HashiCorp Terraform Associate (004) Question 175
Single answer6d Manage resource drift and Terraform stateYour team manages an AWS security group with Terraform. An administrator manually changed the security group's inbound rules in the AWS console during an incident. The Terraform configuration has not been updated, and the team wants to identify whether the deployed infrastructure has drifted from the current configuration before making any changes. Which action should the engineer take first?
- A
Run terraform plan to compare the current state in the remote system with the configuration and show proposed changes
- B
Run terraform refresh to automatically restore the infrastructure to match the configuration
- C
Delete the existing state file so Terraform rebuilds state from the provider and removes drift
- D
Run terraform apply immediately, because apply both detects drift and is the safest first step
Show answer and explanation
Correct answer: A
Explanation
When infrastructure may have been changed outside Terraform, the recommended first step is to run terraform plan. Terraform uses state to map configuration to real-world resources, and drift occurs when those resources are modified outside Terraform. During planning, Terraform queries the provider, updates its understanding of the remote objects, and compares that information against the current configuration to show what would change. This lets operators safely assess drift before deciding whether to update configuration, import or move state, or apply corrective changes. The key distinction is that state records Terraform's last known mapping, while drift detection depends on comparing configuration, state, and the actual remote infrastructure. HashiCorp documentation and best practices emphasize reviewing terraform plan output before applying changes, especially in environments where manual modifications may have occurred.
- A. Correct.
Correct. terraform plan refreshes Terraform's understanding of real infrastructure state and compares it to the configuration, then shows the proposed changes needed to reconcile differences. This is the safest first step when you suspect drift because it is read-focused and lets you inspect the impact before modifying resources.
- B. Incorrect.
Incorrect. terraform refresh updates the state file to match real infrastructure, but it does not restore infrastructure to the configuration. A common misconception is that refresh fixes drift in infrastructure; in reality, it syncs state to observed remote objects. Also, in modern Terraform workflows, plan and apply already perform a refresh step by default unless disabled.
- C. Incorrect.
Incorrect. Deleting the state file is not an appropriate drift-management technique and can make the situation worse by losing Terraform's resource tracking. Terraform state is required to map configuration to real resources. Removing it does not safely detect or resolve drift.
- D. Incorrect.
Incorrect. terraform apply would detect differences as part of the planning phase, but using apply as the first step is risky because it can modify infrastructure. Best practice is to review a plan first, especially after manual changes in production.