4. Plan, Apply, and Drift Detection

`terraform plan` compares configuration, state, and provider observations to show proposed changes.`terraform apply` executes the approved plan. In team workflows, review plans in CI and restrict apply permissions to controlled environments.

Drift occurs when someone changes a resource outside Terraform. A refresh-aware plan exposes differences, but the team must decide whether to import the external change into configuration or revert it. Do not blindly apply a plan you have not reviewed.