Plan¶

So it's time to actually start executing our Terraform code.

Terraform lets us generate a plan and save it to a file for use later on and that's what we're going to do here.

We're going to produce a plan file called latest.plan. This file will be used in the next section to make sure our changes go through to AWS and our state file is updated and stored in GitLab's Terraform remote state storage engine.

Note

Make sure you've gone over the previous section which covers running terraform init. Without an initialised environment you can't plan, apply or destroy anything.

Executing¶

Let's execute our command:

terraform plan -out latest.plan

And give it time to process. You'll eventually get something along these lines (I've omitted nothing here):

$ terraform plan -out latest.plan
Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_acm_certificate.cert will be created
  + resource "aws_acm_certificate" "cert" {
      + arn                       = (known after apply)
      + domain_name               = "httpcats.net"
      + domain_validation_options = [
          + {
              + domain_name           = "httpcats.net"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
          + {
              + domain_name           = "www.httpcats.net"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      + id                        = (known after apply)
      + status                    = (known after apply)
      + subject_alternative_names = [
          + "www.httpcats.net",
        ]
      + tags_all                  = (known after apply)
      + validation_emails         = (known after apply)
      + validation_method         = "DNS"
    }

  # aws_acm_certificate_validation.cert will be created
  + resource "aws_acm_certificate_validation" "cert" {
      + certificate_arn         = (known after apply)
      + id                      = (known after apply)
      + validation_record_fqdns = (known after apply)
    }

  # aws_alb.httpcats will be created
  + resource "aws_alb" "httpcats" {
      + arn                        = (known after apply)
      + arn_suffix                 = (known after apply)
      + dns_name                   = (known after apply)
      + drop_invalid_header_fields = false
      + enable_deletion_protection = false
      + enable_http2               = true
      + id                         = (known after apply)
      + idle_timeout               = 60
      + internal                   = (known after apply)
      + ip_address_type            = (known after apply)
      + load_balancer_type         = "application"
      + name                       = "httpcats-beta"
      + security_groups            = (known after apply)
      + subnets                    = (known after apply)
      + tags                       = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "HTTP DevOps Cats HTTP ALB"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                   = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "HTTP DevOps Cats HTTP ALB"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id                     = (known after apply)
      + zone_id                    = (known after apply)

      + subnet_mapping {
          + allocation_id        = (known after apply)
          + ipv6_address         = (known after apply)
          + outpost_id           = (known after apply)
          + private_ipv4_address = (known after apply)
          + subnet_id            = (known after apply)
        }
    }

  # aws_alb_listener.http will be created
  + resource "aws_alb_listener" "http" {
      + arn               = (known after apply)
      + certificate_arn   = (known after apply)
      + id                = (known after apply)
      + load_balancer_arn = (known after apply)
      + port              = 443
      + protocol          = "HTTPS"
      + ssl_policy        = (known after apply)
      + tags_all          = (known after apply)

      + default_action {
          + order = (known after apply)
          + type  = "fixed-response"

          + fixed_response {
              + content_type = "text/plain"
              + message_body = "Meow?"
              + status_code  = "404"
            }
        }
    }

  # aws_alb_target_group.cats will be created
  + resource "aws_alb_target_group" "cats" {
      + arn                                = (known after apply)
      + arn_suffix                         = (known after apply)
      + deregistration_delay               = 300
      + id                                 = (known after apply)
      + lambda_multi_value_headers_enabled = false
      + load_balancing_algorithm_type      = (known after apply)
      + name                               = "httpcats-web-servers"
      + port                               = 8080
      + preserve_client_ip                 = (known after apply)
      + protocol                           = "HTTP"
      + protocol_version                   = (known after apply)
      + proxy_protocol_v2                  = false
      + slow_start                         = 0
      + tags                               = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "HTTP DevOps Cats HTTP Servers"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                           = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "HTTP DevOps Cats HTTP Servers"
          + "Solution"    = "HTTP Cats"
        }
      + target_type                        = "instance"
      + vpc_id                             = (known after apply)

      + health_check {
          + enabled             = (known after apply)
          + healthy_threshold   = (known after apply)
          + interval            = (known after apply)
          + matcher             = (known after apply)
          + path                = (known after apply)
          + port                = (known after apply)
          + protocol            = (known after apply)
          + timeout             = (known after apply)
          + unhealthy_threshold = (known after apply)
        }

      + stickiness {
          + cookie_duration = (known after apply)
          + enabled         = (known after apply)
          + type            = (known after apply)
        }
    }

