A pipeline runs terraform plan in one job, posts the plan for human approval, and runs apply in a later job after approval. The team must guarantee the apply performs exactly the actions that were approved, not a freshly computed plan. How should the jobs be set up?

The -out option writes the generated plan to a file, and passing that file to terraform apply performs exactly the operations recorded in it, without computing a new plan or prompting, because passing the file is itself the approval. The pipeline should store the file as a protected artifact, since saved plans can contain sensitive values, and the apply job must run with the same configuration, initialized working directory and provider versions. If anything changed state between plan and apply, Terraform refuses the stale plan rather than applying something different. Running apply with -auto-approve computes a brand new plan at apply time, so any drift, upstream change or data source update since the review can produce different actions from the ones approved, even on the same commit. The -json option on plan streams machine-readable log output; it is not an executable plan, and apply accepts a saved plan file, not JSON. Disabling refresh in both jobs does not make plans identical, since state, configuration inputs or data sources can still change, and it causes Terraform to ignore external changes. Exam caveat: once a plan is applied, any other plans made against the same state are invalidated, so allow only one outstanding plan per workspace. Operational check: run terraform show tfplan in the approval step so reviewers see the saved file's contents, then apply that same file.