plan -detailed-exitcode -destroy return "2" when nothing to destroy

[next-jesusmanuelnavarro]

Terraform Version

$ terraform -v
Terraform v0.12.15

Expected Behavior

as per help, terraform plan -detailed-exitcode should return:

                      0 - Succeeded, diff is empty (no changes)
                      1 - Errored
                      2 - Succeeded, there is a diff

Actual Behavior

terraform plan -detailed-exitcode -destroy returns '2' on already destroyed infra.

Steps to Reproduce

On an already destroyed infra (I'm using shared state/lock on S3/DynamoDB):

1. terraform init
2. terraform plan -detailed-exitcode -destroy -out=./planfile
3. $?. It returns 2 code, and the following message to stdout:

------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:

Terraform will perform the following actions:

Plan: 0 to add, 0 to change, 0 to destroy.

------------------------------------------------------------------------

Then, upon acting on the plan...

$ terraform show ./planfile
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:

Terraform will perform the following actions:

Plan: 0 to add, 0 to change, 0 to destroy.

Additional Context

This behaviour has changed a bit since Terraform v0.12.10: while the plan step produced the same stdout, and exit code, terraform show offered a different message:

$ terraform show ./planfile
This plan does nothing.

References

This behaviour is neither the first, nor the second, nor the third time it gets described:

• plan -detailed-exitcode returns 2 with external provider even if there is no change #16055
• Misleading return code when running terraform plan #18453
• plan -detailed-exitcode -destroy return "2" when nothing to destroy #18224

[MartinKaburu]

Hey @danieldreier I'm a new contributor and I'm willing to contribute on this. Please advise if I can proceed to start working on it. Thanks

[jjno91]

I'm experiencing the same issue on terraform plan -detailed-exitcode -destroy this is my output:

An execution plan has been generated and is shown below.

Resource actions are indicated with the following symbols:



Terraform will perform the following actions:



Plan: 0 to add, 0 to change, 0 to destroy.

script returned exit code 2

[Jean-Mercier]

Hello same issue

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:

Terraform will perform the following actions:

Plan: 0 to add, 0 to change, 0 to destroy.

Changes to Outputs:

------------------------------------------------------------------------

Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.```

echo $?
2

on terraform 0.13.0  on 0.12.26 it was OK 

[next-jesusmanuelnavarro]

I can confirm this bug is still present on terraform v0.13.0.

[corey-hammerton]

I can confirm it is present in terraform v0.13.5. We had one check that flagged a change in a datasource which caused exit code 2

[Joorem]

Same here with Terraform v.0.15.0.

[kmoe]

I haven't been able to reproduce this on any of the stated versions, or latest, with trivial config. I'd be grateful if someone could provide a reproduction case.

Terraform is returning 2 from plan -detailed-exitcode -destroy because it considers the plan applyable, but it is not showing those applyable actions to the user. The bug here is either that an empty plan is wrongly considered applyable, or that the UI output is missing information.

We can construct a case like this with config based on #16055. Here a destroy plan with output changes is being rendered to the user as an empty plan, but detected by Terraform as applyable.

Config

data "external" "foo" {
  depends_on = [null_resource.test]
  program = ["bash", "${path.module}/test.sh"]
}

resource "null_resource" "test" {
}
output "foo" {
  value = data.external.foo.result["foo"]
}

Steps

1. terraform init
2. terraform plan -detailed-exitcode -destroy

Result

Exit code 2.

Output:

Changes to Outputs:

You can apply this plan to save these new output values to the
Terraform state, without changing any real infrastructure.

───────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so
Terraform can't guarantee to take exactly these actions if you run
"terraform apply" now

(Note the dangling newline at the beginning of this output - the plan renderer does not anticipate the case in which an applyable plan has no initial segment describing resource changes.)

Plan

{
  "format_version": "1.1",
  "terraform_version": "1.3.0-dev",
  "planned_values": {
    "root_module": {}
  },
  "output_changes": {
    "foo": {
      "actions": [
        "delete"
      ],
      "before": null,
      "after": null,
      "after_unknown": false,
      "before_sensitive": false,
      "after_sensitive": false
    }
  },
  "configuration": {
    "provider_config": {
      "external": {
        "name": "external",
        "full_name": "registry.terraform.io/hashicorp/external"
      },
      "null": {
        "name": "null",
        "full_name": "registry.terraform.io/hashicorp/null"
      }
    },
    "root_module": {
      "outputs": {
        "foo": {
          "expression": {
            "references": [
              "data.external.foo.result[\"foo\"]",
              "data.external.foo.result",
              "data.external.foo"
            ]
          }
        }
      },
      "resources": [
        {
          "address": "null_resource.test",
          "mode": "managed",
          "type": "null_resource",
          "name": "test",
          "provider_config_key": "null",
          "schema_version": 0
        },
        {
          "address": "data.external.foo",
          "mode": "data",
          "type": "external",
          "name": "foo",
          "provider_config_key": "external",
          "expressions": {
            "program": {
              "references": [
                "path.module"
              ]
            }
          },
          "schema_version": 0,
          "depends_on": [
            "null_resource.test"
          ]
        }
      ]
    }
  },
  "relevant_attributes": [
    {
      "resource": "data.external.foo",
      "attribute": [
        "result",
        "foo"
      ]
    }
  ]
}

In this case, however, it's not clear to me whether the output action should exist at all and whether this plan should be considered applyable. Opened #31471 to try to deal with this side of the issue.