HashiCorp Terraform Associate (004) Question 75
Single answer3e Apply changes to infrastructure with TerraformYour team uses Terraform to manage a production VPC and EC2 instances. After reviewing a saved execution plan created earlier with terraform plan -out=prod.tfplan, the team approves the exact proposed changes. Before applying, another engineer modifies a tag in the Terraform configuration and runs terraform fmt, but no infrastructure has changed in the cloud. You want to ensure Terraform applies only the previously approved changes and does not incorporate the later configuration edit. Which command should you run?
- A
terraform apply
- B
terraform apply prod.tfplan
- C
terraform apply -auto-approve
- D
terraform plan -out=prod.tfplan && terraform apply
Show answer and explanation
Correct answer: B
Explanation
When a team needs to review and approve a specific set of infrastructure changes before execution, Terraform supports a two-step workflow: generate a saved plan with terraform plan -out=FILE, then apply that exact plan with terraform apply FILE. This is important because terraform apply by itself recalculates the plan using the current configuration, state, and real infrastructure at apply time. If configuration files changed after plan approval, those new changes can be included unless the saved plan file is explicitly used. This behavior aligns with Terraform CLI best practices for controlled change management, especially in production environments.
- A. Incorrect.
Incorrect. Running
terraform applywithout a saved plan causes Terraform to create a new plan from the current configuration and current state before applying. That means the later tag edit in the configuration could be included, which does not guarantee application of only the previously reviewed changes. - B. Correct.
Correct. Applying a saved plan file with
terraform apply prod.tfplantells Terraform to execute exactly the actions captured in that approved plan, rather than recalculating from the current configuration. This is the standard way to separate plan review from apply and preserve approval of a specific proposed change set. - C. Incorrect.
Incorrect.
-auto-approveonly skips the interactive approval prompt. It does not force Terraform to use the previously saved plan, so Terraform would still generate a new plan from the current configuration if no plan file is provided. - D. Incorrect.
Incorrect. This sequence creates a new plan using the current configuration, overwriting or replacing the previously approved intent. Because the scenario requires applying only the earlier approved changes, creating a fresh plan is specifically what should be avoided.