HashiCorp Terraform Associate (004) Question 22
Single answer2 Terraform fundamentalsA platform team is standardizing how Terraform is used across several environments. A developer updates a Terraform configuration to change an existing AWS security group rule and add a new tag to an EC2 instance. Before applying anything, the team wants to review exactly what Terraform intends to change and share that review artifact with another engineer for approval. Which approach best meets this requirement?
- A
Run
terraform validateand share the validation output, because it confirms what infrastructure changes Terraform will make. - B
Run
terraform plan -out=tfplanand share the saved plan, because it captures the proposed execution changes for later review and apply. - C
Run
terraform fmtand share the formatted configuration, because formatting ensures the configuration reflects the pending infrastructure updates. - D
Run
terraform apply -refresh-onlyand share the output, because it previews configuration changes without modifying infrastructure.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use terraform plan -out=tfplan. In Terraform fundamentals, plan is the command used to preview proposed infrastructure changes before they are applied. Saving the plan with -out is especially important in team workflows because it creates a plan artifact representing the exact actions reviewed and approved. That same saved plan can then be applied later with terraform apply tfplan, reducing the risk that a newly generated plan differs from the one that was reviewed. By contrast, validate checks configuration validity, fmt enforces style, and apply -refresh-only is for reconciling state with existing infrastructure rather than previewing intended configuration-driven changes. This aligns with Terraform CLI workflow guidance in HashiCorp documentation for terraform plan, terraform apply, terraform validate, and terraform fmt.
- A. Incorrect.
terraform validatechecks whether the configuration is syntactically valid and internally consistent, such as valid references and argument structure. It does not produce an execution plan showing what resources will be created, updated, or destroyed. A candidate might choose this option because validation is commonly part of CI workflows, but it does not satisfy the need to review intended infrastructure changes. - B. Correct.
terraform plan -out=tfplanis correct becauseterraform plancompares the current state, the real infrastructure state as refreshed, and the configuration to determine proposed actions. Using-outsaves the plan to a file so the exact reviewed plan can later be applied withterraform apply tfplan. This is the standard Terraform workflow when teams want a review/approval step between planning and applying. - C. Incorrect.
terraform fmtonly rewrites Terraform configuration files into a canonical format. It improves readability and consistency but has no effect on infrastructure planning or change previews. Someone might choose this because formatting is often part of team standards, but it does not show planned resource actions. - D. Incorrect.
terraform apply -refresh-onlyis incorrect because refresh-only mode is used to update Terraform state to match remote objects without changing remote infrastructure to fit the configuration. It is not a general-purpose preview of pending configuration changes like modifying a security group rule or adding a tag from code. Also,applyis an execution command, not the appropriate review artifact for planned changes.