Suppose someone changes infrastructure outside Terraform. The stored state may no longer match what exists. Run `terraform plan -refresh-only` to inspect that difference without planning changes to the infrastructure. Normal and destroy plans also refresh state, but they can follow the refresh with other planned actions. section 5.3.1
A configuration change is not the target
Changing the organization name in a TLS configuration would normally affect the plan. With refresh-only mode, Terraform ignores that configuration change and concentrates on refreshing state. section 5.3.5
Choose the command according to what you need to do:
- Use `terraform plan -refresh-only` to inspect a refresh when you suspect manual changes or state drift. section 5.3.1
- Use `terraform apply -refresh-only` when you want to update state without updating resources; it shows the proposed changes and asks for approval. section 5.3.5
- Avoid substituting `terraform refresh` for that approval workflow. If provider credentials have expired, a failed lookup could cause resources to be removed from state, leading a later run to try creating them again. section 5.3.5
Not every drifted attribute needs an infrastructure change. If an attribute changes automatically and the difference causes no problem, a refresh-only plan can help reconcile Terraform’s view of it. For attributes that should remain outside Terraform’s updates, consider the `ignore_changes` lifecycle rule instead. section 6.6.3
Listing 5.5 Refresh-only plan
$ terraform plan -refresh-only #1
tls_private_key.ca_key: Refreshing state... #2
[id=4c9b44687d30a59610287574ea4efccbfda02f52] #2
tls_private_key.child_key["bravo.example.com"]: Refreshing state... #2
[id=8ec2521d90a08a519a726f138b19199d6ed6437a] #2
tls_private_key.child_key["charilie.example.com"]: Refreshing state... #2
[id=435155292c21a131097fcceb9a766e665f2f8ebc] #2
tls_private_key.child_key["example.com"]: Refreshing state... #2
[id=9d9c8317f875a36b5bc57e670fd47635492d2d68] #2
tls_cert_request.child_request["charilie.example.com"]: Refreshing state... #2
[id=a2cf771109b74a9aac1f5e53e6315541b6f0ce87] #2
tls_self_signed_cert.ca_cert: Refreshing state... #2
[id=12130143203772277739991525625097530930] #2
tls_cert_request.child_request["example.com"]: Refreshing state... #2
[id=7167dd2d7a84a0e93649fe8da51d4a09242f41c1] #2
tls_cert_request.child_request["bravo.example.com"]: Refreshing state... #2
[id=8a9ed6e21bdf631b6fa5eae4ee1a19054b18c83f] #2
tls_locally_signed_cert.child_certificate["charilie.example.com"]: #2
Refreshing state... [id=261354429775196687330090384346558832041] #2
tls_locally_signed_cert.child_certificate["example.com"]: #2
Refreshing state... [id=197151303769940224413374914269052138442] #2
tls_locally_signed_cert.child_certificate["bravo.example.com"]: #2
Refreshing state... [id=69778434329272285339085853065384974027] #2
No changes. Your infrastructure still matches the configuration. #3
#4
#1 Run Terraform plan in refresh-only mode.
#2 Terraform is checking to seeif any resources have changed.
#3 Terraform is letting us know there were no changes.
#4 Terraform stops here. Even though we made changes to our code Terraform is ignoring them in this planning mode.
The refresh-only plan listing shows the command followed by state lookups for TLS resources. section 5.3.5
