HashiCorp Terraform Associate (004) Question 177
Single answer6d Manage resource drift and Terraform stateYour team manages an AWS security group with Terraform. A teammate manually added an extra inbound rule in the AWS console to allow temporary access, but the Terraform configuration was not updated. You need to determine whether Terraform detects this drift and what action it will propose before anyone changes infrastructure. Which command is the best choice?
- A
Run terraform plan to refresh state from the real infrastructure and compare it with the configuration
- B
Run terraform validate to detect the manually added inbound rule in AWS
- C
Run terraform fmt to update the state file with the current AWS security group rules
- D
Run terraform output to display the current security group configuration from AWS
Show answer and explanation
Correct answer: A
Explanation
This scenario tests drift detection and understanding of Terraform state behavior. Drift occurs when real infrastructure changes outside Terraform, causing the actual resource to differ from what is recorded in state and defined in configuration. The standard way to identify this before applying changes is terraform plan, which refreshes the state from provider APIs and compares the refreshed state to the configuration. If the manually added security group rule is not in configuration, the plan will typically show that Terraform intends to remove it to bring the resource back to the declared state. Commands such as terraform validate, terraform fmt, and terraform output do not detect drift because they do not perform a full comparison between configuration and live infrastructure. This aligns with Terraform workflow guidance and state management best practices in HashiCorp documentation: use plan to review proposed actions, especially when out-of-band changes may have occurred.
- A. Correct.
Correct. terraform plan compares the Terraform configuration with the current state of real infrastructure. During planning, Terraform refreshes state by reading the actual remote objects unless refresh is explicitly disabled, so it can detect drift such as a manually added security group rule. It then shows the proposed changes needed to reconcile the infrastructure with the configuration.
- B. Incorrect.
Incorrect. terraform validate checks whether the Terraform configuration is syntactically valid and internally consistent. It does not query the provider or inspect live infrastructure, so it cannot detect a rule that was added manually in AWS.
- C. Incorrect.
Incorrect. terraform fmt only rewrites Terraform configuration files into a canonical format. It has nothing to do with state or drift detection and cannot update state from real infrastructure.
- D. Incorrect.
Incorrect. terraform output displays output values from Terraform state. It does not inspect AWS directly for unmanaged changes and is not intended for drift detection.