HashiCorp Terraform Associate (004) Question 180
Single answer7 Maintain infrastructure with TerraformYour team manages production infrastructure with Terraform using a remote backend. During an incident review, you discover that an engineer manually changed the size of a cloud database instance in the provider console, and the running application now depends on that larger size. The Terraform code in Git still specifies the old, smaller size. You need to bring Terraform back into a maintainable state without causing Terraform to attempt to shrink or recreate the database on the next apply. What is the best action to take first?
- A
Run terraform refresh so Terraform updates the configuration in the .tf files to match the real infrastructure
- B
Update the Terraform configuration to the larger database size, then run terraform plan to verify Terraform sees no undesired change
- C
Run terraform taint on the database resource so Terraform will recreate it with the correct size from configuration
- D
Delete the resource from the Terraform state with terraform state rm so Terraform stops managing it until later
Show answer and explanation
Correct answer: B
Explanation
When infrastructure is changed outside Terraform, the result is drift between configuration, state, and real infrastructure. To maintain infrastructure safely, Terraform practitioners should first decide whether the manual change is acceptable and should become the new desired state. In this scenario, the larger database size is now required by the application, so the correct maintenance action is to update the Terraform configuration to match that intended state and then validate with terraform plan. Terraform state reflects observed or managed infrastructure, but state is not a substitute for configuration as the source of truth. Commands like terraform refresh (or the refresh behavior built into plan/apply in many workflows) update state, not .tf files. Similarly, terraform taint forces replacement, and terraform state rm stops management rather than reconciling drift. This aligns with Terraform best practices: keep configuration consistent with the intended infrastructure and use plan to review changes before apply.
- A. Incorrect.
Incorrect. terraform refresh updates Terraform state from real infrastructure; it does not rewrite the Terraform configuration files. If the configuration still contains the smaller size, a subsequent plan can still propose changing the resource to match configuration. This option reflects a common misconception that refresh reconciles code automatically.
- B. Correct.
Correct. In this scenario, the actual infrastructure has drifted, but the application now depends on the manually increased size. The safest first step is to update the Terraform configuration so it reflects the intended real-world state, then run terraform plan to confirm Terraform no longer proposes an unintended downgrade or replacement. This restores code-to-infrastructure alignment, which is essential for maintainability.
- C. Incorrect.
Incorrect. terraform taint marks a resource for recreation on the next apply. That is the opposite of what you want for a production database that should not be shrunk or recreated. Taint is used when you intentionally want replacement, not when preserving an adopted manual change.
- D. Incorrect.
Incorrect. Removing the resource from state makes Terraform forget it is managing that resource, but the infrastructure still exists. This does not solve the underlying drift and creates a new management gap. It is generally not the best first step when the goal is to continue managing the resource safely with Terraform.