  # aws_eip.meow_1 will be created
  + resource "aws_eip" "meow_1" {
      + allocation_id        = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = (known after apply)
      + id                   = (known after apply)
      + instance             = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags_all             = (known after apply)
      + vpc                  = true
    }

  # aws_eip.meow_2 will be created
  + resource "aws_eip" "meow_2" {
      + allocation_id        = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = (known after apply)
      + id                   = (known after apply)
      + instance             = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags_all             = (known after apply)
      + vpc                  = true
    }

  # aws_instance.meow_1 will be created
  + resource "aws_instance" "meow_1" {
      + ami                                  = "ami-0a43280cfb87ffdba"
      + arn                                  = (known after apply)
      + associate_public_ip_address          = (known after apply)
      + availability_zone                    = (known after apply)
      + cpu_core_count                       = (known after apply)
      + cpu_threads_per_core                 = (known after apply)
      + get_password_data                    = false
      + host_id                              = (known after apply)
      + id                                   = (known after apply)
      + instance_initiated_shutdown_behavior = (known after apply)
      + instance_state                       = (known after apply)
      + instance_type                        = "t2.micro"
      + ipv6_address_count                   = (known after apply)
      + ipv6_addresses                       = (known after apply)
      + key_name                             = "deployment-key"
      + outpost_arn                          = (known after apply)
      + password_data                        = (known after apply)
      + placement_group                      = (known after apply)
      + primary_network_interface_id         = (known after apply)
      + private_dns                          = (known after apply)
      + private_ip                           = (known after apply)
      + public_dns                           = (known after apply)
      + public_ip                            = (known after apply)
      + secondary_private_ips                = (known after apply)
      + security_groups                      = (known after apply)
      + source_dest_check                    = true
      + subnet_id                            = (known after apply)
      + tags                                 = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats-meow-1"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                             = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats-meow-1"
          + "Solution"    = "HTTP Cats"
        }
      + tenancy                              = (known after apply)
      + vpc_security_group_ids               = (known after apply)

      + capacity_reservation_specification {
          + capacity_reservation_preference = (known after apply)

          + capacity_reservation_target {
              + capacity_reservation_id = (known after apply)
            }
        }

      + ebs_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + snapshot_id           = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }

      + enclave_options {
          + enabled = (known after apply)
        }

      + ephemeral_block_device {
          + device_name  = (known after apply)
          + no_device    = (known after apply)
          + virtual_name = (known after apply)
        }

      + metadata_options {
          + http_endpoint               = (known after apply)
          + http_put_response_hop_limit = (known after apply)
          + http_tokens                 = (known after apply)
        }

      + network_interface {
          + delete_on_termination = (known after apply)
          + device_index          = (known after apply)
          + network_interface_id  = (known after apply)
        }

      + root_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }
    }

  # aws_instance.meow_2 will be created
  + resource "aws_instance" "meow_2" {
      + ami                                  = "ami-0a43280cfb87ffdba"
      + arn                                  = (known after apply)
      + associate_public_ip_address          = (known after apply)
      + availability_zone                    = (known after apply)
      + cpu_core_count                       = (known after apply)
      + cpu_threads_per_core                 = (known after apply)
      + get_password_data                    = false
      + host_id                              = (known after apply)
      + id                                   = (known after apply)
      + instance_initiated_shutdown_behavior = (known after apply)
      + instance_state                       = (known after apply)
      + instance_type                        = "t2.micro"
      + ipv6_address_count                   = (known after apply)
      + ipv6_addresses                       = (known after apply)
      + key_name                             = "deployment-key"
      + outpost_arn                          = (known after apply)
      + password_data                        = (known after apply)
      + placement_group                      = (known after apply)
      + primary_network_interface_id         = (known after apply)
      + private_dns                          = (known after apply)
      + private_ip                           = (known after apply)
      + public_dns                           = (known after apply)
      + public_ip                            = (known after apply)
      + secondary_private_ips                = (known after apply)
      + security_groups                      = (known after apply)
      + source_dest_check                    = true
      + subnet_id                            = (known after apply)
      + tags                                 = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats-meow-2"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                             = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats-meow-2"
          + "Solution"    = "HTTP Cats"
        }
      + tenancy                              = (known after apply)
      + vpc_security_group_ids               = (known after apply)

      + capacity_reservation_specification {
          + capacity_reservation_preference = (known after apply)

          + capacity_reservation_target {
              + capacity_reservation_id = (known after apply)
            }
        }

      + ebs_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + snapshot_id           = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }

      + enclave_options {
          + enabled = (known after apply)
        }

      + ephemeral_block_device {
          + device_name  = (known after apply)
          + no_device    = (known after apply)
          + virtual_name = (known after apply)
        }

