HashiCorp Terraform Associate (004) Question 196
Single answer7c Describe when and how to use verbose loggingA platform engineer runs terraform apply in a CI job and sees a generic provider error during refresh: Error: Request failed. The team cannot reproduce the issue locally and needs more detail from the failing pipeline run without changing the configuration itself. Which action is the most appropriate way to enable verbose logging for troubleshooting this Terraform run?
- A
Set the environment variable
TF_LOG=TRACEfor the CI job, rerun the command, and review the emitted logs carefully because they can include sensitive data. - B
Add
logging { level = "trace" }to the Terraform configuration and rerunterraform applyso Terraform Core and providers output debug logs. - C
Run
terraform apply -verbosein the CI job to print provider API requests and responses directly to the console. - D
Set
TF_INPUT=TRACEin the CI job so Terraform prompts for additional diagnostic details during execution.
Show answer and explanation
Correct answer: A
Explanation
The best practice for troubleshooting Terraform CLI execution is to enable verbose logging with the TF_LOG environment variable, typically setting it to one of Terraform's supported log levels such as TRACE, DEBUG, INFO, WARN, or ERROR. For deep troubleshooting, TRACE is commonly used because it provides the most detail. This is especially useful in CI/CD pipelines when a failure cannot be reproduced locally and you want more insight into Terraform Core and provider interactions without editing the infrastructure code. Candidates should also know that verbose logs can expose secrets, credentials, request payloads, or other sensitive values, so logs should be captured, stored, and shared carefully. HashiCorp documentation on debugging Terraform explicitly recommends TF_LOG for this purpose.
- A. Correct.
Correct. Terraform supports verbose logging through the
TF_LOGenvironment variable. Setting it to a level such asTRACEenables the most detailed logs, which is appropriate when troubleshooting intermittent or hard-to-reproduce failures in automation. This is also a practical choice in CI because it does not require modifying the Terraform configuration. HashiCorp documentation also warns that logs may contain sensitive information, so they should be handled carefully. - B. Incorrect.
Incorrect. Terraform does not support a
loggingblock in configuration for enabling Terraform CLI verbose logs. This distractor reflects a common misconception that logging is configured inside.tffiles. In practice, Terraform CLI logging is controlled with environment variables such asTF_LOG, not with a configuration block. - C. Incorrect.
Incorrect.
terraform applydoes not have a-verboseflag for enabling detailed Terraform or provider logs. Someone might choose this because many CLI tools use a verbose flag, but Terraform uses environment variables for log verbosity instead. - D. Incorrect.
Incorrect.
TF_INPUTcontrols whether Terraform asks for interactive input, typicallytrueorfalse. It has nothing to do with logging levels or diagnostics. This option tests the common mistake of confusing Terraform environment variables with one another.