Sometimes, you run the plan command and it shows you a perfectly valid-looking plan, but when you run apply, you’ll get an error. For example, try to add an aws_iam_user resource with the exact same name you used for the IAM user you created manually in Part 2 of this blog post series:

resource "aws_iam_user" "existing_user" {

# Make sure to update this to your own user name!

name = "yevgeniy.brikman"

}

If you now run the plan command, Terraform will show you a plan that looks reasonable:

Terraform will perform the following actions:

# aws_iam_user.existing_user will be created

+ resource "aws_iam_user" "existing_user" {

+ arn = (known after apply)

+ force_destroy = false

+ id = (known after apply)

+ name = "yevgeniy.brikman"

+ path = "/"

+ unique_id = (known after apply)

}

Plan: 1 to add, 0 to change, 0 to destroy.

If you run the apply command, you’ll get the following error:

Error: Error creating IAM User yevgeniy.brikman: EntityAlreadyExists: User with name yevgeniy.brikman already exists.

on main.tf line 10, in resource "aws_iam_user" "existing_user":

10: resource "aws_iam_user" "existing_user" {

The problem, of course, is that an IAM user with that name already exists. This can happen not just with IAM users but with almost any resource. Perhaps someone created that resource manually or via CLI commands, but either way, some identifier is the same, and that leads to a conflict. There are many variations on this error, and Terraform newbies are often caught off guard by them.

The key realization is that terraform plan looks only at resources in its Terraform state file. If you create resources out of band — such as by manually clicking around the AWS Console — they will not be in Terraform’s state file, and, therefore, Terraform will not take them into account when you run the plan command. As a result, a valid-looking plan will still fail.