HashiCorp Terraform Associate (004) Question 183
Single answer7 Maintain infrastructure with TerraformYour team manages a production VPC with Terraform. During troubleshooting, an engineer manually deleted one of the subnets in the cloud console, but no Terraform files were changed. Before applying any changes, you want to confirm exactly how Terraform sees the current infrastructure compared to the state file and configuration. Which action is the most appropriate to identify this out-of-band change with the least risk?
- A
Run terraform plan to compare the real infrastructure, the current state, and the configuration, and review the proposed changes.
- B
Run terraform refresh-only apply so Terraform automatically recreates the deleted subnet without changing state.
- C
Delete the state file and run terraform apply so Terraform rebuilds everything from configuration.
- D
Run terraform fmt and terraform validate to detect the missing subnet before making changes.
Show answer and explanation
Correct answer: A
Explanation
This question tests drift detection and safe maintenance practices. When infrastructure is changed outside Terraform, the recommended first step is usually terraform plan so you can review the proposed actions before modifying anything. Terraform uses state to track managed resources, but it also checks real infrastructure during planning to determine whether resources still exist and whether they match configuration. If a managed subnet was manually deleted, Terraform will typically show that resource as needing to be created again.
refresh-only operations are related but different: they are used to update state based on the current remote infrastructure without applying configuration changes to remote objects. They help reconcile state, but they do not recreate missing infrastructure. Deleting state is a common but serious misconception and should be avoided except in very specific recovery workflows. Likewise, fmt and validate are important maintenance commands, but they only operate on configuration, not live infrastructure.
This aligns with Terraform workflow best practices: review changes with terraform plan before applying, use state carefully, and avoid destructive troubleshooting steps when investigating drift.
- A. Correct.
Correct. terraform plan is the safest first step to identify drift caused by out-of-band changes. Terraform refreshes its understanding of remote objects during planning and compares the real infrastructure against both the recorded state and the configuration. In this scenario, the deleted subnet would typically appear in the plan as needing to be recreated, allowing the team to review intended actions before any infrastructure changes occur.
- B. Incorrect.
Incorrect. A refresh-only operation updates Terraform state to match remote infrastructure, but it does not recreate missing resources. In fact, refresh-only is intended to reconcile state with existing remote objects without proposing configuration-driven infrastructure changes. It is useful for observing drift in state, but not for automatically rebuilding deleted resources.
- C. Incorrect.
Incorrect. Deleting the state file is a dangerous and unnecessary action. The state file is Terraform's source of truth for tracked resources, and removing it can cause Terraform to lose resource mappings and potentially attempt to recreate or mismanage existing infrastructure. This is not a best practice for investigating drift.
- D. Incorrect.
Incorrect. terraform fmt only formats configuration files, and terraform validate checks whether the configuration is syntactically valid and internally consistent. Neither command inspects remote infrastructure, compares it to state, or detects that a subnet was manually deleted outside Terraform.