HashiCorp Terraform Associate (004) Question 21
Single answer2 Terraform fundamentalsA platform team stores its Terraform configuration in Git and uses Terraform CLI in a CI pipeline. A new engineer updates an AWS VPC resource by changing only its tags and then opens a pull request. The team wants reviewers to see exactly what infrastructure Terraform intends to change before approving the merge, without making any real changes to the environment. Which Terraform command should the CI job run for this purpose?
- A
terraform apply
- B
terraform plan
- C
terraform refresh
- D
terraform validate
Show answer and explanation
Correct answer: B
Explanation
The correct answer is terraform plan. In Terraform fundamentals, plan is the command used to preview infrastructure changes before they are applied. It is especially common in CI/CD workflows because it allows teams to review the proposed actions safely. terraform apply would make real changes, which violates the requirement. terraform validate only checks configuration validity, and terraform refresh is not the correct review tool for proposed changes. HashiCorp documentation describes terraform plan as generating and showing an execution plan so you can review actions Terraform will take before applying them.
- A. Incorrect.
Incorrect.
terraform applycreates, updates, or destroys real infrastructure to match the execution plan. While it does show a plan before applying unless auto-approve is used, it is not the right choice when the requirement is to review intended changes without modifying the environment. - B. Correct.
Correct.
terraform plancompares the configuration, current state, and real infrastructure information available through providers, then generates an execution plan showing what Terraform would do. This is the standard command used in pull request reviews and CI pipelines when teams want visibility into proposed changes without applying them. - C. Incorrect.
Incorrect.
terraform refreshupdates the Terraform state to match remote infrastructure, but it is not intended as the primary review mechanism for proposed configuration changes. In modern workflows, refreshing happens as part of planning and applying. Running refresh alone does not present the same review-focused execution plan for a configuration change. - D. Incorrect.
Incorrect.
terraform validatechecks whether the configuration is syntactically valid and internally consistent, but it does not compare configuration to state or remote infrastructure. It cannot show whether changing VPC tags will result in an in-place update, replacement, or no change.