HashiCorp Terraform Associate (004) Question 73
Single answer3e Apply changes to infrastructure with TerraformYour team manages an AWS VPC with Terraform. After reviewing a plan, you want to make sure the exact reviewed changes are what get applied in production, even if someone modifies the configuration files before the apply step. Which approach should you use?
- A
Run
terraform applywithout arguments immediately afterterraform plan, because Terraform automatically reuses the last plan it displayed. - B
Run
terraform plan -out=prod.tfplan, review that plan, and then runterraform apply prod.tfplan. - C
Run
terraform refreshbeforeterraform applyso Terraform locks in the reviewed changes from the earlier plan output. - D
Run
terraform apply -target=aws_vpc.mainso Terraform applies only the reviewed resource and ignores any later configuration changes.
Show answer and explanation
Correct answer: B
Explanation
The correct approach is to save the plan with terraform plan -out=FILE and then apply that saved plan with terraform apply FILE. This workflow is important when changes must be reviewed and approved before execution, because a saved plan file contains the specific actions Terraform intends to take based on the configuration, input variables, and state at planning time. By contrast, running terraform apply without a saved plan causes Terraform to generate a new execution plan, which may differ if anything changed. HashiCorp documentation describes this distinction between speculative plans shown in the terminal and saved plans intended for later application. Also, while targeting and refresh have valid uses, they do not provide the guarantee that the exact reviewed plan is what gets applied.
- A. Incorrect.
Incorrect. A plain
terraform applyperforms its own planning step before applying changes unless you provide a saved plan file. That means if the configuration, variables, or state have changed since the earlierterraform plan, the actions applied may differ from the plan you previously reviewed. A common misconception is that Terraform caches and automatically reuses the last displayed plan, but it does not do so unless you explicitly save and pass a plan file. - B. Correct.
Correct. Using
terraform plan -out=prod.tfplancreates a saved execution plan. Applying that exact file withterraform apply prod.tfplanensures Terraform executes the reviewed plan rather than recalculating a new one at apply time. This is the standard workflow when you need approval or separation between planning and applying, and it helps preserve the integrity of the reviewed changes. - C. Incorrect.
Incorrect.
terraform refreshupdates state to reflect real infrastructure, but it does not preserve or lock in a previously reviewed plan. It also does not ensure thatterraform applywill use the exact actions shown in a prior plan output. Candidates may choose this because refresh relates to state accuracy, but it does not solve the reviewed-plan integrity requirement. - D. Incorrect.
Incorrect.
-targetis intended for exceptional situations and does not guarantee that the exact reviewed full plan will be applied. It narrows the graph and can lead to partial or incomplete changes, which HashiCorp documentation generally discourages for routine use. It also does not prevent differences caused by later configuration changes; it simply changes the scope of what Terraform considers.