Learn · The plan as a document
known after apply, and what it hides
Half the rows in a real plan are a placeholder rather than a value. Knowing which half, and why, is how you tell a consequence from a cause.
It is a value, in a particular state
(known after apply) is not a blank and not an error. It is the planner saying: this attribute is chosen by the provider, the object does not exist yet, so there is nothing to print.
Every id, every ARN, every endpoint and every generated name is like this on a create. That is unremarkable. What matters is when one appears on a resource you did not think you were changing — because that means something it depends on is being replaced, and its new values will be different.
+ resource "cloud_bucket" "exports" { bucket = "orders-exports-eu-west-1" }
Watch: How many rows in a single create block are a placeholder rather than a value.
A consequence, not a cause
When a resource is replaced, every attribute the provider assigns becomes unknown again — a new id, a new ARN, a new endpoint. Those rows fill the block, and every one of them is an effect of the replacement rather than a reason for it.
Only one row carries # forces replacement, and it is the cause. Reading a plan efficiently is largely the skill of looking past the noisy consequences to the one row that produced them.
(known after apply) is not evidence of anything. A single # forces replacement is.It spreads, and that is the useful part
An unknown value propagates. A name built from an unknown is unknown; a list containing one is unknown; a conditional on one is unknown in both branches. That is why a single replacement can make rows go blank three resources away.
It has one hard limit: count and for_each cannot be unknown. The plan has to say how many resources it is about to create, so an unknown there is an error rather than a placeholder. That refusal is the planner being honest about what it does not know.
Before you run it
A plan shows ~ records = ["app-lb-1..."] -> (known after apply) on a DNS record. What has happened?
The plan
The same service every claim above was made about. Nothing here is graded — load whatever you like, or change nothing and read what the configuration already produces.
Plan: 0 to add, 0 to change, 0 to destroy.
Nothing in this plan is destroyed.