Auto-approve flag and its danger in Terraform - Mini Project: Build & Apply

Auto-approve Flag and Its Danger

📖 Scenario: You are managing infrastructure using Terraform. Terraform lets you apply changes to your cloud resources. There is a special flag called -auto-approve that skips the confirmation step before applying changes.Using this flag can be risky because it applies changes immediately without asking you to double-check. This can cause accidental changes or deletions.

🎯 Goal: You will create a simple Terraform configuration for an AWS S3 bucket. Then you will add a variable to control whether to use the -auto-approve flag. Finally, you will write a script snippet that applies Terraform changes safely without using -auto-approve by default.

📋 What You'll Learn

Create a Terraform configuration file for an AWS S3 bucket

Add a variable to control the use of the auto-approve flag

Write a shell script snippet that applies Terraform changes

Ensure the script does not use auto-approve by default

💡 Why This Matters

🌍 Real World

Terraform is widely used to manage cloud infrastructure. The auto-approve flag can speed up deployments but can cause accidental resource changes if used carelessly.

💼 Career

Understanding how to safely apply infrastructure changes with Terraform is essential for cloud engineers and DevOps professionals to avoid costly mistakes.

1

Create Terraform configuration for an AWS S3 bucket

Create a file named main.tf with a resource block for an AWS S3 bucket named exactly my-example-bucket. Use the resource type aws_s3_bucket and set the bucket attribute to "my-example-bucket".

Terraform

# Create the aws_s3_bucket resource named my-example-bucket
# Your code here

Hint

Use the resource keyword, resource type aws_s3_bucket, and name my_example_bucket. Set the bucket attribute to "my-example-bucket".

2

Add a variable to control auto-approve flag

In the same main.tf file, add a Terraform variable named auto_approve of type bool with a default value of false. This variable will control whether to use the auto-approve flag.

Terraform

resource "aws_s3_bucket" "my_example_bucket" {
  bucket = "my-example-bucket"
}

# Add variable auto_approve here
# Your code here

Hint

Use the variable block with name auto_approve. Set type = bool and default = false.

3

Write a shell script snippet to apply Terraform changes

Create a shell script snippet that runs terraform apply. Use the variable auto_approve to decide if the -auto-approve flag should be added. The script should use terraform apply without -auto-approve if auto_approve is false.

Terraform

resource "aws_s3_bucket" "my_example_bucket" {
  bucket = "my-example-bucket"
}

variable "auto_approve" {
  type    = bool
  default = false
}

# Add shell script snippet below
# Your code here

Hint

Use a shell if statement to check if TF_VAR_auto_approve equals true. Run terraform apply -auto-approve if true, else run terraform apply.

4

Complete the Terraform setup with provider configuration

Add the AWS provider block to main.tf with region set to us-east-1. This completes the Terraform configuration to deploy the S3 bucket safely.

Terraform

resource "aws_s3_bucket" "my_example_bucket" {
  bucket = "my-example-bucket"
}

variable "auto_approve" {
  type    = bool
  default = false
}

# Add AWS provider block below
# Your code here

# Shell script snippet
if [ "$TF_VAR_auto_approve" = "true" ]; then
  terraform apply -auto-approve
else
  terraform apply
fi

Hint

Add a provider "aws" block with region = "us-east-1" at the top of main.tf.

Practice

1. What does the -auto-approve flag do when running terraform apply?

easy

A. It cancels the apply process automatically.

B. It shows a detailed plan before applying changes.

C. It skips the confirmation prompt and applies changes immediately.

D. It only validates the configuration without applying changes.

Solution

1. Step 1: Understand the purpose of the -auto-approve flag

   This flag is designed to skip the manual confirmation step during terraform apply.

2. Step 2: Identify the effect on the apply process

   By skipping confirmation, Terraform applies changes immediately without waiting for user input.

