HashiCorp Terraform Associate (004) Question 197
Single answer7c Describe when and how to use verbose loggingA platform engineer runs terraform init in a CI job and it fails intermittently while downloading a provider from the registry. The standard error output only shows a generic network error, and the engineer needs more detail to determine whether the failure is caused by Terraform core, the provider installation process, or the remote service response. What is the best way to enable verbose logging for this troubleshooting session without changing the Terraform configuration itself?
- A
Set the
TF_LOGenvironment variable to a level such asDEBUGorTRACEbefore runningterraform init, and optionally setTF_LOG_PATHto write the logs to a file. - B
Add
log_level = "TRACE"to the root module so Terraform will emit detailed logs for all commands. - C
Run
terraform init -verboseto force Terraform to print internal plugin and HTTP logs to the console. - D
Set
TF_VAR_LOG=TRACEso Terraform treats logging as an input variable and increases output detail.
Show answer and explanation
Correct answer: A
Explanation
The best practice for Terraform verbose logging is to enable it only when troubleshooting because detailed logs can be noisy and may include sensitive information from provider interactions, request metadata, or configuration processing. In a real-world CI failure during terraform init, the most appropriate action is to set TF_LOG to a suitable level such as DEBUG or TRACE for that session. If log retention is needed, TF_LOG_PATH writes the output to a file. This approach helps distinguish whether an issue originates in Terraform core, provider/plugin installation, or an external registry/service response without modifying the Terraform configuration. HashiCorp documentation for Terraform CLI environment variables describes TF_LOG and TF_LOG_PATH as the standard mechanism for enabling detailed logs.
- A. Correct.
Correct. Terraform verbose logging is typically enabled with the
TF_LOGenvironment variable. Valid levels include values such asTRACE,DEBUG,INFO,WARN,ERROR, andOFF. For troubleshooting intermittent initialization, provider installation, registry communication, or other internal behavior, settingTF_LOG=DEBUGorTF_LOG=TRACEbefore running the command is the standard approach.TF_LOG_PATHcan also be set to persist logs to a file, which is especially useful in CI systems where console output may be truncated or hard to review later. - B. Incorrect.
Incorrect. Terraform does not support a
log_levelargument inside the root module or Terraform configuration files for enabling CLI debug logs. Logging is controlled through environment variables, not through HCL configuration. A candidate might choose this because many tools allow logging configuration in project files, but Terraform CLI diagnostic logging is external to the configuration. - C. Incorrect.
Incorrect. There is no general
-verboseflag forterraform initthat enables Terraform's internal diagnostic logging in this way. Terraform uses theTF_LOGmechanism instead. This distractor is plausible because many CLI tools use--verboseor-v, but that is not how Terraform Associate-level troubleshooting is performed for detailed internal logs. - D. Incorrect.
Incorrect.
TF_VAR_*environment variables are used to pass input variable values into Terraform, not to configure CLI logging behavior.TF_VAR_LOGwould only map to an input variable namedlogif one existed in the configuration. It would not increase diagnostic output. This reflects a common misunderstanding between Terraform environment variables for runtime behavior and those for variable injection.