terraform apply

What Is terraform apply?

terraform apply is the command that actually makes changes to your infrastructure. It calculates a fresh execution plan (or uses a saved one), shows you that plan, waits for your approval, then provisions your infrastructure.

terraform apply

Unlike terraform plan, which is always safe, apply has real side effects. It calls cloud APIs to create, update, or delete resources. Run plan and review the output carefully before every apply.

The Apply Flow

When you run terraform apply without a saved plan file:

1. Terraform calculates a fresh execution plan (same as running terraform plan)
2. Displays the plan with all changes
3. Asks for confirmation:

   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes
   

4. Applies the changes: creates, updates, or destroys resources
5. Updates the state file with the new infrastructure state
6. Prints outputs if you have output blocks defined

You must type exactly yes to proceed. Typing y, Y, or anything else cancels the apply.

Real-Time Apply Output

As Terraform applies changes, it prints real-time status:

aws_vpc.main: Creating...
aws_vpc.main: Creation complete after 2s [id=vpc-0a1b2c3d4e5f]
aws_subnet.public: Creating...
aws_subnet.public: Creation complete after 1s [id=subnet-0abc123]
aws_internet_gateway.main: Creating...
aws_internet_gateway.main: Creation complete after 1s [id=igw-0xyz789]
aws_security_group.web: Creating...
aws_security_group.web: Creation complete after 3s [id=sg-0def456]
aws_instance.web: Creating...
aws_instance.web: Still creating... [10s elapsed]
aws_instance.web: Still creating... [20s elapsed]
aws_instance.web: Creation complete after 23s [id=i-0abc12345def67890]

Apply complete! Resources: 5 added, 0 changed, 0 destroyed.

Outputs:
  instance_public_ip = "54.123.45.67"
  vpc_id             = "vpc-0a1b2c3d4e5f"

Notice how Terraform creates resources in dependency order, the VPC first, then subnets, then the internet gateway, then the security group, then the instance.

Parallel Execution

Terraform does not apply changes sequentially. It builds a dependency graph from your configuration and runs independent resources in parallel: up to 10 at a time by default:

aws_s3_bucket.logs: Creating...       ← no dependencies, starts immediately
aws_s3_bucket.assets: Creating...     ← no dependencies, starts immediately
aws_vpc.main: Creating...             ← no dependencies, starts immediately
aws_s3_bucket.logs: Creation complete after 2s
aws_s3_bucket.assets: Creation complete after 2s
aws_vpc.main: Creation complete after 2s
aws_subnet.public: Creating...        ← depends on VPC, starts after VPC

To change the parallelism limit:

terraform apply -parallelism=5

You can also disable parallelism completely (rarely needed):

terraform apply -parallelism=1

Applying a Saved Plan

When you saved a plan with terraform plan -out=tfplan, apply it directly:

terraform apply tfplan

When applying a saved plan:

• No confirmation prompt is shown, the plan was already reviewed
• No fresh calculation: Terraform uses exactly the plan that was saved
• If infrastructure changed between plan and apply, Terraform will error and ask you to re-plan

This is the recommended production workflow and the standard CI/CD pattern.

Auto-Approve for CI/CD

In automated pipelines, you cannot have an interactive approval prompt. Skip it with -auto-approve:

terraform apply -auto-approve

Important: Only use -auto-approve in CI/CD pipelines with proper code review and branch protection. Never use it interactively on production infrastructure, you lose the safety check.

A complete GitLab CI apply stage:

apply:
  stage: apply
  script:
    - terraform init -input=false
    - terraform apply -input=false -auto-approve
  when: manual         # Requires a human to click "Play" in GitLab
  environment: production

Note the when: manual, even with -auto-approve, the CI job itself requires a human to trigger it. This gives you both automation and a human gate.

Accessing Outputs After Apply

After apply completes, view your declared outputs:

# Show all outputs
terraform output

# Show a specific output
terraform output instance_public_ip

# Get output as JSON (useful in scripts)
terraform output -json

Example output block in your Terraform config:

output "instance_public_ip" {
  description = "Public IP of the web server"
  value       = aws_instance.web.public_ip
}

Targeting a Specific Resource

Just like plan, you can apply to a specific resource only:

terraform apply -target=aws_instance.web

Warning: Using -target can leave your state inconsistent. Dependencies of the targeted resource will not be created/updated. Use only for emergencies or debugging.

What Happens to State During Apply

Every time apply succeeds, Terraform updates the state file (terraform.tfstate) to record what it built. The state file contains:

• Resource IDs from the cloud provider (e.g., i-0abc123 for an EC2 instance)
• All attribute values Terraform tracks
• Dependencies between resources

This is why apply is idempotent, if you run it again without changing your config, plan will show no changes and apply will do nothing.

Handling Apply Errors

If an error occurs mid-apply, Terraform:

1. Stops the apply for the failed resource
2. Continues applying resources that don't depend on the failed one
3. Updates state with what was successfully created

You will see something like:

╷
│ Error: error creating EC2 Instance: InvalidParameterValue: Invalid value for InstanceType
│   with aws_instance.web,
│   on main.tf line 10
│
│ aws_instance.web: Creation failed after 2s
╵

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.
Error: 1 error occurred.

After fixing the error, run terraform plan again to see the remaining changes, then terraform apply again. Terraform won't try to recreate resources that were already successfully created.

---

Knowledge Check