Neither preview is a guarantee. A Terraform plan is generated from state and provider logic and shows resource changes, but it cannot predict provisioner behavior. Ansible check mode is a simulation where unsupported modules report nothing. Use both as evidence, and fill the gaps with review.
What each tool previews
Terraform's plan compares configuration, state and remote objects, and lists what it would create, change or destroy. Ansible's check mode runs a play without making changes and reports what supporting modules would change. Diff mode adds before and after comparisons.
Where each goes blind
| Tool | Blind spot | Source of the limit |
|---|---|---|
| Terraform plan | Provisioner actions | Docs say Terraform cannot predictably model provisioner behavior |
| Ansible check mode | Modules without check mode support | Docs say they report nothing and do nothing |
| Ansible check mode | Tasks depending on earlier results | Docs say no output for conditionals on registered variables |
| Ansible check mode | Tasks with check_mode set to false | They change systems even in a check run |
Matching the tool to the job
- Terraform fits creating and changing infrastructure with a state record.
- Ansible fits configuring what runs on machines.
- Provisioners and command tasks are where both previews are weakest, so those are where reviewers should slow down.
A combined review routine
- Require a saved plan for Terraform changes and review it, not just the code.
- Run Ansible in check and diff mode against a staging inventory.
- Flag provisioners,
local-exec,command,shellandcheck_mode: falsefor explicit approval. - Pin providers, modules, collections and roles so the preview matches the real run.
- Apply to a small group first, then widen.
- After the run, compare actual state with intent. For Terraform, use a plan that should show no changes.
Why pinning is part of previewing
A preview describes one moment. If a module version or collection changes between preview and run, the preview is stale. Lock files, exact versions and saved plans keep the two aligned. A related Terraform point: the lock file tracks providers only, so remote modules need exact versions on their own.
Treat previews as evidence
A clean preview lowers the chance of surprise. It does not replace least privilege credentials, approval of production runs and a way to roll back.
Quick check
Can a Terraform plan miss a change?
It cannot predictably model provisioner behavior, according to the documentation.
Can Ansible check mode miss a change?
Yes, when modules do not support it or tasks depend on earlier results.
Do I need both tools?
They do different jobs. Many teams use one for infrastructure and the other for host configuration.
Safeguard offers SBOM and dependency scanning and policy gates that can block a pull request on findings, and you can try a free scan at gold.safeguard.sh/scan.
Sources
- Terraform docs: Provisioners
- Ansible docs: Validating tasks, check mode and diff mode
- Terraform docs: Dependency Lock File
Last reviewed: 19 October 2026.