3. Final Answer:

   It skips the confirmation prompt and applies changes immediately. -> Option C

4. Quick Check:

   -auto-approve skips confirmation [OK]

Hint: Remember: auto-approve means no manual confirmation [OK]

Common Mistakes:

• Thinking it shows the plan before applying
• Assuming it cancels the apply
• Confusing it with validation only

2. Which is the correct syntax to apply Terraform changes without confirmation?

easy

A. terraform apply --force-apply

B. terraform apply --skip-confirm

C. terraform apply --no-approve

D. terraform apply -auto-approve

Solution

1. Step 1: Recall the exact flag name for skipping confirmation

   The correct flag is -auto-approve, which tells Terraform to apply changes without asking.

2. Step 2: Check the options for correct syntax

   Only terraform apply -auto-approve uses the correct flag -auto-approve with proper syntax.

3. Final Answer:

   terraform apply -auto-approve -> Option D

4. Quick Check:

   Correct flag syntax is -auto-approve [OK]

Hint: Flag always spelled exactly as -auto-approve [OK]

Common Mistakes:

• Using --skip-confirm which does not exist
• Confusing with --no-approve or --force-apply
• Adding extra dashes or misspelling the flag

3. Given this command: terraform apply -auto-approve, what is the main risk involved?

medium

A. Changes will be applied without reviewing the plan first.

B. Terraform will only validate the configuration.

C. Terraform will prompt twice for confirmation.

D. Terraform will not apply any changes.

Solution

1. Step 1: Understand what -auto-approve does

   This flag skips the manual confirmation step, so Terraform applies changes immediately.

2. Step 2: Identify the risk of skipping confirmation

   Without reviewing the plan, unintended or harmful changes might be applied automatically.

3. Final Answer:

   Changes will be applied without reviewing the plan first. -> Option A

4. Quick Check:

   Auto-approve skips review, causing risk [OK]

Hint: Auto-approve skips review, so risk is blind apply [OK]

Common Mistakes:

• Thinking no changes will apply
• Assuming double confirmation happens
• Believing it only validates without applying

4. You ran terraform apply -auto-approve and accidentally deleted a critical resource. What is the best way to prevent this in the future?

medium

A. Always run terraform apply without any flags.

B. Use -auto-approve only after reviewing the plan with terraform plan.

C. Disable Terraform state locking.

D. Run terraform apply -auto-approve twice to confirm.

Solution

1. Step 1: Identify the cause of accidental deletion

   Using -auto-approve without reviewing the plan can cause unintended changes.

2. Step 2: Find the best practice to avoid mistakes

   Always review the plan output with terraform plan before applying changes automatically.

3. Final Answer:

   Use -auto-approve only after reviewing the plan with terraform plan. -> Option B

4. Quick Check:

   Review plan before auto-approve prevents mistakes [OK]

Hint: Review plan first, then auto-approve safely [OK]

Common Mistakes:

• Thinking running apply without flags always prevents errors
• Disabling state locking which is unrelated
• Running auto-approve twice does not add confirmation

5. In an automated CI/CD pipeline, you want to safely use terraform apply -auto-approve. Which practice reduces the danger of unintended changes?

hard

A. Run terraform plan and save the plan output, then apply only if the plan matches expectations.

B. Use -auto-approve with terraform destroy to clean up resources automatically.

C. Skip the plan step and apply directly to save time.

D. Run terraform apply manually after the pipeline finishes.

Solution

1. Step 1: Understand the risk of auto-approve in automation

   Auto-approve skips manual review, so unintended changes can happen if the plan is not checked.

2. Step 2: Identify a safe automation practice

   Running terraform plan first and saving its output allows verification before applying changes automatically.

3. Step 3: Confirm the best option

   Run terraform plan and save the plan output, then apply only if the plan matches expectations. describes this safe practice, reducing risk in CI/CD pipelines.

4. Final Answer:

   Run terraform plan and save the plan output, then apply only if the plan matches expectations. -> Option A

5. Quick Check:

   Plan then apply ensures safe automation [OK]

Hint: Always plan and verify before auto-approve in pipelines [OK]

Common Mistakes:

• Skipping plan to save time
• Using auto-approve with destroy carelessly
• Running apply manually defeats automation purpose