Diagnosing a clean plan when infrastructure clearly differs

Diagnosing a clean plan when infrastructure clearly differs

Symptom

terraform plan reports no changes, but the real infrastructure visibly differs from config: a setting, a tag, a whole resource.

Cause (in order of likelihood)

1. Refresh was skipped (-refresh=false) so Terraform never looked.
2. ignore_changes on the differing attribute tells Terraform to look away.
3. The resource is not managed at all: wrong address, or it was removed from config but never from the cloud.
4. Provider read gap: the provider's Read does not return that attribute, so Terraform cannot see the difference.

Confirmation

1. Was refresh skipped? Check the command and CI job for -refresh=false. Re-run a full plan with refresh.
2. Search the config for ignore_changes covering the attribute. Lifecycle blocks are the usual hiding place.
3. terraform state list | grep for the resource. Not in state means not managed: plan correctly shows nothing because as far as Terraform knows, the object does not exist.
4. If managed, refreshed, and not ignored, compare terraform state show [address] with the console. Attributes absent from state that exist in reality are provider read gaps.

Fix

1. Refresh skipped: run normally. If CI skips refresh for speed, that is the bug; fix the job.
2. ignore_changes: narrow it to the exact attributes the external writer manages, or remove it if the writer is gone.
3. Unmanaged: import the object (or delete it, if it should not exist).
4. Provider read gap: file the provider bug; work around with a targeted replace or external check until fixed.

Verification

1. Full plan (with refresh) now shows the expected diff, or a clean plan you can explain attribute by attribute.
2. The fix is in config (not a CLI flag), so the next agent gets the same correct behavior.

Refresh updates state from real infrastructure; -refresh=false skips it; ignore_changes excludes attributes from planning. Verified against live docs 2026-09-26.