = "myorgordersdev"
+ account_tier = "Standard"
+ account_replication_type = "LRS"
}
# azurerm_resource_group.orders will be updated in-place
~ resource "azurerm_resource_group" "orders" {
~ tags = {
~ "env" = "development" -> "dev"
}
}
Plan: 1 to add, 1 to change, 0 to destroy.
Watch for -/+ replacements
~ mutates in place (cheap, safe). -/+ destroys and recreates — for stateful resources like a storage account or database that can mean data loss or downtime. Terraform annotates the culprit with # forces replacement; always read those lines before approving.
# azurerm_storage_account.orders must be replaced
-/+ resource "azurerm_storage_account" "orders" {
~ name = "myorgordersdev" -> "myorgordersdev2" # forces replacement
}
Plan: 1 to add, 0 to change, 1 to destroy.
The summary is a contract
Never approve a plan whose summary counts surprise you. 1 to add on a new resource is expected; 3 to destroy when you only edited a tag is a red flag — usually a changed for_each key or a renamed resource. The numbers must match your intent exactly.
Tally a plan diff
Given changes: Array<"+" | "~" | "-">, write summarize(changes) that returns "Plan: A to add, C to change, D to destroy." counting +, ~, - respectively. Log summarize of the provided sample.