Auto-approve flag and its danger in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does the auto-approve flag do in Terraform?

When you run terraform apply with the -auto-approve flag, what happens?

A Terraform applies changes immediately without asking for confirmation.

B Terraform asks for manual approval before applying changes.

C Terraform only plans changes but does not apply them.

D Terraform destroys all resources without confirmation.

💡 Hint

Think about what 'auto' and 'approve' mean together.

The -auto-approve flag skips the manual confirmation step and applies changes right away.

❓ security

intermediate

What is a key risk of using the auto-approve flag in Terraform?

Why can using -auto-approve be dangerous in production environments?

A It can apply unintended destructive changes without manual review.

B It prevents Terraform from creating any resources.

C It disables logging of Terraform actions.

D It causes Terraform to ignore the state file.

💡 Hint

Consider what happens if you skip the manual check step.

Using -auto-approve skips the confirmation, so mistakes or destructive changes can be applied without review.

❓ service_behavior

advanced

What happens if you run terraform apply -auto-approve after modifying a resource to be destroyed?

Given a Terraform configuration where a resource is changed to be removed, what is the behavior when applying with -auto-approve?

Terraform

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"
}

# Later, this resource is removed from the config

# Running: terraform apply -auto-approve

A Terraform throws an error and stops.

B Terraform plans the destruction but waits for manual approval.

C Terraform ignores the removal and keeps the resource.

D Terraform immediately destroys the resource without asking for confirmation.

💡 Hint

Think about what skipping approval means for destructive actions.

The -auto-approve flag causes Terraform to apply all changes, including resource destruction, without confirmation.

✅ Best Practice

advanced

Which practice helps reduce risks when using the auto-approve flag?

To safely use -auto-approve in automation, what should you do?

A Always run <code>terraform apply -auto-approve</code> without planning.

B Disable state locking to speed up apply.

C Run <code>terraform plan</code> separately and review output before applying.

D Use <code>-auto-approve</code> only on destroy commands.

💡 Hint

Think about how to catch mistakes before applying changes.

Running terraform plan first lets you review changes and catch errors before applying with -auto-approve.

❓ Architecture

expert

In a CI/CD pipeline, what is a safe way to use the auto-approve flag?

You want to automate Terraform deployments in a pipeline but avoid accidental destructive changes. Which approach is safest?

A Run <code>terraform apply -auto-approve</code> directly on every commit.

B Run <code>terraform plan</code> and require manual approval before running <code>terraform apply -auto-approve</code>.

C Disable state locking to allow parallel applies with auto-approve.

D Use <code>-auto-approve</code> only on the destroy stage without planning.

💡 Hint

Consider how to balance automation and safety in pipelines.

Running plan and requiring manual approval before auto-approve apply prevents accidental destructive changes in automation.