What is the difference between terraform plan and terraform apply?

terraform plan is a dry run — it reads the current state, compares it with the desired configuration, and shows exactly what would be created, modified, or destroyed. It makes no changes to real infrastructure. Output shows: + (resource to create), ~ (resource to modify in-place), -/+ (resource to destroy and recreate), - (resource to destroy). Always review the plan carefully before applying. In CI/CD, run plan in PRs for code review. terraform apply executes the plan — first shows the plan again and prompts for confirmation, then applies changes. Use terraform plan -out=tfplan to save the plan, then terraform apply tfplan to apply exactly that plan (safe for automation). The golden rule: never run apply on infrastructure you haven't reviewed the plan for.