Comparison
Plan and applyvsResource graph
Plan and apply
the tool prints exactly what it will create, change and destroy, and you read the destroy list before typing yes.
The two-phase model of declarative infrastructure tooling: compute the difference between desired and recorded state and show it, then execute it. The plan is the single most valuable safety feature in the category, and reviewing it — particularly the replacements and deletions — is the actual control. A plan is only as good as its freshness, since anything that changes between planning and applying is not in it.
Full entry →Resource graph
you never say what order to build things in; the tool works it out from which resource references which.
The dependency graph the tool derives from references between resources, used to order creation, update and destruction and to parallelise what is independent. It is why declarations can be written in any order and why deletion happens in reverse. Implicit dependencies the graph cannot see — a policy that must exist before a service can assume a role — are the origin of the intermittent failures that succeed on a second apply.
Full entry →