1.3.1. Desired State and Reconciliation

💡 First Principle: Terraform never acts on your configuration directly — it always acts on the difference between your configuration and what it believes already exists, which is why an unchanged config produces an empty plan and why deleting a block triggers a destroy.

The reconciliation loop has three inputs. Your configuration is the desired state. The state file is Terraform's record of what it last knew to exist. The real infrastructure, queried through providers during a refresh, is the ground truth. Terraform compares all three and produces a plan: resources to create (in config, not in state), update (in both but differing), destroy (in state, not in config), or no-op (matching).

This single idea explains a surprising amount of behavior: removing a resource block deletes the resource (it's now "in state, not in config"); renaming a resource without a moved block looks like a destroy-then-create (the old address vanished, a new one appeared); and re-running an unchanged config does nothing (everything matches).

⚠️ Exam Trap: Don't confuse the plan with the apply. Generating a plan is read-only — it refreshes state and shows the diff but changes nothing. Only apply enacts the reconciliation. The exam frequently probes whether you know plan is non-destructive.

Reflection Question: Using the three-input model, explain why deleting a resource block from your configuration causes Terraform to destroy real infrastructure.