HashiCorp Terraform Associate (004) Question 45
Single answer2d Explain how Terraform uses and manages stateA team stores its Terraform state in an S3 backend with DynamoDB state locking. One engineer manually deletes an EC2 instance in AWS outside of Terraform, but no one updates the Terraform configuration. Later, another engineer runs terraform plan from the same workspace. What is the most likely outcome, and why?
- A
Terraform will detect that the resource recorded in state no longer exists in AWS and will propose recreating it to match the configuration.
- B
Terraform will only compare the configuration to the local .tf files, so the deleted EC2 instance will remain in state until terraform refresh is run separately.
- C
Terraform will fail immediately because the DynamoDB lock indicates the previous resource is missing and the state file is now invalid.
- D
Terraform will remove the missing EC2 instance from state automatically and make no infrastructure changes, because the configuration was not modified.
Show answer and explanation
Correct answer: A
Explanation
Terraform state is the authoritative record Terraform uses to map resource addresses in configuration to real-world infrastructure objects. On terraform plan, Terraform compares the desired configuration, the stored state, and the current remote infrastructure as read through the provider. If an object tracked in state has been deleted outside Terraform but is still defined in configuration, Terraform identifies that drift and generally plans to recreate the object. Remote backends such as S3 store the state centrally, and DynamoDB locking helps prevent simultaneous state modification, but locking does not detect or correct infrastructure drift by itself. This aligns with Terraform documentation on state, refresh during planning, drift detection, and remote state backends with locking best practices.
- A. Correct.
Correct. Terraform state records Terraform's last known mapping between configuration resources and real infrastructure objects. During planning, Terraform refreshes its understanding of managed objects by querying the provider unless using options that disable refresh behavior. If a resource in state has been deleted outside Terraform but is still declared in configuration, Terraform will typically show drift and propose creating the resource again so actual infrastructure matches the desired configuration.
- B. Incorrect.
Incorrect. This reflects an outdated or incomplete understanding of Terraform workflows. In normal plan operations, Terraform consults both configuration and current remote object data through the provider. A separate terraform refresh command is not required in typical modern workflows to detect that a managed object was deleted outside Terraform.
- C. Incorrect.
Incorrect. DynamoDB locking is used to coordinate state operations and prevent concurrent writes to the state, not to validate whether infrastructure objects still exist. A deleted EC2 instance does not by itself make the state file invalid or cause a lock-related failure.
- D. Incorrect.
Incorrect. Terraform does not silently forget a resource just because it disappeared remotely while it is still present in configuration. If the resource remains declared, Terraform's goal is to reconcile actual infrastructure back to the desired state, which usually means proposing recreation rather than just removing it from state.