Exercise 10 ยท 50 minutes

Make change predictable

Read Terraform's dependency graph, distinguish update from replacement, apply only a reviewed saved plan, and prepare a destruction plan without executing it.

ModulePlan and applyAzure costNone expectedCreatesDependency marker

Before you start

Goal and prerequisites

Your goal

Predict each proposed action before apply and explain why Terraform orders dependent resources.

You need

  • The remote-state sandbox from Exercise 8
  • Exercise 9 completed
  • A no-change baseline plan
  • Your identity resource address
  • No uncommitted unrelated changes

Participant task

Predict before applying

  1. 01

    Establish a clean baseline

    Format, validate, and confirm Terraform reports no changes. Stop if the baseline differs from Azure.

    terraform fmt -check
    terraform validate
    terraform plan
  2. 02

    Add an explicit consumer

    Add a terraform_data resource whose input uses the managed identity's principal ID and name. Predict the dependency edge this reference creates.

  3. 03

    Inspect the graph and plan

    Generate the graph, locate the dependency, then save a plan. Explain why Terraform can determine creation order without depends_on.

    terraform graph
    terraform plan -out main.tfplan
  4. 04

    Compare update and replacement

    Change a tag and identify the in-place update. Separately create a speculative plan with -replace for the identity. Do not apply the replacement plan; explain its downstream effect and delete that plan file.

    terraform plan -replace=<identity-resource-address>
  5. 05

    Apply and prepare cleanup

    Apply only the reviewed normal plan. Then save a destruction plan and review its order without applying it.

    terraform apply main.tfplan
    terraform plan -destroy -out destroy.tfplan
    terraform show destroy.tfplan

Expected outcome

Explain every action

Validation

  • The graph contains the inferred dependency.
  • The normal plan avoids identity replacement.
  • The saved plan applies successfully.
  • The destruction plan is reviewed but not applied.

Optional extension

Add a precondition that rejects a missing required tag, then observe whether the failure occurs during validation or planning.

Finish

Delete plans, retain resources

Delete local binary plan files, commit the configuration, and keep the sandbox for the module refactor.