HashiCorp Terraform Associate (004) Question 72
Single answer3e Apply changes to infrastructure with TerraformA team manages its production infrastructure with Terraform. Before a maintenance window, an engineer runs terraform plan -out=tfplan and gets approval on the proposed changes. Two hours later, just before the window starts, another engineer commits an update to the same Terraform configuration and pushes it to the main branch. The original engineer must apply only the previously approved changes and avoid introducing any unreviewed configuration updates. What is the best action to take?
- A
Run
terraform applywithout arguments from the current working directory so Terraform recalculates the latest changes before applying. - B
Run
terraform apply tfplanto apply the exact execution plan that was approved earlier. - C
Run
terraform refreshand thenterraform applyso the state is updated before applying the approved infrastructure changes. - D
Run
terraform apply -target=<resource>for the resources shown in the earlier plan so only those reviewed resources are modified.
Show answer and explanation
Correct answer: B
Explanation
When an organization needs a clear separation between review and execution, the correct workflow is to generate a saved plan with terraform plan -out=<FILE> and later apply that file with terraform apply <FILE>. A saved plan preserves Terraform's intended actions at the time the plan was created, helping ensure the apply step matches what was reviewed. By contrast, running terraform apply without a plan file creates a fresh plan from the current configuration and state, which may include additional changes. HashiCorp documentation for the plan and apply commands describes this saved plan workflow and notes that applying a saved plan file prevents Terraform from prompting for a new plan calculation. This is a common best practice in production pipelines and approval-based deployment processes.
- A. Incorrect.
Incorrect. Running
terraform applywithout a saved plan causes Terraform to create a new execution plan based on the current configuration, state, and remote object data. Because the configuration changed after the original approval, this could include unreviewed changes. This is a common mistake when teams assumeapplywill reuse the last displayed plan automatically. - B. Correct.
Correct. Applying a previously saved plan file with
terraform apply tfplanexecutes the exact actions captured in that approved plan, rather than recalculating against the current configuration. This is the recommended way to separate planning from applying in controlled workflows where changes must be reviewed and approved before execution. - C. Incorrect.
Incorrect.
terraform refreshis not the right solution here. Even aside from workflow changes in newer Terraform versions, refreshing state and then runningterraform applywithout the saved plan would still generate a new plan from the current configuration, potentially including the newer unapproved commit. The misconception is that state refresh preserves the originally approved set of actions; it does not. - D. Incorrect.
Incorrect.
-targetis intended for exceptional situations and is not a reliable way to reproduce a previously approved plan. Targeting specific resources can lead to partial or incomplete application of changes and may still be affected by the current configuration. It does not guarantee execution of the exact reviewed plan and is generally not recommended for routine workflows.