      + metadata_options {
          + http_endpoint               = (known after apply)
          + http_put_response_hop_limit = (known after apply)
          + http_tokens                 = (known after apply)
        }

      + network_interface {
          + delete_on_termination = (known after apply)
          + device_index          = (known after apply)
          + network_interface_id  = (known after apply)
        }

      + root_block_device {
          + delete_on_termination = (known after apply)
          + device_name           = (known after apply)
          + encrypted             = (known after apply)
          + iops                  = (known after apply)
          + kms_key_id            = (known after apply)
          + tags                  = (known after apply)
          + throughput            = (known after apply)
          + volume_id             = (known after apply)
          + volume_size           = (known after apply)
          + volume_type           = (known after apply)
        }
    }

  # aws_internet_gateway.httpcats will be created
  + resource "aws_internet_gateway" "httpcats" {
      + arn      = (known after apply)
      + id       = (known after apply)
      + owner_id = (known after apply)
      + tags     = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id   = (known after apply)
    }

  # aws_key_pair.httpcats will be created
  + resource "aws_key_pair" "httpcats" {
      + arn         = (known after apply)
      + fingerprint = (known after apply)
      + id          = (known after apply)
      + key_name    = "deployment-key"
      + key_pair_id = (known after apply)
      + public_key  = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx0zxU998xfSDPJsqmVr4xm1sOwC5H8MI5pU3EJTqv3jbZcbA79rS5Jb68cvKg2yc5a+GzJkSN88xyGEurw0BTjNH/saDWSepC8t3LaIrhDj8CYByLtBWznVvYfkBrUi2psUOUeCMUpXLbDR8uEdq7/EghME02iLZZcj8e3MtpR4wul3heLjvDN9XN6qxq8CG1Uy+P8aBnX6yAy55kZyZeWlpCjilFCy64zcJU+RjVzS8zURsV+hV8hLo9oQYnzA7ETvEyAZvQ7sBne3iK8Bs5l3yvZKnFnhlM2Soo1XUHm/HXt5sGTnf/IGkFLbL5mIUW9riZ1EtMa1DdnHTarHive1nwDQp4muRg+6FJS2xXV9bHrtzkY+1u0gG2mvyGVETLqxOIUN8NRfu6L/1vdtfN44XSVq5lVfWl79RZ+owKoTnKl+E63kSNfEiFf9V3edul3ttzhOHOr46ZVzbkOVds9xOv/oaItvCS6LB33dtFvXsGcuncEnT9gMGRBSOsVyk="
      + tags_all    = (known after apply)
    }

  # aws_lb_listener_rule.cats will be created
  + resource "aws_lb_listener_rule" "cats" {
      + arn          = (known after apply)
      + id           = (known after apply)
      + listener_arn = (known after apply)
      + priority     = 100
      + tags_all     = (known after apply)

      + action {
          + order            = (known after apply)
          + target_group_arn = (known after apply)
          + type             = "forward"
        }

      + condition {

          + path_pattern {
              + values = [
                  + "*",
                ]
            }
        }
    }

  # aws_lb_target_group_attachment.meow-a will be created
  + resource "aws_lb_target_group_attachment" "meow-a" {
      + id               = (known after apply)
      + target_group_arn = (known after apply)
      + target_id        = (known after apply)
    }

  # aws_lb_target_group_attachment.meow-b will be created
  + resource "aws_lb_target_group_attachment" "meow-b" {
      + id               = (known after apply)
      + target_group_arn = (known after apply)
      + target_id        = (known after apply)
    }

  # aws_route53_record.httpcats["httpcats.net"] will be created
  + resource "aws_route53_record" "httpcats" {
      + allow_overwrite = true
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 60
      + type            = (known after apply)
      + zone_id         = "Z07304002IQEID723SY3V"
    }

  # aws_route53_record.httpcats["www.httpcats.net"] will be created
  + resource "aws_route53_record" "httpcats" {
      + allow_overwrite = true
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 60
      + type            = (known after apply)
      + zone_id         = "Z07304002IQEID723SY3V"
    }

  # aws_route53_record.ssh-1 will be created
  + resource "aws_route53_record" "ssh-1" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "ssh-1"
      + records         = (known after apply)
      + ttl             = 300
      + type            = "A"
      + zone_id         = "Z07304002IQEID723SY3V"
    }

  # aws_route53_record.ssh-2 will be created
  + resource "aws_route53_record" "ssh-2" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "ssh-2"
      + records         = (known after apply)
      + ttl             = 300
      + type            = "A"
      + zone_id         = "Z07304002IQEID723SY3V"
    }

