terraform apply should be against a saved plan

[tammersaleh]

Our cg-provision pipeline (also aws-broker and maybe others) is configured to run terraform plan, and in a later job run terraform apply. However, that apply doesn't make use of a saved plan file. This means infrastructure drift during plan review and before the apply job is triggered can result in unexpected and possibly destructive changes.

Instead, we should save the plan output from the terraform plan job and make use of it in the apply job.

[tammersaleh]

relevant: https://github.com/ljfranklin/terraform-resource

[tammersaleh]

I was possibly bit by this today. Triggered a concourse build against a commit that had already run, and somehow that build ended up rebuilding a database. I have no idea what changed, since the apply used -autoapprove. Maybe it was fine?

[tammersaleh]

Closing in favor of cloud-gov/terraform-provision#741