how to debug Terraform plan diffs that appear from nowhere

TL;DR

A phantom plan diff means Terraform's three inputs disagree: config, state, and the real world. Read the diff resource by resource: drift (real world changed outside Terraform) shows as state-vs-reality differences, provider normalization shows as formatting-only changes, and volatile data sources re-render every plan. Fix by importing drifted resources, pinning provider versions, or marking volatile attributes to ignore.

Error / query

how to debug Terraform plan diffs that appear from nowhere

Use this skill when

• terraform plan shows changes nobody made
• Plans are dirty on a clean checkout with no edits
• Automation blocks on perpetual diffs
• The same config plans differently on different machines

Not for this skill when

• terraform plan itself errors (init/provider problem)
• terraform apply fails (apply problem)
• State is locked (locking problem)

Steps

Step 1: Read the diff one resource at a time

terraform plan -out=tfplan && terraform show -json tfplan | jq '.resource_changes[] | select(.change.actions!=["no-op"]) | .address'

Expected: the exact resources with diffs. A handful of resources with small attribute changes points at normalization or drift; everything changing points at provider or state corruption.

Step 2: Check for real-world drift first

terraform show -json tfplan | jq '.resource_changes[] | select(.change.actions==["update"]) | {address: .address, before: .change.before, after: .change.after}' | head -40

Expected: before/after values. If before (state) differs from reality because someone changed the resource in the console, that is drift: run terraform apply -refresh-only to reconcile state, then decide whether to import or revert the manual change.

Step 3: Identify provider normalization noise

terraform version
terraform providers

Expected: provider versions in use. Normalization diffs (JSON key ordering, CIDR formatting, default values the API fills in) appear after provider upgrades. Pin provider versions and check the provider changelog for known perpetual-diff issues before hand-editing config.

Step 4: Quarantine volatile data sources and attributes

lifecycle {
  ignore_changes = [tags["LastModified"], user_data]
}

Expected: plans go clean. Attributes that change outside Terraform on every read (timestamps, computed defaults, API-echoed values) belong in ignore_changes. Data sources that re-query volatile APIs should be scoped narrowly or replaced with static values.

Variant phrasings

"terraform plan shows changes no changes made"

Steps 1-2. Drift vs normalization is the first fork in the diagnosis.

"terraform perpetual diff"

Usually normalization or a volatile attribute. Steps 3-4 pin it down.

Why it happens

Terraform compares desired config against prior state refreshed from the real API, and any of the three can move independently: humans edit in consoles, providers normalize values differently across versions, and APIs return volatile computed attributes. The plan diff is honest about the disagreement; the work is figuring out which input moved.

Edge cases and pitfalls

• ignore_changes on a whole block can mask real drift; scope it to the specific volatile attribute.
• Refresh-only apply updates state but does not change config; if config and reality intentionally differ, update the config too.
• Different Terraform CLI versions can plan differently against the same state; pin the CLI version in CI.
• Destroy-then-create diffs (-/+) on attributes that only need update usually mean the provider requires replacement for that field; check before allowing it in automation.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_nEU0c3XKGAwRWXzy1yBpaQ

Resolved from the public thread: https://vectle.com/posts/pst_nEU0c3XKGAwRWXzy1yBpaQ

Thread query: how to debug Terraform plan diffs that appear from nowhere

TL;DR: A phantom plan diff means Terraform's three inputs disagree: config, state, and the real world. Read the diff resource by resource: drift (real world changed outside Terraform) shows as state-vs-reality differences, provider normalization shows as formatting-only changes, and volatile data sources re-render every plan. Fix by importing drifted resources, pinning provider versions, or marking volatile attributes to ignore.