HashiCorp Terraform Associate (004) Question 68
Single answer3d Generate and review an execution plan for TerraformYour team runs Terraform in CI for a shared AWS environment. A developer updates a module variable and asks you to verify exactly what infrastructure changes Terraform would make before anyone applies them. The team also wants the reviewed plan to be the same plan that is later applied in the deployment stage, to reduce the risk of differences caused by configuration drift or changed input values between steps. Which approach best meets this requirement?
- A
Run
terraform applyin the CI validation stage and answernowhen prompted, then rerunterraform applyin deployment if the output looked correct. - B
Run
terraform plan -out=tfplanin the CI validation stage, review the proposed changes, store the generated plan artifact securely, and later runterraform apply tfplanin deployment. - C
Run
terraform validatein the CI validation stage, because it shows what resources will be created, updated, or destroyed, then runterraform applyin deployment. - D
Run
terraform refreshin the CI validation stage to capture remote changes, then runterraform applylater because refresh output is equivalent to a saved execution plan.
Show answer and explanation
Correct answer: B
Explanation
The best practice for reviewing and then applying the exact same set of proposed changes is to generate a saved plan with terraform plan -out=FILENAME and later apply that file using terraform apply FILENAME. This supports controlled CI/CD workflows and approval gates. By contrast, terraform apply without a saved plan computes a new plan at execution time, which may differ from what was previously reviewed. terraform validate only checks configuration validity, not infrastructure changes, and terraform refresh is not a replacement for a saved execution plan. This behavior is documented in Terraform CLI workflow guidance for plan and apply, where saved plan files are specifically intended for review and later execution.
- A. Incorrect.
Incorrect. Running
terraform applyinteractively and declining the prompt can display a plan, but it does not create a saved plan file that can be reused later. If you rerunterraform applyin a later stage, Terraform generates a new plan at that time, which could differ because of changed variables, configuration, provider behavior, or remote system state. This fails the requirement to review and then apply the same exact plan. - B. Correct.
Correct.
terraform plan -out=tfplangenerates an execution plan file that can be reviewed and then applied later withterraform apply tfplan. This is the standard way to separate planning from applying while ensuring the reviewed plan is the same one used during deployment. It is particularly useful in CI/CD workflows where one stage creates and approves the plan and a later stage applies it. - C. Incorrect.
Incorrect.
terraform validatechecks whether the configuration is syntactically valid and internally consistent, but it does not compare configuration against current state and does not show an execution plan of creates, updates, or destroys. A common misconception is confusing validation with planning. - D. Incorrect.
Incorrect.
terraform refreshupdates state from real infrastructure state, but it does not produce a reusable execution plan equivalent toterraform plan -out=.... Also, modern Terraform workflows generally rely on normal planning and applying behavior rather than using refresh as a substitute for plan review. Refreshing state alone does not satisfy the requirement to review and later apply the same approved plan.