HashiCorp Terraform Associate (004) Question 67
Single answer3d Generate and review an execution plan for TerraformYour team uses Terraform in a CI pipeline to manage AWS infrastructure. A pull request changes an EC2 instance type and adds a new security group rule. The pipeline currently runs terraform plan during review, and after approval it runs terraform apply separately. Your lead wants to ensure that the exact reviewed changes are what get applied later, even if external conditions change between the two steps. Which action best meets this requirement?
- A
Run
terraform plan -out=tfplanduring review, store the generated plan artifact securely, and later runterraform apply tfplanin the deployment step. - B
Run
terraform planduring review, copy the console output into the pull request, and later runterraform applyso Terraform recomputes the same plan automatically. - C
Run
terraform refreshafter approval, then runterraform applyto guarantee the apply step matches the previously reviewed plan. - D
Run
terraform apply -auto-approveduring review to ensure the reviewed changes are identical to what will be applied after approval.
Show answer and explanation
Correct answer: A
Explanation
To ensure the exact reviewed changes are applied later, Terraform best practice is to save the execution plan to a file using terraform plan -out=FILENAME and then apply that saved plan with terraform apply FILENAME. Without a saved plan file, terraform apply generates a new execution plan at apply time, which may differ from the earlier review output if anything changed in configuration inputs, state, or the target environment. This distinction is important in CI/CD workflows where plan and apply occur in separate stages. HashiCorp documentation for terraform plan and terraform apply describes this saved plan workflow and notes that applying a saved plan executes the actions captured in that file rather than recalculating them.
- A. Correct.
Correct. Saving a plan with
terraform plan -out=tfplancreates a plan file containing the exact execution plan Terraform generated at review time. Applying that saved plan withterraform apply tfplanensures Terraform executes the reviewed plan rather than recalculating a new one during apply. This is the standard approach when you need a human-reviewed plan to match the final deployment step. - B. Incorrect.
Incorrect. Reviewing plain text plan output is useful for humans, but if you later run
terraform applywithout a saved plan file, Terraform creates a new plan before applying. Changes in state, configuration, variables, provider behavior, or remote infrastructure between the review step and apply step can produce a different result from what was reviewed. - C. Incorrect.
Incorrect. Refreshing state can change Terraform's understanding of real infrastructure, but it does not preserve or enforce the previously reviewed execution plan. In fact, running refresh before apply may lead to a newly calculated plan that differs from the one seen during review.
- D. Incorrect.
Incorrect.
terraform apply -auto-approveskips the interactive approval prompt and immediately applies changes. It does not support a separate review-and-apply workflow, and it defeats the goal of having a reviewed plan applied later in a controlled deployment step.