'It was just a rename'
Some incidents start with an innocent change. A resource is renamed in the code, it is applied, and the tool, which does not know it is the same one, destroys the old one and creates a new one. If it was a database, the new name arrives with an empty database.
The tool would have warned. All it took was reading the plan.
What a plan says
Before applying, an infrastructure-as-code tool works out the difference between what is declared and what exists, and shows it:
- Create: new resources.
- Modify: changes applied to an existing resource without replacing it.
- Destroy and recreate: changes that require deleting the resource and creating another. These are the dangerous ones.
- Destroy: resources that are no longer in the code.
The plan is the equivalent of reviewing a code change: it is read before, not after.
How to turn the plan into a gate
- The plan is generated automatically on every proposed change and attached to the review.
- What gets applied is exactly the plan that was reviewed, not one recalculated minutes later (in the meantime, reality may have changed).
- Anything destructive requires explicit approval from a person, by name, just like the gates in the Platform series.
- Critical resources are protected against deletion in the code itself, so that not even a plan approved by mistake can remove them.
A plan that says something more
The plan says what changes. One question is missing, one that is almost never asked at that moment and matters just as much: how much will it cost?
How we apply it: Automation and IaC.