HashiCorp Terraform Associate (004) Question 66
Single answer3d Generate and review an execution plan for TerraformYour team manages infrastructure with Terraform and stores state remotely. Before a production change window, you want a senior engineer to review the exact set of actions Terraform will take, and then have the pipeline apply only that reviewed plan without recalculating it later. Which approach best meets this requirement?
- A
Run
terraform plan -out=prod.tfplan, have the engineer review the plan output, and later runterraform apply prod.tfplan - B
Run
terraform apply -auto-approveduring the review window so Terraform shows the planned actions and then executes them immediately - C
Run
terraform plan, save the console output to a text file for approval, and later runterraform applywithout a plan file - D
Run
terraform refreshfirst, then runterraform applylater because refresh guarantees the later apply uses the reviewed actions
Show answer and explanation
Correct answer: A
Explanation
When Terraform must separate planning from execution, the correct practice is to generate a saved plan with terraform plan -out=FILE and then apply that exact plan using terraform apply FILE. This supports approval workflows and reduces the risk that a later apply will recalculate a different set of actions. By contrast, a normal terraform apply without a plan file performs its own planning step at apply time. The human-readable plan output is useful for review, but it is not itself executable. Terraform documentation distinguishes speculative plans from saved plans and explains that saved plan files can be applied later to execute the previously generated actions.
- A. Correct.
Correct.
terraform plan -out=prod.tfplancreates a saved execution plan file. Reviewing that plan and then applying it withterraform apply prod.tfplanensures Terraform executes the exact reviewed plan rather than generating a new one at apply time. This is the standard workflow when you need review/approval before execution. - B. Incorrect.
Incorrect.
terraform apply -auto-approveskips interactive approval and performs the apply immediately after planning. Although Terraform shows a plan as part of apply, this does not support a separate review-and-later-apply workflow, and it does not produce a reusable saved plan for later execution. - C. Incorrect.
Incorrect. Saving the human-readable console output from
terraform plandoes not create a reusable execution plan. If you later runterraform applywithout a saved plan file, Terraform generates a new plan at that time, which could differ from what was previously reviewed due to configuration, variable, or remote state changes. - D. Incorrect.
Incorrect.
terraform refreshupdates state to match remote objects, but it does not create a reviewed, reusable execution plan. A laterterraform applywithout a saved plan still recalculates actions. Also, refresh is not a substitute for saving and applying a plan file.