HashiCorp Terraform Associate (004) Question 189
Single answer7b Use the CLI to inspect stateA teammate reports that a Terraform-managed AWS EC2 instance was manually modified in the AWS console, and you need to inspect what Terraform currently believes is stored in state before deciding whether to run plan or import anything. The configuration uses a remote backend, and you do not want to change infrastructure or state. Which CLI command is the best choice to inspect the attributes Terraform currently has recorded for that specific resource instance?
- A
terraform state show aws_instance.web
- B
terraform show aws_instance.web
- C
terraform plan -target=aws_instance.web
- D
terraform refresh aws_instance.web
Show answer and explanation
Correct answer: A
Explanation
The correct answer is terraform state show aws_instance.web because the objective is to inspect what Terraform currently has recorded in state for a single resource instance. The terraform state subcommands are intended for working directly with state data, and state show is specifically used to view one resource by address. By contrast, terraform show is broader and does not support the provided single-resource syntax, terraform plan is used to evaluate proposed changes and detect drift rather than simply inspect state, and terraform refresh is not the appropriate read-only inspection tool for this task. This aligns with Terraform CLI documentation and best practice: use terraform state list to enumerate addresses and terraform state show to inspect a specific object's tracked attributes in state, especially when using a remote backend where Terraform still accesses state through the configured backend.
- A. Correct.
Correct.
terraform state show <address>displays the attributes Terraform currently has stored in state for the specified resource address. It is designed specifically for inspecting a single resource in state without modifying infrastructure. This is the most direct and safest CLI command for the scenario. - B. Incorrect.
Incorrect.
terraform showdisplays a human-readable representation of the entire state or a saved plan file, but it does not accept a resource address in this way to inspect one specific object. Someone might choose this because it sounds like a generic inspection command, but it is not the correct syntax for targeting a single resource in state. - C. Incorrect.
Incorrect.
terraform plan -target=aws_instance.webcreates an execution plan and compares configuration, state, and real infrastructure. While it may help identify drift, it is not the best command when the goal is specifically to inspect the attributes currently recorded in state. It is also more intrusive in terms of workflow and not a pure state-inspection command. - D. Incorrect.
Incorrect.
terraform refreshwas historically used to reconcile state with real infrastructure, but it is not the right choice here because the requirement is to inspect existing state without changing it. In modern Terraform workflows, refresh behavior is typically integrated into plan and apply operations rather than used as a targeted inspection command.