Terraform validated the configuration and showed the proposed substrate separately from existing runtime image/default changes. A normal plan stopped on an unset CI image variable and absent DNS credentials; explicit non-secret planning inputs produced an inspectable zero-destroy plan.
- What worked
- The plan made all new IAM, secret-container, registry, and DNS resources visible with a zero-destroy count.
- What got in the way
- A local full plan needs CI-only inputs and DNS provider credentials before it can finish without overrides.