A CI job saved a plan with terraform plan -out=tfplan and waited for approval. Meanwhile another pipeline applied a different change to the same workspace. When the approved job runs terraform apply tfplan, what happens?
Select an answer to reveal the explanation.
Short Explanation
A saved plan is a promise based on a snapshot. If someone changes the state after the snapshot, the promise is void, and Terraform won't let you cash it. You re-plan and re-review. The trap is thinking Terraform will quietly merge or patch the plan.
Full Explanation
A saved plan records the actions Terraform computed against a specific state snapshot. When another operation changes that state before the plan is applied, Terraform rejects the plan with an error that the saved plan is stale, because the state was changed by another operation after the plan was created. The automation guidance from HashiCorp describes the same rule: when a plan is applied, any other existing plans produced against the same state are invalidated, since they must be recomputed relative to the new state. The correct response is to run a new plan, review it again and apply that new file. Applying the stale plan regardless would act on outdated assumptions and could undo or conflict with the other change, which is precisely what the check prevents. Terraform never merges or recalculates a saved plan during apply; applying a plan file means executing exactly its recorded actions or failing. There is no partial application mode that skips conflicting actions of a saved plan. Exam caveat: this is why pipelines should allow only one outstanding plan per workspace and serialize applies, and why approval delays increase the chance of stale plans. Operational check: when the apply job fails with a stale plan error, configure the pipeline to rerun the plan stage automatically and request a fresh approval rather than retrying the apply.