Inaccurate modifications in the Terraform plan

Problem

A terraform plan may show proposed changes to resources that do not occur during the subsequent terraform apply. The plan output suggests updates will be made, but the apply summary reports fewer or no changes to the infrastructure.

Prerequisites

This behavior can occur when a data source in your configuration uses the depends_on meta-argument to reference a resource that is also being modified.

Cause

This issue occurs because the depends_on meta-argument creates an explicit dependency. When the referenced resource changes, Terraform knows the data source must be re-read during the apply phase. Consequently, any other resources that reference this data source are also marked for potential updates, as their configuration values are not known until after the apply.

However, if the data read during the apply phase is identical to the data in the state, the dependent resources are not actually updated. This leads to the discrepancy between the plan and the apply output.

The following example output demonstrates this behavior. The plan indicates two resources will change, but the apply summary shows only one resource was changed.

Terraform will perform the following actions:

  # data.tfcoremock_simple_resource.test2 will be read during apply
  # (depends on a resource or a module with changes pending)
  <= data "tfcoremock_simple_resource" "test2" {
      + bool    = (known after apply)
      + float   = (known after apply)
      + id      = "example_data"
      + integer = (known after apply)
      + number  = (known after apply)
      + string  = (known after apply)
    }

  # tfcoremock_simple_resource.test1 will be updated in-place
  ~ resource "tfcoremock_simple_resource" "test1" {
        id     = "93460adf-6019-3646-7968-403e0421ee10"
      ~ string = "test1" -> "test-x"
    }

  # tfcoremock_simple_resource.test2 will be updated in-place
  ~ resource "tfcoremock_simple_resource" "test2" {
        id     = "ca4c93ee-67cd-67d7-d4ed-14935ac1f214"
      ~ string = "some data example" -> (known after apply)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

tfcoremock_simple_resource.test1: Modifying... [id=93460adf-6019-3646-7968-403e0421ee10]
tfcoremock_simple_resource.test1: Modifications complete after 0s [id=93460adf-6019-3646-7968-403e0421ee10]
data.tfcoremock_simple_resource.test2: Reading...
data.tfcoremock_simple_resource.test2: Read complete after 0s

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Solutions

Solution 1: Remove Explicit depends_on

Review your configuration and remove the depends_on meta-argument from data sources wherever possible. Terraform can automatically infer dependencies by analyzing resource attributes and module outputs used in other resources. Relying on these implicit dependencies is the preferred approach.

Solution 2: Use Implicit Dependencies with Module Outputs

If dependencies are not automatically inferred, you can create them implicitly. Generate outputs from the module that must be created first. Then, pass these outputs as input variables to the modules that need to be created subsequently. This approach creates a clear and robust dependency graph, which narrows the scope of dependencies and makes your plans more predictable and accurate.

Outcome

By restructuring your Terraform configuration to favor implicit dependencies over explicit depends_on arguments, you can improve the accuracy of your Terraform plans. This leads to more predictable infrastructure changes and reduces confusion about unintended modifications.