Terraform Workflow & auto-approve

The core workflow

Write Terraform code
        ↓
terraform init
        ↓
terraform plan
        ↓
terraform apply
        ↓
Infrastructure created

Example project:

provider "aws" {
  region = "ap-south-1"
}
 
resource "aws_instance" "web" {
  ami           = "ami-0db56f446d44f2f09"
  instance_type = "t3.micro"
}

terraform init

terraform init

Internally Terraform:

1. Reads configuration files
2. Downloads required providers (for example AWS)
3. Creates .terraform/
4. Writes .terraform.lock.hcl to pin provider versions

terraform init
        ↓
Read .tf files
        ↓
Download providers
        ↓
Create .terraform/ + lock file
        ↓
Ready

terraform plan

terraform plan

Compares desired configuration to current state and prints what would be added, changed, or destroyed — without making changes.

terraform apply

terraform apply

Shows the plan, asks for confirmation (yes), then creates or updates resources and refreshes state.

Next apply

If nothing changed in code or cloud drift, plan shows no changes. If you change instance_type, plan shows an update (or replacement, depending on the attribute).

Destroy

terraform destroy

Removes all resources tracked in state for this configuration.

Lifecycle summary

init   → prepare working directory
plan   → preview changes
apply  → create / modify
destroy → tear down

What is -auto-approve?

Normally apply asks:

Do you want to perform these actions?
Only 'yes' will be accepted to approve.

Skip the prompt:

terraform apply -auto-approve
terraform destroy -auto-approve

Why CI uses it

In GitHub Actions, Jenkins, or GitLab CI nobody is present to type yes.

terraform init
terraform plan
terraform apply -auto-approve

Is it safe?

Wrong code + -auto-approve = immediate create/change/destroy with no human gate.

Interview answer

-auto-approve runs Terraform without the interactive yes confirmation. It is common in CI/CD and dangerous without a prior reviewed plan.