HashiCorp Terraform Associate (004) Question 70
Single answer3d Generate and review an execution plan for TerraformYour team uses Terraform in a CI pipeline to manage AWS infrastructure. A developer submits a change to increase the size of an existing EC2 instance and add a new security group rule. Before approving the pull request, you want reviewers to see exactly what Terraform intends to change without applying anything. You also want to make sure the exact reviewed plan is what gets applied later in the deployment stage, rather than recalculating a potentially different plan. Which approach best meets these requirements?
- A
Run
terraform apply -auto-approvein the review stage, because apply shows the planned changes before making them and guarantees the same actions are executed later. - B
Run
terraform plan -out=tfplanin the review stage, share the plan output with reviewers, and then runterraform apply tfplanin the deployment stage. - C
Run
terraform validatein the review stage, because it confirms whether Terraform will update the instance size and add the security group rule without making changes. - D
Run
terraform refreshin the review stage, because it compares remote infrastructure to configuration and produces a reusable execution plan for later application.
Show answer and explanation
Correct answer: B
Explanation
To generate and review an execution plan, Terraform provides the terraform plan command. When used with -out=FILE, Terraform saves the generated plan to a file. Applying that file later with terraform apply FILE ensures Terraform executes the exact reviewed plan rather than recalculating one that could differ due to configuration, variable, or infrastructure changes between stages. This pattern is common in CI/CD pipelines where one stage performs plan and review, and a later stage performs deployment. By contrast, terraform validate only checks configuration validity, not proposed infrastructure changes. terraform refresh updates state from remote objects but is not a review-and-apply workflow for planned changes. HashiCorp documentation for plan and apply describes saving and applying plan files as the proper way to separate review from execution.
- A. Incorrect.
Incorrect.
terraform applydoes display a plan before execution unless auto-approval bypasses confirmation, but it also performs the changes immediately. In a review stage, this violates the requirement to inspect changes without applying them. It also does not separate review from deployment in a controlled way. - B. Correct.
Correct.
terraform plan -out=tfplancreates an execution plan file that can be reviewed and then applied later withterraform apply tfplan. This is the recommended approach when you want to inspect proposed changes first and ensure the exact saved plan is what gets executed later, instead of generating a new plan at apply time. - C. Incorrect.
Incorrect.
terraform validatechecks configuration syntax and internal consistency, such as whether references are valid and required arguments are present. It does not compare configuration to current state or provider-managed resources, so it cannot show the actual infrastructure changes Terraform intends to make. - D. Incorrect.
Incorrect.
terraform refreshupdates Terraform state with information from real infrastructure, but it does not create a reusable execution plan for later application. It is not the correct command for generating and preserving a reviewed plan in a CI/CD workflow.