HashiCorp Terraform Associate (004) Question 80
Single answer3f Destroy Terraform-managed infrastructureA team uses Terraform to provision a short-lived test environment in AWS. The root module currently manages an EC2 instance, a security group, and an S3 bucket. The team needs to remove only the EC2 instance from the real infrastructure immediately, while leaving the other Terraform-managed resources intact. They also want Terraform state to remain accurate after the change. What is the most appropriate way to do this?
- A
Run terraform destroy to remove all resources, then run terraform apply after commenting out the S3 bucket and security group so only the EC2 instance stays deleted.
- B
Delete the EC2 instance manually in the AWS console, then run terraform refresh so Terraform updates state and leaves configuration unchanged.
- C
Remove the EC2 instance resource block from configuration and run terraform apply so Terraform destroys only that managed resource and updates state accordingly.
- D
Run terraform state rm on the EC2 instance resource so Terraform forgets it, which also destroys the real EC2 instance without affecting other resources.
Show answer and explanation
Correct answer: C
Explanation
The best answer is to remove the EC2 instance from configuration and run terraform apply. In Terraform's declarative model, infrastructure that is no longer defined in configuration is planned for destruction if it is still tracked in state. This keeps both the real infrastructure and the state file aligned. By contrast, terraform destroy is for tearing down managed infrastructure broadly, not for routine selective removal of a single resource from an environment. Manually deleting resources outside Terraform causes drift and often leads Terraform to recreate them if configuration still expects them. Likewise, terraform state rm affects only state metadata and does not delete the underlying object. HashiCorp documentation and best practices emphasize making changes through configuration and applying them so Terraform can safely plan, destroy, and reconcile managed infrastructure.
- A. Incorrect.
Incorrect. terraform destroy is intended to destroy all managed infrastructure in the current working configuration unless specifically targeted. Using it here would remove the S3 bucket and security group too, which violates the requirement to preserve the rest of the environment. Re-applying afterward is unnecessary risk and operational overhead.
- B. Incorrect.
Incorrect. Manually deleting the instance in AWS introduces drift. Running terraform refresh (or a plan/apply that refreshes state) does not solve the core problem cleanly because the configuration still declares that instance. Terraform would detect it as missing and attempt to recreate it on the next apply, not treat it as intentionally removed.
- C. Correct.
Correct. If a managed resource should no longer exist, the normal workflow is to remove its resource block from the configuration and run terraform apply. Terraform compares the updated configuration to state, plans a destroy for that resource, and updates state after successful deletion. This is the standard declarative approach for removing a specific Terraform-managed resource while preserving other managed objects.
- D. Incorrect.
Incorrect. terraform state rm only removes the binding from Terraform state; it does not destroy the real infrastructure. The EC2 instance would continue to exist in AWS but would no longer be tracked by Terraform, creating an unmanaged resource. This is a common misconception between state operations and real infrastructure changes.