I haven't seen a scenario where TF plan AND apply miss something, but I have definitely been in the scenario where a CF stack fails, and then the rollback fails, and then you're stuck with an undeletable resource and can only submit a ticket to AWS.
Ditto on both counts: we stopped using CF after hitting one of those irrecoverable bugs — usually deleting the resources manually and ignoring all the errors deleting the stack would recover after a cycle or two but we hit at least one case where that wasn’t true.
Re:AWS services to avoid
by ciceryadam on Monday May 11, 2020 @04:37AM
(#23140059)
I had a lot of uncatched issues while migrating from tf11 to tf12, as far as I remember it was due to heavy module usage.
Oh! I forgot about that mess. Yeah, it takes minutes of deploy time while real resources are spun up to catch some really basic mistakes.
Terraform plan catches a lot of issues, but I've seen cases where it misses something.