HashiCorp Terraform Associate (004) Question 77
Single answer3f Destroy Terraform-managed infrastructureYour team uses Terraform to manage a temporary test environment in AWS. The environment was created successfully last week and is no longer needed. The Terraform configuration still exists locally, and the remote state is up to date. Before deleting anything, the team wants to review exactly which Terraform-managed resources will be removed. Which approach should the engineer take to safely preview the destruction and then remove the infrastructure if the review looks correct?
- A
Run
terraform plan -destroyto review the proposed deletions, then runterraform destroyto perform them after approval. - B
Run
terraform apply -destroyto generate a preview only, then runterraform destroyif the preview is acceptable. - C
Delete the resources manually in AWS first, then run
terraform refreshso Terraform updates the state and removes the infrastructure cleanly. - D
Run
terraform state rmfor all resources to mark them for deletion, then runterraform applyto destroy the actual infrastructure.
Show answer and explanation
Correct answer: A
Explanation
When destroying Terraform-managed infrastructure, a best-practice workflow is to preview the changes first with terraform plan -destroy, then perform the actual deletion with terraform destroy after review and approval. This helps avoid accidental removal of unexpected resources. HashiCorp documentation distinguishes planning from applying: terraform plan shows the proposed actions, while terraform destroy is a convenience command for destroying all resources tracked in the current state. Commands like terraform state rm modify state only and do not affect remote objects, and manual deletion outside Terraform can create drift and operational risk. For exam purposes, remember that the safest and most auditable approach is to review the destroy plan before executing it.
- A. Correct.
Correct.
terraform plan -destroycreates an execution plan showing what Terraform would destroy without actually deleting resources. After review,terraform destroyexecutes a destroy plan and prompts for confirmation unless auto-approve is used. This is the standard and safest workflow when you want to inspect intended deletions before removing Terraform-managed infrastructure. - B. Incorrect.
Incorrect.
terraform apply -destroydoes not provide a preview-only step. It both creates a destroy plan and, if approved, applies it. While this command can be used to destroy infrastructure, it is not the best answer when the requirement is to safely review the proposed deletions first and then perform the destruction as a separate step. - C. Incorrect.
Incorrect. Manually deleting resources outside Terraform is generally not the recommended workflow for Terraform-managed infrastructure. Doing so introduces drift between real infrastructure and state. Also,
terraform refreshdoes not "remove infrastructure cleanly"; it only updates state based on real-world resources. The proper approach is to let Terraform destroy resources it manages. - D. Incorrect.
Incorrect.
terraform state rmremoves resource bindings from the state file only; it does not destroy the real infrastructure. This is a common misconception. After removing resources from state, Terraform no longer tracks them, soterraform applywould not delete them. In fact, if the configuration still declares those resources, Terraform may attempt to recreate them instead.