HashiCorp Terraform Associate (004) Question 71
Single answer3e Apply changes to infrastructure with TerraformA team maintains a Terraform configuration for an AWS environment in a remote workspace. Before deploying a small networking change, an engineer runs terraform plan -out=tfplan and gets approval from the change board. An hour later, another team member merges a separate Terraform change that modifies tags on the same VPC and applies it successfully. The original engineer now wants to deploy only the reviewed changes and avoid applying anything different from what was approved. What is the best action to take?
- A
Run
terraform apply tfplanto apply exactly the previously saved execution plan. - B
Run
terraform applywithout arguments so Terraform refreshes state and recomputes the safest changes. - C
Run
terraform plan -destroyand thenterraform applyto clear any drift before reapplying the approved change. - D
Run
terraform apply -refresh-onlyand thenterraform apply tfplanto update state and preserve the original reviewed plan.
Show answer and explanation
Correct answer: A
Explanation
When a team needs a strict review-and-apply workflow, Terraform supports saving an execution plan with terraform plan -out=FILE and later applying that exact plan with terraform apply FILE. This is important because applying without a saved plan causes Terraform to generate a new plan, which may include different actions if configuration, state, variables, or real infrastructure changed in the meantime. In practice, Terraform plans are based on a snapshot of prior state and planning decisions taken at plan time, so a saved plan is the correct mechanism when approvals must map to a specific set of actions. HashiCorp documentation for the Terraform CLI describes that terraform apply can either generate a plan automatically or execute a previously saved plan file, and that the saved plan preserves the exact actions that were planned.
- A. Correct.
Correct. Applying a saved plan file with
terraform apply tfplantells Terraform to execute the exact set of actions captured in that approved plan, rather than recalculating a new plan at apply time. This is the recommended approach when you need separation between plan review and apply, because the saved plan locks in the intended actions and input values from the planning step. - B. Incorrect.
Incorrect. Running
terraform applywithout a saved plan causes Terraform to create a new execution plan before applying. Because the state and possibly the remote objects changed after the original plan was reviewed, the new plan may differ from what the change board approved. This is safer for general day-to-day work, but it does not meet the scenario requirement to apply only the reviewed changes. - C. Incorrect.
Incorrect.
terraform plan -destroycreates a plan to destroy managed infrastructure, which is unrelated to this scenario and would be dangerous in a production environment. It does not 'clear drift' or reconcile state for a normal incremental change. - D. Incorrect.
Incorrect.
terraform apply -refresh-onlycreates and applies a refresh-only plan that updates state and outputs to match real infrastructure without changing remote objects. After doing that, the previously saved plan file may no longer be valid because it was built against an older state snapshot. This approach defeats the goal of applying the exact approved plan.