HashiCorp Terraform Associate (004) Question 46
Single answer3 Core Terraform workflowA team manages its infrastructure with Terraform. Before every production deployment, they want to review the exact changes Terraform intends to make, save that reviewed plan as an artifact in their CI pipeline, and then apply only those approved changes later in the release stage. Which approach best meets this requirement using the core Terraform workflow?
- A
Run
terraform applyin the review stage, because it shows the execution plan before asking for approval, then rerunterraform applyin the release stage. - B
Run
terraform plan -out=prod.tfplanin the review stage, store the generated plan file, and later runterraform apply prod.tfplanin the release stage. - C
Run
terraform planin the review stage, copy the console output into the change record, and later runterraform applyin the release stage to reproduce the same changes. - D
Run
terraform validate -out=prod.tfplanin the review stage, then runterraform apply prod.tfplanin the release stage.
Show answer and explanation
Correct answer: B
Explanation
In the core Terraform workflow, terraform plan is used to preview changes and terraform apply is used to execute them. When teams need a strict review-and-approve process, the best practice is to generate a saved plan with terraform plan -out=FILE and then apply that exact file with terraform apply FILE. This prevents Terraform from recalculating a potentially different plan at apply time. By contrast, running terraform apply without a saved plan creates a new plan immediately before execution. terraform validate is useful earlier in the workflow to check configuration correctness, but it is not a substitute for planning. This behavior is documented in Terraform CLI documentation for the plan, apply, and validate commands.
- A. Incorrect.
Incorrect. While
terraform applydoes display a plan before prompting for approval, using it in the review stage does not create a reusable approved plan artifact for a later stage. Rerunningterraform applylater causes Terraform to generate a new plan at that time, which could differ if infrastructure, variables, or state changed between stages. This does not satisfy the requirement to apply only the reviewed changes. - B. Correct.
Correct.
terraform plan -out=prod.tfplancreates a saved execution plan file. Storing that file as a CI artifact and later runningterraform apply prod.tfplanensures Terraform applies the exact reviewed plan, rather than recalculating changes. This is the standard workflow when approval must occur before apply and when teams want predictable, reviewed changes across pipeline stages. - C. Incorrect.
Incorrect. Plain
terraform planonly displays the proposed changes; it does not save a plan for later use. Runningterraform applylater without a saved plan causes Terraform to create a fresh execution plan, which may differ from what reviewers originally approved. A common misconception is that plan output in the console is enough to guarantee the same apply behavior later, but Terraform must use a saved plan file for that guarantee. - D. Incorrect.
Incorrect.
terraform validatechecks whether configuration is syntactically valid and internally consistent, but it does not generate an execution plan and does not support producing an applyable plan artifact with-out. This option confuses configuration validation with planning.