Day 115: Terraform modules, plan/apply, drift
Modules: reusable infrastructure components
A module packages a group of resources behind a reusable interface — a "VPC module" that takes a CIDR block and subnet count as input and outputs the created subnet IDs, usable across multiple environments without copy-pasting the underlying resources each time (the same reuse motivation as a Helm chart, Phase 12).
Plan and apply
terraform plan shows exactly what would change — resources to create, modify, or destroy — without making any changes. terraform apply executes that plan. Reviewing a plan before applying (especially in CI, requiring human approval on apply) is the single most important safety habit in infrastructure-as-code.
terraform plan -out=tfplan
# review the plan output carefully
terraform apply tfplanDrift
Drift is when real infrastructure diverges from what Terraform's state believes it manages — someone manually changed a security group rule in the AWS console, for instance. terraform plan will show this as a change it "needs" to make (reverting the manual edit) — the exact same self-heal problem GitOps (Phase 13) solves for Kubernetes, here applied to cloud infrastructure.
Key terms
- Terraform module
- A reusable, parameterized package of resources.
- Drift
- Divergence between real infrastructure and what Terraform's state expects.
terraform plan unexpectedly shows it wants to revert a security group rule you didn't touch in code. What likely happened?
