HashiCorp Terraform Associate (004) Question 78
Single answer3f Destroy Terraform-managed infrastructureYour team uses Terraform to manage a temporary test environment in AWS. The configuration has not changed, but the environment is no longer needed and must be removed. Before deleting anything, the operations engineer wants Terraform to show exactly which managed resources will be destroyed, and then perform the destruction only after approval. Which approach best meets this requirement?
- A
Run
terraform plan -destroyto review the proposed deletions, then runterraform destroyafter approval. - B
Run
terraform apply -destroyto review the proposed deletions, then approve the prompt to complete the destroy operation. - C
Delete the resources manually in AWS, then run
terraform refreshso Terraform updates the state and confirms the environment is destroyed. - D
Run
terraform state rmon all resources so Terraform stops managing them, then runterraform destroyto remove the infrastructure.
Show answer and explanation
Correct answer: A
Explanation
To destroy Terraform-managed infrastructure in a controlled way, the best practice is to preview the impact first and then execute the destroy. terraform plan -destroy shows a destroy plan without changing real infrastructure, allowing operators to review exactly what resources Terraform intends to delete. After approval, terraform destroy performs the actual deletion of managed resources. This aligns with Terraform CLI workflow guidance around planning before applying changes. In contrast, manual deletion causes drift, and terraform state rm only forgets resources in state rather than destroying them. For Terraform Associate 004, candidates should understand both the purpose of destroy operations and the difference between planning, applying, and manipulating state.
- A. Correct.
Correct.
terraform plan -destroycreates an execution plan that shows what Terraform would destroy without making changes. This is the safest way to review a full teardown before approval. After review,terraform destroycan be run to actually remove the Terraform-managed infrastructure. This matches a common operational workflow: inspect first, destroy second. - B. Incorrect.
Incorrect.
terraform apply -destroyis not the normal workflow for reviewing and then separately approving a destroy in Terraform Associate-level usage. While destroy mode can be invoked through planning/apply mechanics, the standard and clearest operational approach is to useterraform plan -destroyfor review andterraform destroyfor execution. This option also implies review and execution in a single command flow, which does not best match the requirement to inspect first and then perform the destroy after approval. - C. Incorrect.
Incorrect. Manually deleting resources outside Terraform introduces drift and bypasses Terraform's intended lifecycle management.
terraform refreshdoes not perform destruction; it only reconciles state with real infrastructure for supported workflows. This approach is error-prone and does not satisfy the requirement to have Terraform show a destruction plan before changes occur. - D. Incorrect.
Incorrect.
terraform state rmremoves resource bindings from the Terraform state but does not destroy the actual infrastructure. After removing resources from state, Terraform no longer manages them, soterraform destroywould not remove those resources. This is a common misconception: state operations affect Terraform's tracking, not the real infrastructure itself.