HashiCorp Terraform Associate (004) Question 79
Single answer3f Destroy Terraform-managed infrastructureA team uses Terraform to manage a temporary test environment in AWS. The configuration includes an EC2 instance, security group, and related networking components. The environment is no longer needed, but the team wants Terraform to remove only the resources tracked in the current workspace's state and leave unrelated infrastructure in the AWS account untouched. Before deleting anything, they also want to review Terraform's proposed destruction actions. Which action should the engineer take?
- A
Run
terraform destroyto preview the changes, then runterraform applyto perform the deletion. - B
Run
terraform plan -destroyto review the proposed deletions, then runterraform destroyto remove the tracked resources. - C
Delete the resources manually in the AWS console, then run
terraform refreshso Terraform updates the state. - D
Run
terraform apply -destroybecause it deletes only resources that are not referenced by other AWS resources.
Show answer and explanation
Correct answer: B
Explanation
Terraform destroys infrastructure based on the resources recorded in the current state for the selected workspace, not by scanning and deleting all resources in a cloud account. To safely remove Terraform-managed infrastructure, a common best practice is to first review the plan using terraform plan -destroy, then execute the deletion with terraform destroy. This aligns with Terraform CLI behavior described in HashiCorp documentation: terraform plan -destroy shows what would be destroyed, while terraform destroy is a convenience command for destroying all remote objects managed by the current Terraform configuration and state. Manually deleting resources outside Terraform is not recommended because it causes drift and reduces Terraform's ability to manage lifecycle predictably.
- A. Incorrect.
Incorrect.
terraform destroydoes not act only as a preview; it is the command used to create and execute a destroy plan. In interactive mode it will prompt for approval before making changes, but it is not a review-only command. Also,terraform applywithout a saved destroy plan will try to reconcile configuration to the desired state, which usually means creating or updating resources, not deleting everything in state. - B. Correct.
Correct.
terraform plan -destroycreates a destruction plan so the engineer can review what Terraform intends to delete. After review,terraform destroyis the standard way to destroy all Terraform-managed resources tracked in the current state for that workspace. This matches the requirement to review proposed actions first and then remove only resources Terraform manages, rather than unrelated infrastructure in the account. - C. Incorrect.
Incorrect. Manually deleting resources in the AWS console bypasses Terraform and can leave the state out of sync.
terraform refreshdoes not perform a controlled destroy workflow; it only updates state based on real infrastructure and has been deprecated as a standalone workflow in favor of normal planning/apply behavior. This approach also removes the ability to review Terraform's intended destroy actions before changes are made. - D. Incorrect.
Incorrect.
terraform apply -destroyis a valid way to apply a destroy plan in some workflows, but the reason given is wrong. Terraform destroys resources based on the current state and dependency graph, not based on whether they are referenced by other AWS resources outside Terraform. The key requirement in the scenario is to review the destruction first, which is best satisfied withterraform plan -destroyfollowed byterraform destroy.