HashiCorp Terraform Associate (004) Question 90
Single answer4 Terraform configurationA team maintains a Terraform module that creates an application stack. The module currently works, but reviews are slow because formatting differs between contributors and several configuration mistakes are only found after running a full plan in CI. The team wants a simple way to improve consistency and catch configuration problems earlier without contacting remote APIs or requiring provider credentials. Which command should they add to their local workflow and CI pipeline to best meet this requirement?
- A
terraform validate
- B
terraform plan
- C
terraform apply -refresh-only
- D
terraform fmt -check -recursive
Show answer and explanation
Correct answer: A
Explanation
The best answer is terraform validate because it is intended to verify that Terraform configuration files are valid and internally consistent before execution. This aligns with Terraform best practices of validating configuration early in development and CI pipelines. In contrast, terraform fmt helps with style consistency but does not validate configuration logic, while terraform plan is a later-stage step that often requires provider credentials and remote API access. HashiCorp documentation distinguishes these commands clearly: fmt standardizes formatting, validate checks configuration validity, plan previews execution changes, and apply performs them. In a practical workflow, teams often use both terraform fmt -check and terraform validate, but because the question asks for the single best command to catch configuration problems early without a full plan, terraform validate is the correct choice.
- A. Correct.
Correct.
terraform validatechecks whether the Terraform configuration is syntactically valid and internally consistent. It is designed to catch many configuration errors before planning or applying. It does not create infrastructure and is useful in CI to detect issues early. While provider plugins may need to be available,validatedoes not perform the kind of remote infrastructure change or full execution thatplanandapplydo. In the scenario, the key requirement is to catch configuration problems earlier without contacting remote APIs or requiring a full plan, andvalidateis the best single command for that purpose. - B. Incorrect.
Incorrect.
terraform planis valuable, but it is not the best answer here because it is heavier-weight and typically requires more setup, including provider configuration and often access to remote APIs to refresh state and evaluate changes accurately. The scenario specifically asks for a way to catch configuration issues earlier without requiring a full plan in CI. - C. Incorrect.
Incorrect.
terraform apply -refresh-onlyis used to update state to reflect real infrastructure without changing remote objects beyond state reconciliation behavior. It still requires a configured working environment and is not intended as an early configuration validation step. It also goes far beyond what is needed for this requirement. - D. Incorrect.
Incorrect.
terraform fmt -check -recursiveis useful for enforcing consistent formatting across contributors, and many teams should include it in CI. However, formatting does not catch semantic or internal configuration problems such as invalid references, missing required arguments in resource blocks, or incompatible expressions. The scenario prioritizes catching configuration mistakes earlier, sovalidateis the better single answer.