HashiCorp Terraform Associate (004) Question 69
Single answer3d Generate and review an execution plan for TerraformYour team uses Terraform in a CI/CD pipeline to manage AWS infrastructure. A pull request changes an EC2 instance type and updates tags on several resources. The reviewer wants to inspect the exact changes before approval and ensure that the same reviewed plan is what gets applied later in production, without Terraform recalculating against potentially changed remote objects. Which approach best meets this requirement?
- A
Run
terraform plan -out=tfplan, review the proposed changes, and later runterraform apply tfplan - B
Run
terraform plan, save the console output to a text file, and later runterraform applyso Terraform uses the reviewed output - C
Run
terraform refreshfirst, then runterraform applybecause refresh guarantees the apply step will match the earlier review - D
Run
terraform plan -destroy, review the output, and later runterraform applyto ensure all pending changes are captured
Show answer and explanation
Correct answer: A
Explanation
The key requirement is to review a plan and then apply that exact plan later without recalculating. In Terraform, this is done by creating a saved plan file with terraform plan -out=FILENAME and applying it with terraform apply FILENAME. This differs from simply reviewing terminal output, which is only a human-readable representation and cannot be used to guarantee the same actions later. This behavior is documented in Terraform CLI workflow guidance for plan and apply: a saved plan file lets operators separate planning from application and supports controlled approval workflows. In real-world CI/CD pipelines, this approach is commonly used to prevent drift between review time and apply time caused by new commits, changed variables, refreshed state, or infrastructure changes.
- A. Correct.
Correct.
terraform plan -out=tfplancreates a saved execution plan file containing the planned actions. Reviewing that plan and then applying it withterraform apply tfplanensures Terraform executes the exact reviewed plan rather than generating a new one at apply time. This is a common best practice in automated workflows when you want plan/apply separation and stronger change-control. - B. Incorrect.
Incorrect. Saving the human-readable console output does not create a reusable execution plan. If you later run
terraform applywithout a saved plan file, Terraform will generate a new plan at that time, which may differ if configuration, state, variables, or remote infrastructure changed. This is a common misconception because the displayed plan looks authoritative, but only a saved plan file can be applied directly. - C. Incorrect.
Incorrect.
terraform refreshupdates state to reflect real infrastructure, but it does not preserve a reviewed execution plan for later use. A subsequentterraform applystill computes a new plan unless you provide a saved plan file. Candidates may choose this because they associate refresh with synchronization, but synchronization is not the same as reusing an approved plan. - D. Incorrect.
Incorrect.
terraform plan -destroycreates a plan to destroy managed infrastructure, which is unrelated to reviewing normal in-place updates such as instance type or tag changes. It would produce the wrong kind of plan for this scenario and would not help preserve the intended non-destructive changes for later apply.