github.com/loicalbertin/terraform@v0.6.15-0.20170626182346-8e2583055467/website/docs/commands/plan.html.markdown (about) 1 --- 2 layout: "docs" 3 page_title: "Command: plan" 4 sidebar_current: "docs-commands-plan" 5 description: |- 6 The `terraform plan` command is used to create an execution plan. Terraform performs a refresh, unless explicitly disabled, and then determines what actions are necessary to achieve the desired state specified in the configuration files. The plan can be saved using `-out`, and then provided to `terraform apply` to ensure only the pre-planned actions are executed. 7 --- 8 9 # Command: plan 10 11 The `terraform plan` command is used to create an execution plan. Terraform 12 performs a refresh, unless explicitly disabled, and then determines what 13 actions are necessary to achieve the desired state specified in the 14 configuration files. The plan can be saved using `-out`, and then provided 15 to `terraform apply` to ensure only the pre-planned actions are executed. 16 17 ## Usage 18 19 Usage: `terraform plan [options] [dir-or-plan]` 20 21 By default, `plan` requires no flags and looks in the current directory 22 for the configuration and state file to refresh. 23 24 If the command is given an existing saved plan as an argument, the 25 command will output the contents of the saved plan. In this scenario, 26 the `plan` command will not modify the given plan. This can be used to 27 inspect a planfile. 28 29 The command-line flags are all optional. The list of available flags are: 30 31 * `-destroy` - If set, generates a plan to destroy all the known resources. 32 33 * `-detailed-exitcode` - Return a detailed exit code when the command exits. 34 When provided, this argument changes the exit codes and their meanings to 35 provide more granular information about what the resulting plan contains: 36 * 0 = Succeeded with empty diff (no changes) 37 * 1 = Error 38 * 2 = Succeeded with non-empty diff (changes present) 39 40 * `-input=true` - Ask for input for variables if not directly set. 41 42 * `-lock=true` - Lock the state file when locking is supported. 43 44 * `-lock-timeout=0s` - Duration to retry a state lock. 45 46 * `-module-depth=n` - Specifies the depth of modules to show in the output. 47 This does not affect the plan itself, only the output shown. By default, 48 this is -1, which will expand all. 49 50 * `-no-color` - Disables output with coloring. 51 52 * `-out=path` - The path to save the generated execution plan. This plan 53 can then be used with `terraform apply` to be certain that only the 54 changes shown in this plan are applied. Read the warning on saved 55 plans below. 56 57 * `-parallelism=n` - Limit the number of concurrent operation as Terraform 58 [walks the graph](/docs/internals/graph.html#walking-the-graph). 59 60 * `-refresh=true` - Update the state prior to checking for differences. 61 62 * `-state=path` - Path to the state file. Defaults to "terraform.tfstate". 63 Ignored when [remote state](/docs/state/remote.html) is used. 64 65 * `-target=resource` - A [Resource 66 Address](/docs/internals/resource-addressing.html) to target. This flag can 67 be used multiple times. See below for more information. 68 69 * `-var 'foo=bar'` - Set a variable in the Terraform configuration. This flag 70 can be set multiple times. Variable values are interpreted as 71 [HCL](/docs/configuration/syntax.html#HCL), so list and map values can be 72 specified via this flag. 73 74 * `-var-file=foo` - Set variables in the Terraform configuration from 75 a [variable file](/docs/configuration/variables.html#variable-files). If 76 "terraform.tfvars" is present, it will be automatically loaded first. Any 77 files specified by `-var-file` override any values in a "terraform.tfvars". 78 This flag can be used multiple times. 79 80 ## Resource Targeting 81 82 The `-target` option can be used to focus Terraform's attention on only a 83 subset of resources. 84 [Resource Address](/docs/internals/resource-addressing.html) syntax is used 85 to specify the constraint. The resource address is interpreted as follows: 86 87 * If the given address has a _resource spec_, only the specified resource 88 is targeted. If the named resource uses `count` and no explicit index 89 is specified in the address, all of the instances sharing the given 90 resource name are targeted. 91 92 * The the given address _does not_ have a resource spec, and instead just 93 specifies a module path, the target applies to all resources in the 94 specified module _and_ all of the descendent modules of the specified 95 module. 96 97 This targeting capability is provided for exceptional circumstances, such 98 as recovering from mistakes or working around Terraform limitations. It 99 is *not recommended* to use `-target` for routine operations, since this can 100 lead to undetected configuration drift and confusion about how the true state 101 of resources relates to configuration. 102 103 Instead of using `-target` as a means to operate on isolated portions of very 104 large configurations, prefer instead to break large configurations into 105 several smaller configurations that can each be independently applied. 106 [Data sources](/docs/configuration/data-sources.html) can be used to access 107 information about resources created in other configurations, allowing 108 a complex system architecture to be broken down into more managable parts 109 that can be updated independently. 110 111 ## Security Warning 112 113 Saved plan files (with the `-out` flag) encode the configuration, 114 state, diff, and _variables_. Variables are often used to store secrets. 115 Therefore, the plan file can potentially store secrets. 116 117 Terraform itself does not encrypt the plan file. It is highly 118 recommended to encrypt the plan file if you intend to transfer it 119 or keep it at rest for an extended period of time. 120 121 Future versions of Terraform will make plan files more 122 secure.