# Safe Terraform Apply — Plan → Review → Apply (July 2026)

## Gates

1. `terraform plan -out=tfplan` (artifact, not scrollback)
2. Human review of destroys / replaces / IAM / SG / data stores
3. `terraform apply tfplan` only (never fresh plan after approval)

## CI defaults

- [ ] No `-auto-approve` on prod
- [ ] OIDC to AWS (no long-lived keys in CI)
- [ ] Atlantis / HCP Terraform / Spacelift / env0 for PR plan + apply ACL
- [ ] Policy: block `aws_db_instance` destroy without break-glass

## Red flags in plan

- `destroy` / `forces replacement` on RDS, ALB, KMS, IAM roles
- Broad `0.0.0.0/0` ingress
- Account ID / region surprise

## Rollback rehearse

State backup before risky apply; know restore path before you need it.