HashiCorp Terraform Associate (004) Question 52
Single answer3a Describe the Terraform workflowA platform team stores its Terraform configuration in Git and uses a remote backend for shared state. A team member updates the configuration to add a new subnet and wants to review the exact infrastructure changes before applying them in production. Which Terraform command sequence best follows the recommended workflow for safely previewing and then making the change?
- A
Run
terraform validate, thenterraform applyto see the proposed changes during the apply step - B
Run
terraform init, thenterraform plan, review the execution plan, and finally runterraform apply - C
Run
terraform refresh, thenterraform destroyand recreate the infrastructure withterraform apply - D
Run
terraform fmt, thenterraform output, and finallyterraform apply -refresh-only
Show answer and explanation
Correct answer: B
Explanation
The recommended Terraform workflow for applying infrastructure changes is to initialize the working directory with terraform init, review proposed changes with terraform plan, and then execute them with terraform apply. This is especially important in team environments using remote state, where understanding the impact of a change before applying it reduces risk. Supporting commands like terraform fmt and terraform validate are useful during development, but they do not replace the execution plan as the primary review step. HashiCorp documentation consistently describes the core workflow as write configuration, initialize, plan, and apply, with plan serving as the key step for previewing changes before they are made.
- A. Incorrect.
terraform validateis useful for checking whether the configuration is syntactically valid and internally consistent, but it does not replace creating and reviewing an execution plan. Whileterraform applywill show a plan before asking for approval in many interactive cases, the safer and recommended workflow is to explicitly runterraform planfirst so changes can be reviewed before execution. This option reflects a common misconception that validation alone is sufficient for change review. - B. Correct.
This is correct. In the normal Terraform workflow,
terraform initprepares the working directory, installs required providers, and configures the backend.terraform planthen compares the configuration with the current state and real infrastructure to show the proposed actions. After reviewing the plan,terraform applyis used to make the approved changes. This sequence matches Terraform best practices for safely previewing and applying infrastructure changes. - C. Incorrect.
terraform refreshis not the recommended way to preview intended configuration changes, andterraform destroyis used to remove managed infrastructure, not to safely introduce a new subnet. Recreating infrastructure to make a routine change is disruptive and unnecessary. This distractor targets the misconception that destroy-and-recreate is part of a standard change workflow. - D. Incorrect.
terraform fmthelps enforce canonical formatting, andterraform outputdisplays output values after resources exist, but neither command previews infrastructure changes.terraform apply -refresh-onlyupdates state to match real infrastructure without proposing configuration-driven changes such as creating a new subnet. This option confuses maintenance commands with the standard plan/apply workflow.