Many engineers treat terraform plan as a preview feature.
The more important role is control.
A plan-only pipeline creates a boundary between reviewing infrastructure intent and changing infrastructure. Terraform reads configuration, state, and AWS data to calculate proposed actions, but no resources are created because the pipeline stops before apply.
This lesson examines how validation prevents malformed configurations from reaching review, how drift appears during planning, why secret metadata can still create security exposure, and how separate IAM roles prevent review pipelines from becoming deployment pipelines.
Understanding that distinction helps explain why plan-only workflows are a security mechanism rather than just a reporting tool.