HashiCorp Terraform Associate (004) Question 54
Single answer3a Describe the Terraform workflowA platform engineer updates several Terraform configuration files to add a new AWS subnet and modify tags on an existing VPC. Before making any real infrastructure changes, the engineer wants to review exactly what Terraform will do and then apply only the reviewed changes. Which workflow best meets this requirement?
- A
Run
terraform applydirectly, because it automatically shows the execution plan before prompting for approval - B
Run
terraform validateand thenterraform destroyto confirm which resources would be recreated before reapplying them - C
Run
terraform plan -out=tfplanto generate a saved execution plan, review the proposed changes, and then runterraform apply tfplan - D
Run
terraform fmtand thenterraform apply -refresh-onlyto preview and apply the subnet creation without changing other resources
Show answer and explanation
Correct answer: C
Explanation
The Terraform workflow typically involves writing or updating configuration, initializing the working directory when needed, reviewing proposed changes with terraform plan, and then applying them with terraform apply. In scenarios where an engineer must review changes before execution and ensure the applied actions match the reviewed actions, the best practice is to save the plan using terraform plan -out=<file> and later apply that exact plan file with terraform apply <file>. This is more precise than running terraform apply without a saved plan, which generates a fresh plan at apply time. HashiCorp documentation for the Terraform workflow and CLI commands emphasizes the distinction between validation, planning, and applying, as well as the purpose of saved plan files in controlled deployment workflows.
- A. Incorrect.
Incorrect.
terraform applywithout a saved plan does display a proposed execution plan and prompt for approval in interactive mode, but it does not guarantee that the exact reviewed actions are what get applied later if anything changes between review and execution. Saving the plan withterraform plan -out=...and applying that saved plan is the correct workflow when you want to review specific changes first and then apply exactly those reviewed changes. - B. Incorrect.
Incorrect.
terraform validatechecks whether the configuration is syntactically valid and internally consistent, but it does not show the infrastructure changes Terraform will make.terraform destroyis used to remove managed infrastructure, not to review upcoming changes for a normal update workflow. This reflects a misconception that destroy can be used as a preview tool for standard modifications. - C. Correct.
Correct.
terraform plan -out=tfplancreates an execution plan file that records the actions Terraform intends to take based on the current configuration, state, and real infrastructure. After reviewing that plan,terraform apply tfplanapplies exactly the saved plan. This is the recommended workflow when you need a review step before applying changes and want to avoid differences between a newly generated plan and the one you reviewed. - D. Incorrect.
Incorrect.
terraform fmtformats Terraform configuration files for readability and style consistency; it does not affect the execution workflow for reviewing infrastructure changes.terraform apply -refresh-onlyupdates state and output values to reflect real infrastructure without making configuration-driven create, update, or delete changes, so it would not create a new subnet from the updated configuration.