HashiCorp Terraform Associate (004) Question 181
Single answer7 Maintain infrastructure with TerraformA team manages an AWS VPC with Terraform. Last week, a network engineer manually changed one security group's ingress rules in the AWS Console to temporarily allow SSH from the internet. Today, you run terraform plan from the same workspace and state backend, and the plan shows that Terraform wants to remove that SSH rule. The team wants Terraform to continue managing the security group and to restore the configuration defined in code. Which action should you take next?
- A
Run
terraform applyto reconcile the real infrastructure back to the configuration stored in Terraform code - B
Run
terraform refreshso Terraform permanently updates the configuration to match the manually added SSH rule - C
Run
terraform state rmon the security group so Terraform stops trying to change it, then runterraform apply - D
Run
terraform importfor the security group to capture the manually added SSH rule in state without modifying the configuration
Show answer and explanation
Correct answer: A
Explanation
This question tests drift detection and correction, a core part of maintaining infrastructure with Terraform. When a resource managed by Terraform is changed outside Terraform, terraform plan compares the real infrastructure and current state against the configuration and shows the differences. If the configuration in code remains the source of truth, the correct action is to run terraform apply to reconcile the remote object back to the declared state. Terraform state records the current known state, but the configuration defines the desired state. Commands like terraform import and terraform state rm are for specific state-management situations and are not appropriate for routine drift correction of already managed resources. HashiCorp documentation and best practices emphasize using plan/apply to detect and correct drift while keeping configuration as the authoritative definition of infrastructure.
- A. Correct.
Correct. The manual AWS Console change created drift between the real infrastructure and the Terraform configuration. If the desired state is the configuration in code,
terraform applyis the correct next step because it will make the actual resource match the declared configuration again by removing the unauthorized ingress rule. - B. Incorrect.
Incorrect.
terraform refreshupdates Terraform state from real infrastructure, but it does not change Terraform configuration files. It would not make the SSH rule part of the desired configuration. In newer Terraform workflows, refresh is typically handled as part of plan and apply rather than used to adopt manual changes into code. - C. Incorrect.
Incorrect.
terraform state rmremoves the resource from Terraform state, which means Terraform would no longer track that existing security group. This is not appropriate when the team explicitly wants Terraform to continue managing the resource. It would create a management gap rather than reconcile drift. - D. Incorrect.
Incorrect.
terraform importis used to bring existing unmanaged resources under Terraform state. In this scenario, the security group is already managed by Terraform, so import is unnecessary. Importing also does not update the Terraform configuration to include the manually added rule.