terraform plan does three things well: it validates syntax, resolves references between resources and refreshes the state against the provider for the resources it already manages. What it does not do is call the provider to ask whether what the configuration takes for granted exists, is allowed or has room. That is the gap between a green plan and a red apply, and it is wider than it looks: a subnet typed by hand, a credential that can only read, a vCPU quota already at its limit. None of those shows up in the plan.

These are the six things plan does not verify. For each one: what the plan sees, what the apply hits, and one read-only command per provider to ask beforehand. The commands are taken from each CLI's official reference.

1. The subnet referenced by name or by a hand-typed ID

What the plan sees: a string. subnet_id = "subnet-0abc..." or a var.subnet_name that arrives from a tfvars file.…