  # aws_route53_record.www will be created
  + resource "aws_route53_record" "www" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "www"
      + type            = "A"
      + zone_id         = "Z07304002IQEID723SY3V"

      + alias {
          + evaluate_target_health = true
          + name                   = (known after apply)
          + zone_id                = (known after apply)
        }
    }

  # aws_route_table.httpcats will be created
  + resource "aws_route_table" "httpcats" {
      + arn              = (known after apply)
      + id               = (known after apply)
      + owner_id         = (known after apply)
      + propagating_vgws = (known after apply)
      + route            = [
          + {
              + carrier_gateway_id         = ""
              + cidr_block                 = "0.0.0.0/0"
              + destination_prefix_list_id = ""
              + egress_only_gateway_id     = ""
              + gateway_id                 = (known after apply)
              + instance_id                = ""
              + ipv6_cidr_block            = ""
              + local_gateway_id           = ""
              + nat_gateway_id             = ""
              + network_interface_id       = ""
              + transit_gateway_id         = ""
              + vpc_endpoint_id            = ""
              + vpc_peering_connection_id  = ""
            },
        ]
      + tags             = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats Internet Route Table"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all         = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats Internet Route Table"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id           = (known after apply)
    }

  # aws_route_table_association.httpcats-http-az-a will be created
  + resource "aws_route_table_association" "httpcats-http-az-a" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # aws_route_table_association.httpcats-http-az-b will be created
  + resource "aws_route_table_association" "httpcats-http-az-b" {
      + id             = (known after apply)
      + route_table_id = (known after apply)
      + subnet_id      = (known after apply)
    }

  # aws_security_group.alb will be created
  + resource "aws_security_group" "alb" {
      + arn                    = (known after apply)
      + description            = "Manages all connections to the ALB"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "httpcats-alb"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "ALBs"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all               = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "ALBs"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id                 = (known after apply)
    }

  # aws_security_group.webserver will be created
  + resource "aws_security_group" "webserver" {
      + arn                    = (known after apply)
      + description            = "Manages all connections to the internal web servers"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "httpcats-webserver"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "Webservers"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all               = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "Webservers"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id                 = (known after apply)
    }

  # aws_security_group_rule.alb-https will be created
  + resource "aws_security_group_rule" "alb-https" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "HTTPS"
      + from_port                = 443
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 443
      + type                     = "ingress"
    }

  # aws_security_group_rule.egress_all will be created
  + resource "aws_security_group_rule" "egress_all" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "All"
      + from_port                = -1
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = -1
      + type                     = "egress"
    }

  # aws_security_group_rule.http-custom will be created
  + resource "aws_security_group_rule" "http-custom" {
      + cidr_blocks              = [
          + "10.1.1.0/24",
        ]
      + description              = "custom http port"
      + from_port                = 8080
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 8080
      + type                     = "ingress"
    }

  # aws_security_group_rule.ssh will be created
  + resource "aws_security_group_rule" "ssh" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "ssh"
      + from_port                = 22
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + security_group_id        = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 22
      + type                     = "ingress"
    }

  # aws_security_group_rule.webserver-egress will be created
  + resource "aws_security_group_rule" "webserver-egress" {
      + cidr_blocks              = [
          + "0.0.0.0/0",
        ]
      + description              = "All"
      + from_port                = -1
      + id                       = (known after apply)
      + protocol                 = "-1"
      + security_group_id        = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = -1
      + type                     = "egress"
    }

  # aws_subnet.httpcats-http-az-a will be created
  + resource "aws_subnet" "httpcats-http-az-a" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = false
      + availability_zone               = "ap-southeast-2a"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.1.1.0/27"
      + id                              = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats AZ A"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                        = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats AZ A"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id                          = (known after apply)
    }

  # aws_subnet.httpcats-http-az-b will be created
  + resource "aws_subnet" "httpcats-http-az-b" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = false
      + availability_zone               = "ap-southeast-2b"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.1.1.32/27"
      + id                              = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats AZ B"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                        = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats AZ B"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id                          = (known after apply)
    }

  # aws_vpc.httpcats will be created
  + resource "aws_vpc" "httpcats" {
      + arn                              = (known after apply)
      + assign_generated_ipv6_cidr_block = false
      + cidr_block                       = "10.1.1.0/24"
      + default_network_acl_id           = (known after apply)
      + default_route_table_id           = (known after apply)
      + default_security_group_id        = (known after apply)
      + dhcp_options_id                  = (known after apply)
      + enable_classiclink               = (known after apply)
      + enable_classiclink_dns_support   = (known after apply)
      + enable_dns_hostnames             = (known after apply)
      + enable_dns_support               = true
      + id                               = (known after apply)
      + instance_tenancy                 = "default"
      + ipv6_association_id              = (known after apply)
      + ipv6_cidr_block                  = (known after apply)
      + main_route_table_id              = (known after apply)
      + owner_id                         = (known after apply)
      + tags                             = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                         = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats"
          + "Solution"    = "HTTP Cats"
        }
    }

Plan: 32 to add, 0 to change, 0 to destroy.

