Read a Plan Like a Reviewer

1. 1

   Add versioning and public-access protection

   In AWS provider 4 and later, bucket features are separate resources, one per concern, each pointing at the bucket by its ID. Versioning protects against overwrites and deletes (AWS course, Topic 4.1). The public access block guarantees that no policy or ACL can make the bucket public, even by mistake.

   Both use aws_s3_bucket.assets.id, which is the reference that creates the dependency.

   resource "aws_s3_bucket_versioning" "assets" {
     bucket = aws_s3_bucket.assets.id
   
     versioning_configuration {
       status = "Enabled"
     }
   }
   
   resource "aws_s3_bucket_public_access_block" "assets" {
     bucket = aws_s3_bucket.assets.id
   
     block_public_acls       = true
     block_public_policy     = true
     ignore_public_acls      = true
     restrict_public_buckets = true
   }

2. 2

   Save the plan instead of applying straight away

   Write the plan to a file. Because the bucket already exists, the reference resolves to a real value in the plan (bucket = "shoplite-assets-ak-7x2q") rather than (known after apply).

   terminalcopy cmd

   $ terraform plan -out=tfplan

   ── expected output ──

   aws_s3_bucket.assets: Refreshing state... [id=shoplite-assets-ak-7x2q]

    

   Terraform will perform the following actions:

    

   # aws_s3_bucket_public_access_block.assets will be created

   + resource "aws_s3_bucket_public_access_block" "assets" {

   + block_public_acls = true

   + block_public_policy = true

   + bucket = "shoplite-assets-ak-7x2q"

   + id = (known after apply)

   + ignore_public_acls = true

   + restrict_public_buckets = true

   }

    

   # aws_s3_bucket_versioning.assets will be created

   + resource "aws_s3_bucket_versioning" "assets" {

   + bucket = "shoplite-assets-ak-7x2q"

   + id = (known after apply)

    

   + versioning_configuration {

   + mfa_delete = (known after apply)

   + status = "Enabled"

   }

   }

    

   Plan: 2 to add, 0 to change, 0 to destroy.

    

   Saved the plan to: tfplan

    

   To perform exactly these actions, run the following command to apply:

   terraform apply "tfplan"

3. 3

   Review the saved plan, then apply exactly that

   terraform show tfplan re-renders a saved plan, which is how a reviewer inspects it later. -json gives machine-readable output that policy tools consume in Stage 7. Applying a saved plan doesn't prompt, because the review already happened.

   terminalcopy cmd

   $ terraform show tfplan | tail -n 3

   terraform apply tfplan

   ── expected output ──

   Plan: 2 to add, 0 to change, 0 to destroy.

    

   aws_s3_bucket_versioning.assets: Creating...

   aws_s3_bucket_public_access_block.assets: Creating...

   aws_s3_bucket_public_access_block.assets: Creation complete after 1s [id=shoplite-assets-ak-7x2q]

   aws_s3_bucket_versioning.assets: Creation complete after 2s [id=shoplite-assets-ak-7x2q]

    

   Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

4. 4

   Provoke a replacement — and do NOT apply it

   Change the bucket name by one character (for example -7x2q to -7x2r) and plan. The bucket shows -/+, and the bucket line carries # forces replacement. Both dependent resources are replaced too, because their bucket argument is ForceNew as well.

   Read the summary: 3 to add, 0 to change, 3 to destroy. A one-character edit is about to delete a bucket along with every object in it. This is the review skill to learn in this mission.

   terminalcopy cmd

   $ terraform plan

   ── expected output ──

   # aws_s3_bucket.assets must be replaced

   -/+ resource "aws_s3_bucket" "assets" {

   ~ arn = "arn:aws:s3:::shoplite-assets-ak-7x2q" -> (known after apply)

   ~ bucket = "shoplite-assets-ak-7x2q" -> "shoplite-assets-ak-7x2r" # forces replacement

   ~ id = "shoplite-assets-ak-7x2q" -> (known after apply)

   # (8 unchanged attributes hidden)

   }

    

   # aws_s3_bucket_public_access_block.assets must be replaced

   -/+ resource "aws_s3_bucket_public_access_block" "assets" {

   ~ bucket = "shoplite-assets-ak-7x2q" -> (known after apply) # forces replacement

   # (4 unchanged attributes hidden)

   }

    

   # aws_s3_bucket_versioning.assets must be replaced

   -/+ resource "aws_s3_bucket_versioning" "assets" {

   ~ bucket = "shoplite-assets-ak-7x2q" -> (known after apply) # forces replacement

   # (1 unchanged block hidden)

   }

    

   Plan: 3 to add, 0 to change, 3 to destroy.

5. 5

   Revert, and preview a destroy without doing one

   Put the original name back and confirm the plan is clean. Then look at plan -destroy, which shows what terraform destroy WOULD remove. It's useful before tearing down an environment, and it changes nothing.

   terminalcopy cmd

   $ terraform plan -destroy | tail -n 1

   ── expected output ──

   Plan: 0 to add, 0 to change, 3 to destroy.

6. 6

   Delete the used plan file and commit

   A saved plan is single-use; once applied, it's stale. It's already git-ignored (the tfplan line from Mission 0.1's .gitignore), because saved plans can contain sensitive values. Delete it and commit the code.

   terminalcopy cmd

   $ rm tfplan

   git add -A && git commit -m "assets bucket: versioning + public access block"

   ── expected output ──

   [main 4b1c2d9] assets bucket: versioning + public access block

   1 file changed, 16 insertions(+)

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.