terraform plan -out: save a plan and apply exactly that plan

terraform plan -out=tfplan saves the proposed changes to a binary plan file. terraform apply tfplan applies exactly that plan, without a confirmation prompt and without re-reading changes made to the configuration afterwards. This is how CI pipelines split "plan, review, approve" from "apply".

Save and inspect a plan

printf 'resource "terraform_data" "app" {\n  input = "v1"\n}\n' > main.tf
terraform init -input=false -no-color >/dev/null
terraform plan -no-color -input=false -out=tfplan | tail -4
terraform show -no-color tfplan | sed -n '/will be created/,/^$/p'
terraform show -json tfplan | head -c 60; echo

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"
  # terraform_data.app will be created
  + resource "terraform_data" "app" {
      + id     = (known after apply)
      + input  = "v1"
      + output = (known after apply)
    }

{"format_version":"1.2","terraform_version":"1.16.6","planne

terraform show -json tfplan produces the machine-readable plan used by policy tools (OPA/Conftest, Sentinel) and PR comments.

Things to know

• The plan file is tied to the state it was made from. If the state changes before apply (someone else applied), apply refuses with Saved plan is stale; plan again.
• The file contains every variable value and attribute in clear text, including sensitive ones. Treat it like a secret: short-lived CI artifacts, never committed.
• Use the same Terraform version, providers (.terraform.lock.hcl) and working directory for plan and apply.
• Without -out, terraform apply creates a new plan and asks for confirmation; -auto-approve skips the question but not the new plan.