────────────────────────────────────────────

Saved the plan to: latest.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "latest.plan"

That's a lot of output. Let's review the parts of it that are important to us.

Symbols¶

We can see at the top of the file we get the following output:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

When we review the output from a terraform command execution, the plan will use various symbols, colours and other visual aides to help you review the output and determine what is going to happen if you apply the plan.

These visual "clues" are helpful but do ensure you're reading the output carefully. You should be certain you're happy with all the changes being made.

We'll talk about these visual aides a bit more next.

Actions¶

Next our output contains all the actions Terraform will perform. At this point in time, because we're building everything from scratch and have not made any changes, we're creating everything. Nothing is being updated or deleted, so the actions being performed are simple.

Here's a few of the actions from the output above:

  # aws_subnet.httpcats-http-az-b will be created
  + resource "aws_subnet" "httpcats-http-az-b" {
      + arn                             = (known after apply)
      + assign_ipv6_address_on_creation = false
      + availability_zone               = "ap-southeast-2b"
      + availability_zone_id            = (known after apply)
      + cidr_block                      = "10.1.1.32/27"
      + id                              = (known after apply)
      + ipv6_cidr_block_association_id  = (known after apply)
      + map_public_ip_on_launch         = false
      + owner_id                        = (known after apply)
      + tags                            = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats AZ B"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                        = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats AZ B"
          + "Solution"    = "HTTP Cats"
        }
      + vpc_id                          = (known after apply)
    }

  # aws_vpc.httpcats will be created
  + resource "aws_vpc" "httpcats" {
      + arn                              = (known after apply)
      + assign_generated_ipv6_cidr_block = false
      + cidr_block                       = "10.1.1.0/24"
      + default_network_acl_id           = (known after apply)
      + default_route_table_id           = (known after apply)
      + default_security_group_id        = (known after apply)
      + dhcp_options_id                  = (known after apply)
      + enable_classiclink               = (known after apply)
      + enable_classiclink_dns_support   = (known after apply)
      + enable_dns_hostnames             = (known after apply)
      + enable_dns_support               = true
      + id                               = (known after apply)
      + instance_tenancy                 = "default"
      + ipv6_association_id              = (known after apply)
      + ipv6_cidr_block                  = (known after apply)
      + main_route_table_id              = (known after apply)
      + owner_id                         = (known after apply)
      + tags                             = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats"
          + "Solution"    = "HTTP Cats"
        }
      + tags_all                         = {
          + "Contact"     = "Michael Crilly mike@opsfactory.com.au"
          + "Environment" = "MVP"
          + "Name"        = "httpcats"
          + "Solution"    = "HTTP Cats"
        }
    }

Because the plan files contains the + symbol on every line we can be assured that this means Terraform is adding that resource and its properties. For example the aws_vpc.httpcats resource is being created (+) and the property cidr_block is being added and set to 10.1.1.0/24.

Summary¶

At the bottom of the entire output we have something very useful: a summary.

Plan: 32 to add, 0 to change, 0 to destroy.

This might seem like a simple quality of life improvement but I can almost guarantee you'll use this simple, single line summary a lot.

When you're making changes to your code and executing plan (or going straight to apply, which does a plan behind the scenes for you), you'll have a very good idea of what should be changing and how many resources should be affected by those changes. Especially as time goes on and you get more experienced. As a result of this you'll find yourself glancing at the summary and provided it aligns with your expectations this will be sufficient validation and you'll approve the change.

I recommend trying to get into the habit of always reviewing every line in the plan before executing it.

The File¶

Finally we end up with a latest.plan file. This file is a binary file and cannot be simply viewed in a text editor. If you do want to view it, you can convert it to JSON:

terraform show latest.plan -json

This simply gives you the exact same output as what we have above but it's useful if you want to store the plan and share it with someone else because they can use this command to review it directly without having to run terraform plan again.

We'll use this file in the next section.

Note

We don't have to save this file long term, such as in the git repository, at this point in time. We're just using it locally so we can get to grips with various Terraform commands and operations.

Next Steps¶

Now we're going to use our latest.plan file and actually create some infrastructure.