HashiCorp Terraform Associate (004) Question 55
Single answer3a Describe the Terraform workflowA platform team stores Terraform configuration for a shared AWS VPC in a Git repository. A network engineer updates the configuration to add new subnets and wants to review the exact infrastructure changes before modifying any real resources. The team also wants to avoid accidentally applying changes from an outdated local state snapshot. Which workflow step should the engineer take next to best meet these requirements?
- A
Run terraform validate to compare the configuration against the current infrastructure and preview the subnet changes
- B
Run terraform plan so Terraform refreshes state, compares the configuration to the current state, and shows the proposed execution plan before any changes are made
- C
Run terraform fmt and then terraform apply -auto-approve so the configuration is normalized and applied consistently
- D
Run terraform output to confirm the current VPC values and then manually compare them to the updated configuration
Show answer and explanation
Correct answer: B
Explanation
In the standard Terraform workflow, practitioners typically write or modify configuration, optionally run formatting and validation checks, then use terraform plan to review proposed changes, and finally use terraform apply to make approved changes. In this scenario, terraform plan is the correct next step because it shows the execution plan before any resources are changed. It also refreshes state by default in normal planning behavior, helping Terraform compare configuration, state, and real infrastructure to detect drift or stale assumptions. HashiCorp documentation describes plan as the command that creates an execution plan and apply as the step that executes it. validate and fmt are useful supporting commands, but they do not preview infrastructure changes.
- A. Incorrect.
Incorrect. terraform validate checks whether the configuration is syntactically valid and internally consistent, but it does not contact providers to compare against real infrastructure or generate a change preview. A candidate might choose this because validate is part of a common workflow, but it is not the step used to review proposed infrastructure changes.
- B. Correct.
Correct. terraform plan is the workflow step designed to review intended changes before applying them. It evaluates the configuration, refreshes state by reconciling it with real infrastructure unless refresh is disabled, and produces an execution plan showing what Terraform would create, update, or destroy. This directly addresses both requirements: previewing the subnet changes and reducing the risk of acting on stale state.
- C. Incorrect.
Incorrect. terraform fmt only rewrites configuration files into a canonical format and does not assess infrastructure changes. terraform apply -auto-approve would skip interactive approval and make changes immediately, which is the opposite of the stated goal to review exact changes first. The distractor reflects a common misconception that formatting or auto-approval improves safety in the review stage.
- D. Incorrect.
Incorrect. terraform output only displays output values that are already defined in the configuration and stored in state after apply. It does not generate a proposed change set or verify whether the local understanding of infrastructure is current. Manual comparison is also error-prone and not the standard Terraform workflow for change review.