A tofu plan shows proposed infrastructure actions; it does not apply them. Read the plan summary and each resource action to check whether the proposal matches your intent. For automation, use -detailed-exitcode carefully: exit code 2 means a successful plan found changes, not that the command failed.
What a tofu plan tells you
OpenTofu reads existing remote objects, compares them with your configuration and prior state, then produces a proposed set of actions. The plan is a preview, not evidence that anything has changed in the target system. A plan run without -out is speculative; because the target may change after planning, generate and review a fresh final plan before applying it. See the OpenTofu plan command documentation.
As an Amazon Associate I earn from qualifying purchases.
Start with the summary at the end of the output, then inspect the individual resources and their proposed actions. For example, Plan: 1 to add, 0 to change, 0 to destroy means OpenTofu proposes creating one resource, changing none, and destroying none. The counts describe the proposal, not completed operations. If the summary or a resource-level action is unexpected, stop and investigate before applying.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow to interpret detailed exit codes
The three-value convention applies when you run tofu plan -detailed-exitcode. The codes distinguish a clean plan, a plan with changes, and an error:
#1 Best Overall
| Exit code | Meaning with -detailed-exitcode |
How automation should treat it |
|---|---|---|
0 |
Command succeeded with an empty diff: no changes. | Continue along the no-change path. |
1 |
An error occurred. | Handle as a failed plan and inspect the error output. |
2 |
Command succeeded with a non-empty diff: changes are present. | Handle as a successful plan that needs the changes path, not as an ordinary command failure. |
A shell or CI system may regard any nonzero status as failure by default. If your script uses this option, explicitly branch on all three values rather than treating 2 like 1. These meanings are documented in the plan command reference.
Choose the right way to inspect a plan
Use the human-readable command for interactive review and JSON when a program needs structured data. Use -out when you need to save the plan for later inspection or application.
Rank #2
| Need | Command | What to expect |
|---|---|---|
| Review a saved plan in a terminal | tofu show PLANFILE |
Human-readable plan output. |
| Parse a saved plan in a script or other consumer | tofu show -json PLANFILE |
Structured JSON containing more than the terminal summary, including plan, configuration, values or prior-state, resource-change, and check data. |
| Save a plan for later review or application | tofu plan -out=FILE |
A saved plan artifact that can be inspected with tofu show. |
The commands and output behavior are described in the show command reference, plan command reference, and JSON Output Format documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect saved plans and JSON output
Saved plan files and their derived output can contain sensitive information. A saved plan may retain configuration, variable values, and sensitive values even when the terminal masks them. JSON output can expose sensitive state values in plain text. Treat both the plan file and JSON as confidential: restrict access, avoid attaching them casually to tickets, and prevent CI logs from publishing them. OpenTofu documents these risks in its plan and show command references.
Why tofu show may not display a plan cleanly
Interpreting provider-specific details depends on provider schema information. If the provider versions installed now differ from those used to create the artifact, schema upgrades may be needed. Check which providers were used to create the plan and which are installed before concluding that its contents are corrupt. OpenTofu also documents constraints on viewing plans created with refresh disabled. The show command reference explains these requirements; the init command reference covers provider initialization.
Why JSON can show resource changes when the plan says “No changes”
Do not assume every entry in JSON resource_changes proves that OpenTofu considers the overall plan non-empty. OpenTofu documents an ephemeral-resource edge case: an open action can appear in resource_changes, while OpenTofu’s emptiness test ignores that action. The CLI can therefore say “No changes” and return detailed exit code 0 even though a JSON consumer sees an entry. A consumer that treats any resource-change entry as a change can misclassify this plan. See the provider documentation.
JSON is a versioned format, not an unchanging schema. The documented compatibility policy says consumers should tolerate compatible minor additions by ignoring unknown properties, and reject an unsupported major format version. Check format_version and write parsers to handle the documented compatibility rules rather than assuming every field set is fixed. See OpenTofu’s JSON format documentation.
Diagnose a mismatch between the CLI and a script
When the typed command, terminal output, exit status, and a downstream parser disagree, verify the effective command before changing the parser or plan. The installed OpenTofu version matters: documentation examples may differ from the behavior of another version. Also check whether environment variables added arguments behind the scenes.
TF_CLI_ARGScan add arguments to every CLI command.TF_CLI_ARGS_plancan add arguments specifically totofu plan.
Inspect these variables alongside the command shown in the script or CI configuration, then compare the CLI’s empty-plan result with the JSON consumer’s logic—especially if ephemeral resources are involved. OpenTofu documents command-wide and command-specific argument injection in its environment variables reference; version-related CLI behavior is covered in Basic CLI Features.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
