Interview › Infrastructure as Code (Terraform, Ansible)
What is the purpose of terraform plan -out and applying a saved plan?
Infrastructure as Code (Terraform, Ansible) · Basic level
Answer
terraform plan -out writes an exact saved execution plan. Applying that saved plan ensures the approved actions are the actions that execute, instead of recalculating a different plan later. It is useful in CI/CD because reviewers approve a concrete artifact before apply.
Technical explanation
A saved plan includes variable values and provider decisions at plan time; treat it as sensitive.
Do not edit configuration between saved plan and apply unless you generate a new plan.
Saved plans are useful for audit trails because the approval references a concrete artifact.
Keep Terraform's ownership boundary clear: one state should own a resource or field, and other tools should consume published outputs instead of modifying it.
Use fmt, validate, linting, policy checks, plan review, and state locking before production applies.
Design for small blast radius by splitting state around lifecycle, permissions, and recovery boundaries.
Hands-on example
1. Create a CI job that generates and publishes a saved plan artifact.
2. Run:
terraform init
terraform plan -out=tfplan
terraform show -no-color tfplan > tfplan.txt
terraform show -json tfplan > tfplan.json
3. Require reviewers to inspect tfplan.txt or a summarized PR comment before approving.
4. In the protected apply job, download the exact artifact and run terraform apply tfplan, not a fresh unreviewed apply.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Infrastructure as Code (Terraform, Ansible) interview questions
- What is Infrastructure as Code, and what problems does it solve over click-ops?
- What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
- What is the difference between configuration management and provisioning?
- What is Terraform, and what is the core plan/apply workflow?
- What does terraform init do?
- What is the Terraform state file, and why is it critical?
- Why should state be stored remotely, and what backend would you use on AWS?
- What is state locking, and why does it matter for teams?