HashiCorp Terraform Associate (004) Question 74
Single answer3e Apply changes to infrastructure with TerraformYour team manages a production VPC with Terraform. A teammate runs terraform plan -out=tfplan after updating only security group rules and shares the generated plan file for approval. Before deployment, another engineer manually changes a tag on the VPC in the cloud console, but no Terraform files are modified. To ensure Terraform applies exactly the reviewed changes and does not introduce any unexpected updates, what is the best next step?
- A
Run
terraform apply tfplanusing the saved plan file. - B
Run
terraform applywithout a plan file so Terraform refreshes state and recalculates the execution plan. - C
Run
terraform refreshand thenterraform apply tfplanso the saved plan file is updated with the latest remote changes. - D
Delete the state file and run
terraform applyto force Terraform to rebuild state from the configuration.
Show answer and explanation
Correct answer: A
Explanation
When you want Terraform to apply exactly what was reviewed, the best practice is to generate a saved execution plan with terraform plan -out=... and then apply that same file with terraform apply <planfile>. This separates review/approval from execution and prevents Terraform from generating a different plan at apply time. Terraform documentation describes that applying a saved plan performs the actions in that plan and does not prompt for additional approval. If the plan is no longer valid due to changes in configuration, state, or other relevant factors, Terraform will fail rather than silently substitute a new plan. By contrast, running terraform apply without a plan file always recalculates the plan first, which means drift or external changes can alter the resulting actions. This question tests practical understanding of safe apply workflows and the purpose of saved plan files in change-controlled environments.
- A. Correct.
Correct. Applying a previously saved plan file (
terraform apply tfplan) causes Terraform to execute the exact set of actions captured during the earlier planning step, which is the standard way to ensure the reviewed plan is what gets applied. If anything relevant has changed such that the plan is no longer valid, Terraform will reject the saved plan rather than silently recalculating a different one. - B. Incorrect.
Incorrect. Running
terraform applywithout a saved plan causes Terraform to create a new plan at apply time. That means the final actions may differ from the reviewed plan because Terraform will detect current remote object changes and recalculate what needs to be done. This is useful in some workflows, but it does not guarantee that only the previously approved changes are applied. - C. Incorrect.
Incorrect. A saved plan file is not updated in place by running
terraform refresh. Terraform plan files are snapshots of proposed actions based on the state and configuration at planning time. If you refresh or otherwise change the state, you would need to generate a new plan and have that new plan reviewed. This option reflects a common misconception that a plan file stays synchronized with current infrastructure. - D. Incorrect.
Incorrect. Deleting the state file is destructive to Terraform's tracking of managed resources and is not an appropriate way to handle drift or preserve a reviewed set of changes. In a production environment, removing state can lead to Terraform attempting to recreate existing resources or losing management continuity.