Terraform Apply

Terraform hub

The terraform apply command executes the changes shown in a plan — creating, updating, or destroying real infrastructure to match your Terraform configuration. It updates the state file after each successful change.

What Is Terraform Apply?

Terraform apply is the command that makes real changes. It takes the plan Terraform calculated, executes each action against the cloud provider API, and updates the state file to record what was created. Everything before apply is just reading and planning — apply is where infrastructure actually changes.

At Swiggy, terraform apply only runs from a CI/CD pipeline after a pull request is reviewed and approved. No engineer runs apply directly from a laptop against production.

Running Terraform Apply

Bash

# Interactive apply — shows plan, asks for confirmation
terraform apply
 
# Apply a saved plan file — no re-evaluation, no confirmation prompt
terraform apply tfplan.binary
 
# Non-interactive apply — skips confirmation (use in CI/CD only)
terraform apply -auto-approve
 
# Apply with a specific variable file
terraform apply -var-file=prod.tfvars
 
# Apply targeting one specific resource (use sparingly)
terraform apply -target=aws_s3_bucket.order_images

What Happens During Apply

◈ DIAGRAM

+------------------------------------------+
| 1. Re-evaluate plan (unless using -out)  |
+------------------------------------------+
                    |
                    v
+------------------------------------------+
| 2. Show diff and ask for confirmation    |
+------------------------------------------+
                    |
                    v
+------------------------------------------+
| 3. Execute changes against cloud API     |
| (parallel where dependencies allow)     |
+------------------------------------------+
                    |
                    v
+------------------------------------------+
| 4. Update state file after each change   |
+------------------------------------------+

Apply Output

Bash

aws_s3_bucket.order_images: Creating...
aws_s3_bucket.order_images: Creation complete after 3s [id=swiggy-order-images-prod]
aws_instance.web: Creating...
aws_instance.web: Still creating... [10s elapsed]
aws_instance.web: Creation complete after 23s [id=i-0a1b2c3d4e5f]
 
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
 
Outputs:
 
instance_ip = "10.0.1.50"
bucket_arn  = "arn:aws:s3:::swiggy-order-images-prod"

Partial Apply Failures

If apply fails halfway through, Terraform saves the state for everything that succeeded. The state file will not be empty — it will contain the resources that were created before the failure.

Bash

# After a partial failure:
terraform state list           # see what was created
terraform plan                 # see what still needs to be done
terraform apply                # continue — only applies remaining changes

Parallelism

Terraform creates independent resources in parallel by default (10 at a time). You can control this:

Bash

# Reduce parallelism if hitting API rate limits
terraform apply -parallelism=5
 
# Serialize all operations (slowest, most safe)
terraform apply -parallelism=1

Targeted Apply — Use With Caution

Bash

# Apply only one specific resource
terraform apply -target=aws_s3_bucket.order_images
 
# WARNING: -target skips dependency checks
# Only use for emergency fixes — always run a full apply after

Security
Never use -auto-approve in production without a human review step. In CI/CD, run terraform plan -out=tfplan in the PR stage and terraform apply tfplan in the merge stage — the saved plan ensures exactly what was reviewed gets applied.

Troubleshooting Apply

Error	Cause	Fix
`Error: Error acquiring the state lock`	Another apply running or crashed	Wait or `terraform force-unlock <lock-id>`
`Error: creating S3 Bucket: BucketAlreadyExists`	Bucket name taken globally	Choose a unique bucket name
`Error: Unsupported argument`	Provider version mismatch	Run `terraform init -upgrade`
Apply succeeds but resource not visible	Resource in different region	Check provider `region` argument

Common Mistake
Running terraform apply from your laptop against production with your personal AWS credentials. When the apply fails halfway and you close your laptop, the state lock may remain and block the next apply. Use CI/CD pipelines where the apply runs to completion in a controlled environment.

Frequently Asked Questions

Does terraform apply always show a plan first, or can it apply blindly?

By default, running `terraform apply` with no arguments generates a fresh plan and prompts you to type 'yes' to confirm before making any changes — it doesn't apply blindly. You can skip that confirmation with `-auto-approve` (common in CI/CD pipelines where a human already approved the plan output in an earlier stage) or apply a specific saved plan file generated by a prior `terraform plan -out=tfplan` to guarantee exactly what was reviewed is what gets applied.

What's a common production mistake with terraform apply in CI/CD pipelines?

Running `terraform plan` and `terraform apply` as two separate steps without passing the exact plan file between them — between those two commands, the real infrastructure or someone else's concurrent change can shift, so the apply silently re-plans and may do something different from what was reviewed. Always generate a plan file with `-out`, review it, then apply that specific file, not a fresh implicit plan.