HashiCorp Terraform Associate (004) Question 23
Single answer2 Terraform fundamentalsA platform team stores its Terraform configuration in Git and wants every engineer to review the exact infrastructure changes before anything is applied. During testing, one engineer runs terraform plan in the morning, another engineer changes a variable value in terraform.tfvars before lunch, and a third engineer runs terraform apply in the afternoon without any additional arguments. The team notices that the applied changes do not match the morning review. Which action should the team take to ensure Terraform applies exactly the reviewed execution plan?
- A
Run
terraform refreshimmediately beforeterraform applyso the reviewed changes are preserved - B
Save the plan with
terraform plan -out=tfplanand later runterraform apply tfplan - C
Run
terraform apply -auto-approveright after reviewing the plan output in the terminal - D
Set
TF_LOG=TRACEduringterraform applyso Terraform uses the same decisions made duringterraform plan
Show answer and explanation
Correct answer: B
Explanation
Terraform fundamentals include understanding the difference between speculative plans shown in the terminal and saved execution plans. When you run terraform plan without -out, the result is only displayed for review and is not persisted for later application. A later terraform apply without a plan file creates a fresh plan using the current configuration, variables, and state, so the actions may differ from what was originally reviewed. To ensure the applied changes exactly match the reviewed plan, generate a saved plan with terraform plan -out=tfplan and then apply that file with terraform apply tfplan. This aligns with Terraform CLI workflow guidance in HashiCorp documentation on plan and apply, and is a common best practice in team-based review and approval workflows.
- A. Incorrect.
Incorrect.
terraform refreshupdates Terraform's view of real infrastructure state, but it does not preserve or lock in a previously reviewed execution plan. If configuration files, variables, or state have changed, a laterterraform applywithout a saved plan will recalculate actions and may produce different changes. - B. Correct.
Correct. Saving the plan to a file with
terraform plan -out=tfplancreates an execution plan artifact that can be reviewed and then applied later withterraform apply tfplan. This is the standard way to ensure Terraform applies exactly the set of actions that were reviewed, assuming the plan is still valid at apply time. - C. Incorrect.
Incorrect.
-auto-approveonly skips the interactive approval prompt. It does not guarantee that the actions being applied match an earlier reviewed plan. Ifterraform applyis run without a saved plan file, Terraform generates a new plan before applying, which can differ from the earlier terminal output. - D. Incorrect.
Incorrect.
TF_LOG=TRACEenables verbose logging for troubleshooting. It has no effect on whether Terraform reuses a prior plan or applies the exact previously reviewed changes. This option reflects a common misconception that logging settings influence execution behavior.